Multi-tenancy on CloudBolt Documentation

Use cases for multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Bring your own data center

A global managed services provider (MSP) uses Cloud Management Platform (CMP) to provide automation and self-service to its external customers. The MSP offers its customers two options:

Use the MSP’s data centers, along with all their virtualization systems (resource handlers), environments, container orchestrators, configuration managers, and so on, which are set up in CMP as global objects accessible to all tenants.
Bring their own data centers and use the CMP UI to connect to systems within their own data centers, enabling self-service and automation for the resources they already have.

Option 2 is enabled by CMP’s multi-tenancy capabilities. Global administrators set up tenants in CMP, create an admin role with the appropriate admin management permissions (for example, resourcehandler.manage), and grant that role to users while adding them to the appropriate tenant.

Objects and permissions of multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Group and admin permissions

Group permissions govern which users can see and manage servers and resources, and deploy to specific environments. They keep that role when multi-tenancy is enabled.

Multi-tenancy adds finer-grained permissions to the Super Admin global role. This lets you grant users access to manage a subset of admin objects, but only within their tenant.

For a complete multi-tenancy setup, use both group permissions and admin permissions. See Admin roles.

Set up multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

A Super Admin account, plus two users you can log in as who are not Super Admins (for testing).

Set up tenants

Log in to CMP as a Super Admin.
Create a CNAME alias for each tenant, pointing to the CMP server and named for the tenant. (External to CMP.)
Create a group role with the blueprint permissions your tenant admins need, plus order.view and job.view_logs so tenant-specific admin roles can view orders and jobs within their tenant to troubleshoot and monitor.
Create a branded portal for each tenant.
Create a user to administer each tenant.
Create a top-level group for each tenant. The group can have the same name as the tenant.
Add each tenant’s admin user to its group, with the appropriate roles. If you are not sure which roles to assign, add the user to all roles on the group.
Go to Admin > Roles and create at least one admin role with the admin permissions you want to assign to your tenant users. See Admin roles.
Select Admin > Multi-tenancy, add a tenant, and add the users to the tenant with the appropriate admin roles. Use the branded portal.

(opens full-size image in a new tab)
Add the tenant admin to the tenant’s admin role.
Add a resource handler named for the tenant. This is needed if you want the top-level folder in vCenter to match the tenant name or group; otherwise, you can use a global resource handler for all tenants.
Configure the network for the tenant. This is only needed if you want a separate IPAM or IP pool for the tenant’s machines; otherwise, use the global networks configured on the main CMP instance.
Finish setting up an environment for each tenant.
Create a blueprint for each environment. You can also use a global blueprint with different environments. Configure the build step environments as well.

Use RBAC and portals with multi-tenancy

Mon, 01 Jan 0001 00:00:00 +0000

Multi-tenancy allows a single CMP instance to serve multiple organizations while keeping each organization’s data and resources private. Administrators set global policies, automations, blueprints, and actions, and report on usage across all customers, while each tenant gets a tailored hybrid cloud experience.

Multi-tenancy is especially useful for large companies with different lines of business that should not see each other’s servers, blueprints, and environments.

It also suits managed service providers (MSPs) that provide cloud services to external customers, ensuring that customers (internal or external) can access only the resources they are permitted to and cannot interfere with each other’s operations.