From 4147f246dc86a36fbd619bd9258c2d578c416cd7 Mon Sep 17 00:00:00 2001 From: shavidissa Date: Wed, 26 Jun 2024 13:52:35 -0700 Subject: [PATCH 01/12] Remove sunscription sections and the relevant pages --- _data/sidebars/doc_sidebar.yml | 26 -- pages/doc/csp_accounts-service.md | 2 +- pages/doc/csp_api_tokens.md | 6 +- pages/doc/csp_area_differences.md | 485 --------------------- pages/doc/csp_getting_started.md | 94 ---- pages/doc/csp_migration.md | 418 ------------------ pages/doc/csp_sign_up_or_log_in.md | 6 +- pages/doc/csp_supported_integrations.md | 4 +- pages/doc/csp_ui_differences.md | 83 ---- pages/doc/csp_user_management.md | 2 +- pages/doc/csp_users_account_managing.md | 2 +- pages/doc/integrations_new_changed.md | 4 +- pages/doc/purchase-additional-capacity.md | 2 +- pages/doc/wavefront_introduction.md | 2 +- pages/doc/wavefront_obsolescence_policy.md | 4 +- pages/doc/wavefront_release_notes.md | 4 +- 16 files changed, 19 insertions(+), 1125 deletions(-) delete mode 100644 pages/doc/csp_area_differences.md delete mode 100644 pages/doc/csp_getting_started.md delete mode 100644 pages/doc/csp_migration.md delete mode 100644 pages/doc/csp_ui_differences.md diff --git a/_data/sidebars/doc_sidebar.yml b/_data/sidebars/doc_sidebar.yml index 7fc371ae0..90a4d37a8 100755 --- a/_data/sidebars/doc_sidebar.yml +++ b/_data/sidebars/doc_sidebar.yml @@ -18,28 +18,6 @@ entries: - title: Product FAQ output: web url: /tobs_faq.html - - - title: Subscription and Commitment - output: web - folderitems: - - - title: Subscription Types - url: /subscriptions-differences.html - output: web - - subfolders: - - - title: Differences Explained - output: web - subfolderitems: - - - title: "UI Differences" - url: /csp-ui-differences.html - output: web - - - title: "Functionality Differences" - url: /csp-differences-by-area.html - output: web - title: Purchase Additional Capacity url: /purchase_additional_capacity.html @@ -904,10 +882,6 @@ entries: output: web folderitems: - - title: Get Started with VMware Cloud Services - url: /csp_getting_started.html - output: web - - title: Sign Up or Log In url: /csp_sign_up_or_log_in.html output: web diff --git a/pages/doc/csp_accounts-service.md b/pages/doc/csp_accounts-service.md index 8b4b6ea80..9c86836db 100644 --- a/pages/doc/csp_accounts-service.md +++ b/pages/doc/csp_accounts-service.md @@ -11,7 +11,7 @@ summary: Learn how you can create and manage service accounts. {% include warning.html content="The usage of service accounts in Operations for Applications on VMware Cloud services is **restricted** to support only a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens. We are in the process of updating all of our integrations to authenticate with VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future."%} -If your service was recently onboarded to VMware Cloud services, you might have some legacy service accounts for backward compatibility. It's strongly recommended that you incrementally switch to using [server to server OAuth apps](csp_server_to_server_apps.html) which authenticate with more secure VMware Cloud services access tokens. See [How to Replace a Service Account with a Server to Server App?](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app). +If your service was recently onboarded to VMware Cloud services, you might have some legacy service accounts for backward compatibility. It's strongly recommended that you incrementally switch to using [server to server OAuth apps](csp_server_to_server_apps.html) which authenticate with more secure VMware Cloud services access tokens. ## What Are Service Accounts? diff --git a/pages/doc/csp_api_tokens.md b/pages/doc/csp_api_tokens.md index 51c48b476..d88156792 100644 --- a/pages/doc/csp_api_tokens.md +++ b/pages/doc/csp_api_tokens.md @@ -17,7 +17,7 @@ To obtain a VMware Cloud services access token, you must make an API call to the To obtain an Operations for Applications API token, you can also create a service account and generate an API token associated with it. -{% include note.html content="If your original Operations for Applications subscription was recently [onboarded to VMware Cloud services](csp_migration.html), for backward compatibility, you might have some legacy Operations for Applications API tokens that are associated with user accounts and service accounts. It’s recommended that you incrementally replace them with VMware Cloud services API tokens and sever to server OAuth apps."%} + ## Manage the VMware Cloud Services API Tokens for Your User Account @@ -66,7 +66,7 @@ For details on how to create, view, and modify the details of the OAuth 2.0 apps If you want to set up one of the [integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with an **Operations for Applications API token**, you must create a [service account](csp_service_accounts.html) and generate an API token associated with it. -{% include warning.html content="The usage of service accounts in Operations for Applications on VMware Cloud services is **restricted** to support only a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens. We are in the process of updating all of our integrations to authenticate with VMware Cloud services access tokens. It is strongly recommended that you gradually [switch to using server to server OAuth apps](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app) which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future. "%} +{% include warning.html content="The usage of service accounts in Operations for Applications on VMware Cloud services is **restricted** to support only a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens. We are in the process of updating all of our integrations to authenticate with VMware Cloud services access tokens. It is strongly recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future. "%} @@ -92,7 +92,7 @@ To generate and manage the API tokens for an existing **service account**: As a user with the **Admin** service role, you can view and revoke the API tokens of any service account in your service instance. -{% include warning.html content="If your original Operations for Applications subscription was onboarded to VMware Cloud services, for backward compatibility, you might have some legacy Operations for Applications API tokens that are associated with user accounts. It’s recommended that you incrementally [replace them with VMware Cloud services API tokens](csp_migration.html#how-to-replace-an-operations-for-applications-api-token-with-a-vmware-cloud-services-access-token)."%} +{% include warning.html content="If your original Operations for Applications subscription was onboarded to VMware Cloud services, for backward compatibility, you might have some legacy Operations for Applications API tokens that are associated with user accounts. It’s recommended that you incrementally replace them with VMware Cloud services API tokens."%} 1. Log in to your service instance as an **Admin** user. 2. Click the gear icon on the toolbar and select **Accounts**. diff --git a/pages/doc/csp_area_differences.md b/pages/doc/csp_area_differences.md deleted file mode 100644 index c9800637f..000000000 --- a/pages/doc/csp_area_differences.md +++ /dev/null @@ -1,485 +0,0 @@ ---- -title: Differences Between Original and VMware Cloud Services Subscriptions -keywords: -tags: [introduction] -sidebar: doc_sidebar -permalink: csp-differences-by-area.html -summary: Learn about the functionality differences between VMware Aria Operations for Applications original subscriptions and VMware Cloud services subscriptions. ---- - -Operations for Applications subscriptions are two types: original subscriptions and VMware Cloud Services subscriptions. - -## Examples of the Functionality Differences - -### Users, Roles, and Group Management - -Most of the user and account management tasks done in the Operations for Applications UI for original subscriptions, are done in the VMware Cloud services for VMware Cloud services subscriptions. For example, the following tasks related to managing users, roles, and groups can be done from the VMware Cloud Services Console. - - * Invite new users - * Assign permissions - * Create and edit roles - * Create and edit groups - * Assign roles to users and groups - - ![A graphic showing the differences in the user and account management tasks for original and onboarded subscriptions. The information displayed is already described in the above bullet list.](images/user-management-comparison.png) - - -### Admin Tasks - -Some administrative tasks, done by **Super Admins** and users with the **Accounts** permission in original subscriptions, are done by VMware Cloud **Organization Owners** and VMware Cloud **Organization Administrators** in VMware Cloud services subscriptions. Others can be done by Operations for Applications **Admins** in the Operations for Applications UI. - -With the 2023-38 release, we introduce the **Admin** permission and service role, which partially correspond to the **Accounts** permission for original subscriptions. Users with the **Admin** service role can manage service accounts and Operations for Applications API tokens. They can also restrict access to new dashboards and alerts and set the organization settings. For example, they can restrict the access to the object creator only and set default settings, such as display settings, PromQL support, default way of building queries, and define Logs settings. - -{% include warning.html content="Service accounts and the API tokens associated with them will be deprecated in the future. It's strongly recommended that you incrementally switch to using [server to server OAuth apps](csp_server_to_server_apps.html) which authenticate with more secure VMware Cloud services access tokens. For information on how to do this, see [How to Replace a Service Account with a Server to Server App?](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app)." %} - - - -![A graphic showing the differences in the admin tasks for original and onboarded subscriptions. The information displayed is described in the table below.](images/csp-admin-tasks.png) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TaskOriginal SubscriptionVMware Cloud Services Subscription
Upgrade from trial - -
    -
  • Who: Operations for Applications Super Admin
    • -
  • Where: From the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Super Admin service role
    • -
  • Where: From the Operations for Applications UI
    • -
-
Purchase more PPS - -
    -
  • Who: Operations for Applications Super Admin
    • -
  • Where: From the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Super Admin service role
    • -
  • Where: From the Operations for Applications UI
    • -
-
Invite new Super Admins - -
    -
  • Who: Operations for Applications Super Admin
    • -
  • Where: In the Operations for Applications UI
    • -
-		 -
    -
  • Who: VMware Cloud Organization Owner or Organization Administrator
    • -
  • Where: In the VMware Cloud Services Console
    • -
-
Create and manage service accounts and their Operations for Applications API tokens - -
    -
  • Who: Operations for Applications users with the Accounts permission
    • -
  • Where: In the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Admin service role
    • -
  • Where: In the Operations for Applications UI
    • -
-
Restore orphan dashboards and alerts - -
    -
  • Who: Operations for Applications Super Admin
    • -
  • Where: In the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Super Admin service role
    • -
  • Where: In the Operations for Applications UI
    • -
-
Restrict access to new dashboards and alerts - -
    -
  • Who: Operations for Applications users with the Accounts permission
    • -
  • Where: In the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Admin service role
    • -
  • Where: In the Operations for Applications UI
    • -
-
Set the service organization settings - -
    -
  • Who: Operations for Applications users with the Accounts permission
    • -
  • Where: In the Operations for Applications UI
    • -
-		 -
    -
  • Who: Users with the Operations for Applications Admin service role
    • -
  • Where: In the Operations for Applications UI
    • -
-
- -### REST API Access - -For original subscriptions, using the Operations for Applications REST API requires an API token associated with a user account or a service account. To generate API tokens for your user account you need the **API Tokens** permission. To generate API tokens for service accounts and to manage the API tokens in your Operations for Applications organization, you need the **Accounts** permission. - -When your service is onboarded to VMware Cloud services and you want to access the Operations for Applications REST API, you need a VMware Cloud services **access token**. In a few cases, when setting up a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens), authentication with an Operations for Applications API token is also supported. However, using a VMware Cloud services **access token** is the recommended way as we will deprecate the service accounts in the future. To obtain an **access token**, you can: - -* Generate a VMware Cloud services API token associated with your user account and exchange it for an access token. - - ![A graphic showing information how to generate API token for the user account for onboarded and original subscriptions.](images/csp-api-token-user.png) - -* Create a server to server app (which is the equivalent of a service account), obtain its OAuth credentials (app ID and app secret), and exchange them for an access token. - - ![A graphic showing information how to generate API token for a service account or server to server app for onboarded and original subscriptions.](images/csp-api-token-apps.png) - -## In-Depth Explanation of the Functionality Differences - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FunctionalityOriginal SubscriptionVMware Cloud Services Subscription
User Login -Users log in to their Operations for Applications service instance by using the URL of the service cluster, https://<your_instance>.wavefront.com, and their Operations for Applications accounts. If their corporate domain is configured for SAML SSO with Operations for Applications, users log in with their corporate accounts. -Users log in to their Operations for Applications service instance through the VMware Cloud Services Console with their VMware Cloud services accounts. If their corporate domain is federated with VMware Cloud services, users log in with their corporate accounts. For details, see Log In from the VMware Cloud Services Console. -
User Accounts Management - -Who: Users with the Accounts permission. -

Where: In the Operations for Applications user interface.

-

How: You can invite new users with or without assigning roles and permissions. For details, see Manage User Accounts.

-		 -Who: Users with the VMware Cloud Organization Owner or Organization Administrator role. -

Where: In the VMware Cloud Services Console.

-

How: To add a user to your Operations for Applications service instance, you must assign that user: -

  1. An organization role for the VMware Cloud organization running the service instance. At a minimum, you must assign the VMware Cloud Organization Member role.
    2. -
  2. An Operations for Applications service role for your service instance. At a minimum, you must assign the Viewer service role.
    3. -
  3. Optionally, a custom role with one or more Operations for Applications permissions. A custom role applies to all service instances for which the user has an Operations for Applications service role.
-For details, see Manage User Accounts.

-
Service Accounts and Server to Server OAuth Apps Management -Note: Only service accounts are supported. -

Who: Users with the Accounts permission.

-

Where: In the Operations for Applications user interface.

-

How: Service accounts authenticate with API tokens. Service accounts can be assigned with roles and permissions, as well as can be added to groups. For details, see Manage Service Accounts.

-		Note: Server to server OAuth apps are recommended and fully supported. Service accounts are with limited support and will be deprecated in the future. -

Who: -

    -
  • For server to server OAuth apps, users with the VMware Cloud Organization Owner, Organization Administrator, or Organization Member with the Developer role assigned.
    • -
  • For service accounts, users with the Admin Operations for Applications service role.
    • -

-

Where: -

    -
  • For server to server OAuth apps, in the VMware Cloud Services Console.
    • -
  • For service accounts, in the Operations for Applications user interface.
    • -

-

How: -

    -
  • Server to server OAuth apps authenticate with VMware Cloud services access tokens that can be exchanged from their OAuth credentials. Server to server OAuth app can be assigned with organization roles, service roles, and custom roles, and can belong to one or more VMware Cloud organizations. For details, see Manage Server to Server Apps.
    • -
  • Service accounts authenticate with Operations for Applications API tokens. Service accounts can be assigned with permissions only, and cannot be added to groups. For details, see Manage Service Accounts.
    • -

-
Permissions Management -Who: Users with the Accounts permission. -

Where: In the Operations for Applications user interface.

-

How: Permissions can be assigned to roles as well as to individual user accounts and service accounts.

-

See: -

-

Note: The permissions list includes the Accounts, SAML IdP Admin, and API token permissions, because they are required for all of the authorization and authentication tasks which are done in the Operations for Applications.

-

In addition, the Accounts permission grants privileges for managing the Operations for Applications organization settings.

-

See the Permissions Reference.

-		Who: -
    -
  • For assigning permissions to roles, users with the VMware Cloud Organization Owner or Organization Administrator role.
    • -
  • For assigning permissions to service accounts, users with the Admin Operations for Applications service role.
    • -
-

Where: -

    -
  • For assigning permissions to roles, in the VMware Cloud Services Console.
    • -
  • For assigning permissions to service accounts, in the Operations for Applications user interface.
    • -

-

How: Permissions can be assigned only to roles in the VMware Cloud services organization and service accounts - in the Operations for Applications environment.

-

See: -

-

-

Note: The Accounts, SAML IdP Admin, and API token permissions don't exist, because most of the authorization and authentication tasks requiring these permissions are done in the VMware Cloud Services Console.

-

The Admin Operations for Applications permission grants privileges for managing service accounts, Operations for Applications API tokens, and the Operations for Applications organization settings.

-

See the Operations for Applications Permissions in VMware Cloud Services.

-
Roles Management -Who: Users with the Accounts permission. -

Where: In the Operations for Applications user interface.

-

How: Roles can be assigned with permissions. Roles can be assigned to user accounts, service accounts, and groups. For details, see Manage Roles and Permissions.

-		 -Who: Users with the VMware Cloud Organization Owner or Organization Administrator role. -

Where: In the VMware Cloud Services Console.

-

How: Roles can be assigned with permissions. Roles can be assigned to users, groups, API tokens, and server to server apps. There are: -

    -
  • Built-in Operations for Applications service roles, which are not editable. Each Operations for Applications permission is represented with a service role. In addition, the Super Admin and Viewer service roles grant full-administrative and view-only access, respectively.
    • -
  • Custom roles can be created and assigned with permissions for one or more services.
    • -
-For details, see Manage Roles.

-
Groups Management -Who: Users with the Accounts permission. -

Where: In the Operations for Applications user interface.

-

How: A group of user and service accounts can be assigned with one or more roles. For details, see Create a Group.

-		 -Who: Users with the VMware Cloud Organization Owner or Organization Administrator role. -

Where: In the VMware Cloud Services Console.

-

How: A group of users can be assigned with organization and service roles. A group can be shared with other VMware Cloud organizations. In a federated environment, you can add enterprise groups from your corporate domain. For details, see How do I work with groups in the VMware Cloud services documentation.

-
Self-Service SAML SSO -Who: Users with the SAML IdP Admin permission. -

Where: In the Operations for Applications user interface.

-

How: Operations for Applications includes predefined authentication integrations. For details, see Single-Tenant Authentication and Self-Service SAML SSO.

-		 -Who: A user with the VMware Cloud Organization Owner role together with an Enterprise Administrator. -

Where: In the VMware Cloud Services Console.

-

How: The VMware Cloud Organization Owner user kicks off the self-service federation workflow on behalf of the VMware Cloud organization and invites the Enterprise Administrator to complete the setup. For details, see Setting Up Enterprise Federation with VMware Cloud Services Console in the VMware Cloud services documentation.

-
Generating API Tokens -Note: Only Operations for Applications API tokens are supported. -

Who: -

  • For API tokens associated with a user account, the corresponding user who must have the API Tokens permission.
    • -
  • For API tokens associated with service accounts, the users with the Accounts permission.
    • -

-

Where: In the Operations for Applications user interface.

-

How:

    -
  • A user with the API Tokens permission can generate Operations for Applications API tokens for their own user account. The API tokens inherit all permissions that its associated user account owns.
    • -
  • Users with the Accounts permission can generate Operations for Applications API tokens for service accounts. The API tokens inherit the permissions of their associated service account.
-For details, see Manage API Tokens.

-		Note: It is recommended to use VMware Cloud services API tokens and server to server OAuth app credentials for obtaining VMware Cloud services access tokens. Operations for Applications API tokens are with limited support and will be deprecated in a future release. -

Who: -

  • For VMware Cloud services API tokens associated with a user account, the corresponding user.
    • -
  • For Operations for Applications API tokens associated with service accounts, the users with the Admin Operations for Applications service role.
    • -

-

Where: -

  • For VMware Cloud services API tokens associated with a user account, in the VMware Cloud Services Console.
    • -
  • For Operations for Applications API tokens associated with service accounts, in the Operations for Applications user interface.
    • -
-

-

How: -

  • Each user can generate VMware Cloud services API tokens for their user account. An API token can be assigned with roles from the list of roles that the user owns - organization roles, service roles, and custom roles. For details and instructions, see How do I generate API tokens in the VMware Cloud services documentation.
    • -
  • Users with the Admin service role can generate Operations for Applications API tokens for service accounts. The API tokens inherit the permissions of their associated service account. For details, see Manage Service Accounts. -
    • -
-

-
API Tokens Management -Who: -
  • For API tokens associated with a user account, the corresponding user.
    • -
  • For all API tokens in the Operations for Applications service instance, the users with the Accounts permission.
-

Where: In the Operations for Applications user interface.

-

How:

-		 -Who: -
  • For VMware Cloud services API tokens associated with a user account, the corresponding user.
    • -
  • For all VMware Cloud services API tokens in the VMware Cloud organization, the users with the VMware Cloud Organization Owner role if the organization is activated for Identity Governance and Administration (IGA).
    • -
  • For all Operations for Applications API tokens (limited support), the users with the Admin Operations for Applications service role.
-

Where: -

  • For VMware Cloud services API tokens, in the Cloud Services Console.
    • -
  • For Operations for Applications API tokens (limited support), in the Operations for Applications user interface.
-

-

How: -

-
Operations for Applications REST API Access -Who: Everyone who has an Operations for Applications API token associated with a user account or a service account. -

Where: An API client.

-

How: Interacting with the Operations for Application REST API requires an Operations for Application API token. -

-		 -Who: Everyone who has a VMware Cloud services API token or the credentials of a server to server OAuth app. -

Where: An API client.

-

How: Interacting with the Operations for Application REST API requires a VMware Cloud services access token. -

  • To interact with the REST API on behalf of your user account, you must exchange your VMware Cloud services API token for an access token. For details, see Make API Calls by Using a User Account.
    • -
  • To interact with the REST API on behalf of your VMware Cloud organization, you must exchange the OAuth credentials of a server to server app for an access token. For details, see Make API Calls by Using a Server to Server App.
    • -
-

-
Operations for Applications Organization Settings -Who: Users with the Accounts permission. -

Where: In the Operations for Applications user interface.

-

How: As a user with the Accounts permission, you can configure: -

-		 -Who: Users with the Admin Operations for Applications service role. -

Where: In the Operations for Applications user interface.

-

How: As a user with the Admin service role, you can configure: -

-
Wavefront Proxy Installation -Note: The Wavefront proxy authenticates with an Operations for Applications API token. -

Who: Users with the Proxies permission.

-

Where: In the Operations for Applications user interface.

-

How: As a user with the Proxies permission, you must configure the proxy to authenticate to Operations for Applications with an Operations for Applications API token that have the Proxies permission. For details, see Install a Proxy from the UI.

-		Note: The Wavefront proxy authenticates with a VMware Cloud services access token obtained from server to server OAuth app credentials or from a VMware Cloud services API token. Proxy authentication with an Operations for Applications API token is still possible and supported only for a limited list of integrations. -

Who: -

    -
  • For proxy installation, users with the Proxies Operations for Applications service role.
    • -
  • For creating server to server OAuth apps, users with the VMware Cloud Organization Owner, Organization Administrator, or Organization Member with Developer roles.
    • -
  • For generating an Operations for Applications API token of a service account, users with the Admin Operations for Applications service role.
    • -

-

Where: -

    -
  • For generating a VMware Cloud services API token or creating a server to server OAuth app, in the VMware Cloud Services Console.
    • -
  • For proxy installation and generating an Operations for Applications API token for a service account, in the Operations for Applications user interface.
    • -

-

How: As a user with the Proxies service role, you configure the proxy to authenticate to Operations for Applications. The proxy obtains a VMware Cloud services access token with the Proxies service role or use an Operations for Applications API token of a service account with the Proxies permission. To obtain a VMware Cloud services access token: -

  • The proxy can use the credentials of a server to server OAuth app - ID and secret, together with the VMware Cloud organization long ID.
    • -
  • The proxy can use the VMware Cloud services API token of an active user account.
-In both ways, the access token is directly issued to the proxy. For details, see Proxy Authentication Types.

-
Integrations Installation -Note: All integrations that use a Wavefront proxy authenticate with an Operations for Applications API token. -

Who: Users or service accounts with the Proxies permission who have an active Operations for Applications API token.

-

Where: In the Operations for Applications user interface.

-

How: Follow the instructions on the Setup tab of the integration that you want to install.

-		Note: Most of the integrations that use a Wavefront proxy authenticate with a VMware Cloud services access token. A limited list of integrations still use proxy authentication with an Operations for Applications API token. -

Who: Users with the Proxies Operations for Applications service role who must have one of the following: -

    -
  • A valid VMware Cloud services API token with the Proxies service role assigned.
    • -
  • The credentials of a server to server OAuth app with the Proxies service role assigned.
    • -
  • An Operations for Applications API token associated with a service account that has the Proxies permission.
    • -

-

Where: In the Operations for Applications user interface.

-

How: Follow the instructions on the Setup tab of the integration that you want to install.

-
Metrics Security Policy Management -Who: Users with the Metrics permission. -

Where: In the Operations for Applications user interface.

-

How: Privileged users can block or allow access to metrics for: -

-For details, see Metrics Security Policy Rules.

-		Who: Users with the Metrics Operations for Applications service role. -

Where: In the Operations for Applications user interface.

-

How: Privileged users can block or allow access to metrics for: -

-For details, see Metrics Security Policy Rules.

-
\ No newline at end of file diff --git a/pages/doc/csp_getting_started.md b/pages/doc/csp_getting_started.md deleted file mode 100644 index cc5970070..000000000 --- a/pages/doc/csp_getting_started.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Getting Started with Operations for Applications on VMware Cloud Services -tags: [administration] -sidebar: doc_sidebar -permalink: csp_getting_started.html -summary: Learn the basics for administering your service on the VMware Cloud services platform. ---- -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. From this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to VMware Cloud services and **original** subscriptions. - -Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally [onboarding](csp_migration.html) all original subscriptions to VMware Cloud services. For information about original and VMware Cloud services subscriptions and the differences between them, see [Differences Between Original and VMware Cloud Services Subscriptions](csp-differences-by-area.html). - -VMware Cloud services provides features to your Operations for Applications environment, such as: -- Single sign-on (SSO) with VMware Cloud services accounts. -- SAML 2.0 SSO identity federation with your enterprise identity provider. -- Identity access management (IAM) with built-in and custom service roles. -- Seamless integration with other services from your VMware Cloud services portfolio, for example, VMWare Aria Operations for Logs. -- Billing and Subscriptions - -See the [Advantages of VMware Cloud Services Subscriptions Over Original Subscriptions](subscriptions-differences.html#advantages-of-vmware-cloud-services-subscriptions-over-original-subscriptions). - -## What's VMware Cloud Services Console? - -The VMware Cloud Services Console lets you manage your entire VMware Cloud services portfolio across hybrid and native public clouds. Operations for Applications is one of the many services that you can access, configure, and consume through this console. - -To open the VMware Cloud Services Console: - -- In a Web browser, go to `https://console.cloud.vmware.com`. -- From the Operations for Applications UI, click the **VMware Cloud Services Applications Menu** icon (![applications icon](images/applications-solid.png)) in the top-right corner and select **Cloud Services Console**. - -See [Using VMware Cloud Services Console](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-20D62AFF-024B-4901-976D-69BFD71BECC8.html) in the VMware Cloud services documentation. - -## What's a VMware Cloud Services Account? - -A VMware Cloud services account is a user (human) account in VMware Cloud services with which you can access all of your service instances, including Operations for Applications. A VMware Cloud services account logs in to VMware Cloud services with an email address and a password. A VMware Cloud services account can be one of the following: -- A VMware account (VMware ID) that you create in the VMware Cloud Services Console. - - You can create a VMware account while [signing up](csp_sign_up_or_log_in.html) to a service with an invitation link. -- Your corporate account if your enterprise domain is federated. You might still need to create a VMware account and link it to your corporate account if you need to access billing information in the organization. See [What is enterprise federation and how does it work](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-76FAECB3-CFAA-461E-B9C9-2A49C39CD17F.html) in the VMware Cloud services documentation. - -## What's a VMware Cloud Organization? - -VMware Cloud services uses organizations to provide controlled access to one or more services. The VMware Cloud organization is a top-level construct which owns users and cloud services (subscriptions). -* You can have multiple VMware Cloud organizations. -* Users can belong to multiple organizations. -* Multiple service instances can run in the same or in different organizations. - -For example, you can have a multi-tenant Operations for Applications environment with multiple service instances (tenants) in the same organization. - -{% include note.html content="You can create a VMware Cloud organization only when you are onboarding a new service instance, for example, when you sign up for an Operations for Applications account."%} - -See [How do I manage my Cloud Services organizations](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-CF9E9318-B811-48CF-8499-9419997DC1F8.html) in the VMware Cloud services documentation. - -## What's a VMware Cloud Organization Role? - -A VMware account can belong to one or more VMware Cloud organizations. A VMware account belongs to a given VMware Cloud organization if the account has an organization role for that organization. There are three VMware Cloud organization roles: - - - - - - - - - - - - - - - - - - -
RoleDescription
Organization OwnerThe VMware Cloud Organization Owner role has full administrative access to all resources in the organization. They can invite users to the organization and assign role-based access to all users, including themselves. They can also kick off an enterprise domain federation and invite an Enterprise Administrator. See Setting Up Enterprise Federation with VMware Cloud Services Guide in the VMware Cloud services documentation. -

When you create an organization during a service onboarding process, you become its first Organization Owner.

Organization AdministratorThe VMware Cloud Organization Administrator role has limited administrative access. Users with that role can invite and manage only users that have roles with lower administrative permissions. For example, they can grant or manage access for other users and groups who have the Organization Member role, but cannot manage users, groups, or resources who are assigned the Organization Owner or Organization Administrator role.

Users with the Organization Administrator role can have additional access if other permissions are explicitly assigned to them. For example, when the Billing Read-only check box is selected, users with the Organization Administrator role can have read-only access to billing-related information and the option to generate usage consumption reports.

-
Organization MemberThe VMware Cloud Organization Member role has read-only access to the resources in the organization.

Users with the Organization Member role can have additional access when additional permissions are explicitly assigned to them. For example, when the Access Log Auditor check box is selected, they can access all audit data for the organization in the associated vRealize Log Insight Cloud service instance for their organization.

- -See [What organization roles are available in VMware Cloud Services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-C11D3AAC-267C-4F16-A0E3-3EDF286EBE53.html) in the VMware Cloud services documentation. - -## What Are Service Roles and Custom Roles? - -VMware Cloud services includes service-specific built-in roles, including [Operations for Applications service roles](csp_users_roles.html#operations-for-applications-service-roles-built-in). A service role is required to grant certain access to the corresponding service instance in the organization. - -While the service roles are built-in and not editable, as a VMware Cloud **Organization Administrator** or **Organization Owner**, you can create [custom roles](csp_users_roles.html#create-edit-or-delete-a-custom-role) with service permissions of your choice, including [Operations for Application permissions](csp_permissions_overview.html#operations-for-applications-permissions). Custom roles are optional and apply to all service instances for which the target user or server to server app has at least one service role. - -## What's a Server to Server App? - -If you want to use an application for automating management tasks in your service, for example, in Operations for Applications, your application requires direct access to your service, without user authorization. - -For that purpose, VMware Cloud services supports server to server apps, which are based on OAuth 2.0 client credentials grant type. You can configure your application to pass the OAuth 2.0 client credentials (id and secret) to the VMware Cloud services REST API and exchange the credentials for a VMware Cloud services access token. Your application can use the VMware Cloud services access token to interact with the Operations for Applications REST API. - -See [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. - -{% include important.html content="For each server to server app with access to an Operations for Applications service instance, we create a corresponding **internal service account** in that service instance and add it the **Service Accounts** internal system group. So that, when you configure [the access control security settings](csp_access.html#change-the-access-control-security-setting), [ingestion polices](ingestion_policies.html#step-1-specify-the-scope-and-pps-limit), or [metrics security rules](csp_metrics_security.html), the server to server apps that are assigned with Operations for Applications service roles are represented as service accounts together with the [service accounts](csp_service_accounts.html) created in Operations for Applications."%} diff --git a/pages/doc/csp_migration.md b/pages/doc/csp_migration.md deleted file mode 100644 index 35b3faf69..000000000 --- a/pages/doc/csp_migration.md +++ /dev/null @@ -1,418 +0,0 @@ ---- -title: Onboarding Original Subscriptions to VMware Cloud Services -keywords: administration -tags: [administration] -sidebar: doc_sidebar -permalink: csp_migration.html -summary: Learn about how we migrate the authorization and authentication from Operations for Applications to VMware Cloud services. ---- - -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. We are in the process of incrementally onboarding all original subscriptions to VMware Cloud services. - -## What Should I Do Before the Onboarding? - -Currently, all original Operations for Applications subscriptions are integrated with VMware Cloud services for billing and subscription management. Therefore, you must already have a [VMware Cloud organization](csp_getting_started.html#whats-a-vmware-cloud-organization) with at least one user with the [VMware Cloud **Organization Owner** role](csp_getting_started.html#whats-a-vmware-cloud-organization-role). - -Before the onboarding: -* Get familiar with the VMware Cloud service platform. See [Getting Started with Operations for Applications on VMware Cloud Services](csp_getting_started.html). -* Verify that your VMware Cloud **Organization Owner** user can log in to the [VMware Cloud Services Console](https://console.cloud.vmware.com). - - - If you are the VMware Cloud **Organization Owner** user and cannot log in, try using the **Forgot Password** option. - - If your VMware Cloud **Organization Owner** user is unreachable or you don't know the name of your VMware Cloud **Organization Owner** user, contact our Technical Support team for assistance. -* If you have a [SAML SSO integration](auth_self_service_sso.html), as a VMware Cloud **Organization Owner** user, you must federate your currently integrated enterprise domain with your VMware Cloud organization. For details, see the [Setting Up Enterprise Federation with VMware Cloud Services Guide](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-76FAECB3-CFAA-461E-B9C9-2A49C39CD17F.html) in the VMware Cloud services documentation. - - {% include warning.html content="If you do not federate your currently integrated enterprise domain, after onboarding to VMware Cloud services all users will lose access to the service."%} - - - - - -
 click for top of page
- -## What's the Onboarding Process? - -The onboarding is done by our team. If you are currently using a SAML SSO integration, you must only federate your enterprise domain before the process starts. The following flowchart shows the overall process. - -![Onboarding flowchart. Each stage of the process is described below.](images/csp-onboarding-flow.png) - -Here's the process: -1. You receive a notification in your service UI with the date scheduled for your service onboarding to VMware Cloud services. -1. If you are using a SAML SSO integration, your VMware Cloud **Organization Owner** user federates your currently integrated enterprise domain with your VMware Cloud organization. That must happen before the scheduled onboarding date. -1. On the scheduled date, we onboard your service instance to VMware Cloud services, that is, we migrate your users, roles, and groups to your VMware Cloud organization. During the process, there's a banner notification in your service UI. - - {% include important.html content="During the onboarding, you should not to do any changes related to users, roles, groups, and permissions. Such changes might be lost."%} -1. When the onboarding completes, you can see a banner notification in your service UI and, shortly after that, all active users are logged out. -1. Each user receives an email with an invitation link to sign up to VMware Cloud services. - - The invitation links are valid for seven days. -1. Each user redeems the invitation link and [signs up](csp_sign_up_or_log_in.html#sign-up-with-an-email-invitation) to the VMware Cloud Services Console. - - - The users of a non-federated domain must create a password for their VMware Cloud services account. - - - The users of a federated domain must log in with their existing corporate passwords. - -{% include tip.html content="From now on, **all** users [log in](csp_sign_up_or_log_in.html#log-in-from-the-vmware-cloud-services-console) to the service instance from the [VMware Cloud Services Console](https://console.cloud.vmware.com)."%} - - - - - -
 click for top of page
- -## How Are the Users Migrated to VMware Cloud Services? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, we add all your current users to your VMware Cloud organization running the service. - -![An image displaying how users are migrated when your Operations for Applications service is onboarded to VMware Cloud services. The information from the image is explained in the bullet list below.](images/csp-user-accounts-migration.png) - -* If a user is a **Super Admin** in Operations for Applications, we assign that user with the **Super Admin** Operations for Applications service role in VMware Cloud services. -* If a user is assigned with individual permissions in Operations for Applications, we assign that user with the corresponding [Operations for Applications service roles](csp_users_roles.html#operations-for-applications-service-roles-built-in) in VMware Cloud services. For example, if a user has the **Alerts** permission in Operations for Applications, we assign that user with the **Alerts** Operations for Applications service role in VMware Cloud services. There are the following exceptions: - - - The **Accounts** permission is replaced by the [VMware Cloud **Organization Administrator** role](csp_getting_started.html#whats-a-vmware-cloud-organization-role) plus the **Admin** Operations for Applications service role. - - The **API Tokens** permission is not replaced by any role, because this privilege is not needed in VMware Cloud services. Each VMware Cloud services user can manage their own VMware Cloud services API tokens. - - The **SAML IdP Admin** permission is not replaced by any role, because this privilege is not needed in VMware Cloud services. The VMware Cloud **Organization Owner** initiates enterprise federation for your corporate domain and assigns an **Enterprise Administrator**. - - For details, see the [permissions differences](csp-differences-by-area.html#permissions). -* If a user does not have any permissions and roles in Operations for Applications, we assign that user with the **Viewer** Operations for Applications service role in VMware Cloud services. -* If a user is assigned with roles in Operations for Applications, we assign that user with the corresponding custom roles in VMware Cloud services. See [How Are the Roles Migrated to VMware Cloud Services?](#how-are-the-roles-migrated-to-vmware-cloud-services). -* If a user belongs to a group in Operations for Applications, we add that user to the corresponding group in VMware Cloud services. See [How Are the Groups Migrated to VMware Cloud Services?](#how-are-the-groups-migrated-to-vmware-cloud-services). - -{% include tip.html content="From now on, users with the VMware Cloud **Organization Owner** and **Organization Administrator** roles can [manage the Operations for Applications users](csp_user_management.html) in the VMware Cloud Services Console."%} - - - - - -
 click for top of page
- -## How Are the Groups Migrated to VMware Cloud Services? - -Originally, your Operation for Applications service includes the **Everyone** and **Service Accounts** system groups as well as any other custom groups that you have created. - -### How Are the Custom Groups Migrated? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, for each group that you have created in Operations for Applications, we create a corresponding group in your VMware Cloud organization running the service. - -* The corresponding VMware Cloud groups are with the same names and descriptions as the original Operations for Applications custom groups. -* All users from a custom group in Operations for Applications are added to the corresponding VMware Cloud group. -* The service accounts from the custom groups in Operations for Applications **are not** added to any VMware Cloud group. - - {% include important.html content="Currently, VMware Cloud services supports grouping only for user accounts."%} -* If a custom group in Operations for Applications is assigned with roles, the corresponding VMware Cloud group is assigned with the corresponding VMware Cloud custom roles. See [How Are the Roles Migrated to VMware Cloud Services?](#how-are-the-roles-migrated-to-vmware-cloud-services). - -{% include tip.html content="From now on, users with the VMware Cloud **Organization Owner** and **Organization Administrator** roles can [manage the user groups](csp_users_roles.html#manage-user-groups) in the VMware Cloud Services Console."%} - -### How Is the Everyone System Group Migrated? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, for the **Everyone** system group in Operations for Applications, we create the corresponding **All Operations for Applications Users** group in your VMware Cloud organization running the service as follows: - -* All current users are added to the **All Operations for Applications Users** VMware Cloud group. - - {% include important.html content="New users will **no longer** be added automatically to this group."%} -* The **All Operations for Applications Users** VMware Cloud group is assigned with the **All Operations for Applications Users** VMware Cloud custom role, which corresponds to the **Everyone** role in Operations for Applications. See [How Are the Roles Migrated to VMware Cloud Services?](#how-are-the-roles-migrated-to-vmware-cloud-services). -* If the **Everyone** system group in Operations for Applications is assigned with custom roles, the **All Operations for Applications Users** VMware Cloud group is assigned with the corresponding VMware Cloud custom roles. See [How Are the Roles Migrated to VMware Cloud Services?](#how-are-the-roles-migrated-to-vmware-cloud-services). -* In Operations for Applications, we continue to maintain the **Everyone** system group only as a local **internal** group that is automatically populated with all new users. This group has no roles and permissions. - -{% include tip.html content="From now on, it is up to you to add new users to the **All Operations for Applications Users** VMware Cloud group. The **Everyone** internal system group can be used only when managing [access to dashboards and alerts](csp_access.html), [metrics security policy rules](csp_metrics_security.html), and [ingestion policies](ingestion_policies.html)."%} - -### What Happens with the Service Accounts System Group? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, we **do not** migrate the **Service Accounts** system group. - -{% include important.html content="Currently, VMware Cloud services supports grouping only for user accounts."%} - -* The permissions from the roles assigned to the **Service Accounts** system group in Operations for Applications are now directly assigned to the service accounts. See [What Happens with the Service Accounts?](#what-happens-with-the-service-accounts). -* In Operations for Applications, we continue to maintain the **Service Accounts** system group only as a local **internal** group that is automatically populated with all [service accounts](csp_service_accounts.html) and [server to server OAuth apps](csp_server_to_server_apps.html) that have access to the service instance. This group has no roles and permissions. - -{% include tip.html content="From now on, the **Service Accounts** internal system group can be used only when managing [access to dashboards and alerts](csp_access.html), [metrics security policy rules](csp_metrics_security.html), and [ingestion policies](ingestion_policies.html)."%} - - - - - -
 click for top of page
- -## How Are the Roles Migrated to VMware Cloud Services? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, for each role in Operations for Applications, we create a corresponding [custom role](csp_users_roles.html#create-edit-or-delete-a-custom-role) in your VMware Cloud organization running the service as follows: - -* For each role that you have created in Operations for Applications, we create a corresponding VMware Cloud custom role with the same name and description. -* For the **Everyone** role that is assigned to the **Everyone** system group in Operations for Applications, we create the **All Operations for Applications Users** VMware Cloud custom role. See [How Is the Everyone System Group Migrated?](#how-is-the-everyone-system-group-migrated). -* For the **Service Accounts** role that is assigned to the **Service Accounts** system group in Operations for Applications, we **do not** create any VMware Cloud custom role, because this group is not migrated. See [What Happens with Service Accounts System Group?](#what-happens-with-the-service-accounts-system-group). -* The corresponding VMware Cloud custom roles are assigned with the same [permissions](csp_permissions_overview.html) as the original roles in Operations for Applications. There are the following exceptions: - - - The **Accounts** permission in Operations for Applications is replaced by the **Admin** Operations for Applications permission in VMware Cloud services. In addition, the users with that permission are assigned with the [VMware Cloud **Organization Administrator** role](csp_getting_started.html#whats-a-vmware-cloud-organization-role). - - The **API Tokens** permission in Operations for Applications **is not** replaced by any permission in VMware Cloud services. This permission does not exist in VMware Cloud services, because each user can manage their own VMware Cloud services API tokens. - - The **SAML IdP Admin** permission in Operations for Applications **is not** replaced with by permission in VMware Cloud services. This permission does not exist in VMware Cloud services, because the VMware Cloud **Organization Owner** initiates enterprise federation for your corporate domain and assigns an **Enterprise Administrator**. - - For details, see the [permissions differences](csp-differences-by-area.html#permissions). - -{% include tip.html content="From now on, users with the VMware Cloud **Organization Owner** and **Organization Administrator** roles can [manage the custom roles](csp_users_roles.html#create-edit-or-delete-a-custom-role) in the VMware Cloud Services Console."%} - - - - - -
 click for top of page
- -## What Happens with the Service Accounts? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, the service accounts **are not** migrated to VMware Cloud services, because VMware Cloud services supports [server to server OAuth apps](csp_server_to_server_apps.html), which are equivalent to the services accounts in Operations for Applications. - -{% include warning.html content="The usage of service accounts in Operations for Applications on VMware Cloud services is **restricted** to support only a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens. We are in the process of updating all of our integrations to authenticate with VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future."%} - -For backward compatibility, all of your service accounts are **preserved** in Operations for Applications as follows: - -* The service accounts no longer belong to groups, because the groups management is migrated to VMware Cloud services. -* The service accounts no longer have roles, because the roles management is migrated to VMware Cloud services. -* The service accounts are assigned with their existing permissions, including the permissions that they have inherited from roles and group roles. Exceptions are the **API Tokens** and **SAML IdP Admin** permissions, which no longer exist. - - {% include note.html content="The **Accounts** permission in Operations for Applications corresponds to the [**Admin** Operations for Applications permission](csp_permissions_overview.html) in VMware Cloud services."%} -* All service accounts still belong to the **Service Accounts** system group, which is now only an **internal** Operations for Applications group that is automatically populated with all [service accounts](csp_service_accounts.html) and [server to server OAuth apps](csp_server_to_server_apps.html) that have access to the service instance. This group has no roles and permissions. - -You should incrementally [replace](#how-to-replace-a-service-account-with-a-server-to-server-app) your service accounts in Operations for Applications with server to server OAuth apps in VMware Cloud services. - -{% include tip.html content="From now on, users with the VMware Cloud **Organization Owner**, **Organization Administrator**, or **Organization Member** with **Developer** roles can [manage server to server apps](csp_server_to_server_apps.html) in the VMware Cloud Services Console. Users with the **Admin** service role can [manage the service accounts](csp_service_accounts.html) in Operations for Applications. The **Service Accounts** internal system group can be used only when managing [access to dashboards and alerts](csp_access.html), [metrics security policy rules](csp_metrics_security.html), and [ingestion policies](ingestion_policies.html)."%} - -### How to Replace a Service Account with a Server to Server App? - -Service accounts authenticate with Operations for Applications API tokens, while server to server OAuth apps authenticate with the more secure VMware Cloud services access tokens. Service accounts are supported for a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) but will be deprecated in the future. - - - - - - - - -
-

 

-

 

-

 

-

 

-

 

-

 

-After onboarding to VMware Cloud services, you should incrementally replace your service accounts in Operations for Applications with server to server OAuth apps in VMware Cloud services. - -

The flowchart on the right shows the overall process for creating a server to server OAuth app and replacing a service account with it. -		 -Flowchart showing how to replace a service account with a server to server app. The process is described in the list below -
- -1. Log in to the VMware Cloud Services Console as an **Organization Owner**, **Organization Administrator**, or **Organization Member** with the **Developer** role assigned. -1. Create a server to server OAuth app. See [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. - - - For the server to server app name and description, you can enter the name and the description of the service account that you want to replace. - - For the time to live (TTL) of the access tokens that will be issued to that server to server app, you can configure a value from 1 to 300 minutes. This value defines the period in which the access token should be renewed. - - For the scopes of the server to server app, you must configure the roles that correspond to the permissions of the service account that you want to replace: - - - - - - - - - - - - - - - - - - - - -
Scope - Description -
- Organization Role - Organization Member is sufficient in most of the cases. -
- Custom Roles - Optional. Use only if you previously created a custom role with the necessary Operations for Applications permissions. -
Service Roles - Required for service access. Assign the Operations for Applications service roles that correspond to the permissions of the service account that you want to replace. -

If you already assigned a custom role, you must assign at least the Viewer Operations for Applications service role.

-
-1. Make sure that you save the app credentials (ID and secret) of your newly created server to server app to a secure location. - - {% include important.html content="This is the only time you can see and save the app secret. If you miss to copy it or lose it, you must regenerate the app secret."%} -1. Add the server to server app to your VMware Cloud organization. -1. Reconfigure your scripts, API calls, or proxies to exchange the app credentials for an access token, instead of using the API tokens associated with the service account. - - {% include important.html content="Depending on the TTL that you configured for the app access tokens, make sure that your script renews the access token periodically before it expires. The Wavefront proxy does this automatically. "%} -1. Log in to your service instance as a user with the **Admin** service role and [deactivate or delete](csp_service_accounts.html#deactivate-or-activate-a-service-account) the service account that you replaced. - - - - - -
 click for top of page
- -## What Happens with the Operations for Applications API Tokens? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, the Operations for Applications API tokens **are not** migrated to VMware Cloud services, because Operations for Applications on VMware Cloud services supports authentication with: - -* VMware Cloud services API tokens associated with user accounts. -* Server to server OAuth apps credentials, that is, app ID and app secret. The server to server OAuth app must belong to the organization that is running the Operations for Applications service. - -You must exchange a VMware Cloud services API token or the credentials (ID and secret) of server to server OAuth app for a VMware Cloud services **access token**. - -For backward compatibility, all of your API tokens are **preserved** in Operations for Applications as follows: - -* The Operations for Applications API tokens associated with user accounts are **no longer** editable. The users can still use, view, and revoke their Operations for Applications API tokens until they expire, but they **cannot** generate new ones. -* The Operations for Applications API tokens associated with service accounts are editable, because we still support them for a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens). - -You should incrementally [replace](#how-to-replace-an-operations-for-applications-api-token-with-a-vmware-cloud-services-access-token) your Operations for Applications API tokens with VMware Cloud services API tokens and server to server OAuth apps. - -{% include tip.html content="From now on, all users must generate VMware Cloud services API tokens for their accounts and exchange them for access tokens. Users with the VMware Cloud **Organization Owner**, **Organization Administrator**, or **Organization Member** with **Developer** roles can create server to server OAuth apps and exchange the app credentials for access tokens."%} - -### How to View and Manage the Operations for Applications API Tokens? - -Users with the **Admin** Operations for Applications service role can [manage](csp_api_tokens.html#manage-the-operations-for-applications-api-tokens-in-your-service-instance) the Operations for Applications API tokens in the service instance. - -Each user can view and revoke their own Operations for Applications API tokens: - -1. Log in to your service instance. -1. From the gear icon on the toolbar, select your username. -1. Click the **API Access** tab and view all your Operations for Applications API tokens. -1. To revoke a token, click the **Revoke** button for the token. - - If you run a script that uses a revoked token, the script returns an authorization error. - -### How to Replace an Operations for Applications API Token with a VMware Cloud Services Access Token? - -It's recommended to use Operations for Applications API tokens only for a [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens). We will update these integrations to authenticate with VMware Cloud services access tokens in a future release. - - - - - - - - -
-



- -You should incrementally replace your Operations for Applications API tokens with the more secure VMware Cloud services access tokens. -

-To replace an Operations for Applications API token associated with a service account, you must replace the service account with a server to server OAuth app. See [How to Replace a Service Account with a Server to Server App?](#how-to-replace-a-service-account-with-a-server-to-server-app). -

-The flowchart on the right shows the overall process for replacing an Operations for Applications API token with a VMware Cloud services API token. -		 -Flowchart showing how to replace an Operations for Applications API token with a VMware Cloud services API token. The process is described in the list below -
- - -To replace an Operations for Applications API token associated with your user account: - -1. Log in to the VMware Cloud Services Console. -1. Generate an API token. See [How do I generate API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E2A3B1C1-E9AD-4B00-A6B6-88D31FCDDF7C.html) in the VMware Cloud services documentation. - - - For the name of the VMware Cloud services API token, you can enter the name of the Operations for Applications API token that you want to replace. - - For the time to live (TTL) of the VMware Cloud services API token, you can configure a value from several minutes to several months, or never expire. This value defines the period in which the API token should be renewed. - - The TTL of the access tokens that will be issued to that API token is 30 minutes and is not configurable. - - For the scopes of the API token, you must configure the minimum portion of your roles: - - {% include note.html content="Till now, the Operations for Applications API tokens inherited all your permissions and roles. Now, you can set the VMware Cloud services API token with a subset of the roles that you own."%} - - - - - - - - - - - - - - - - - - - - -
Scope - Description -
- Organization Role - Organization Member is sufficient in most of the cases. -
- Custom Roles - Optional. Use only if you have assigned a custom role. -
Service Roles - Required for service access. -

If you already assigned a custom role, you must assign at least the Viewer Operations for Applications service role.

-
-1. Reconfigure your scripts, API calls, or proxies to exchange the newly generated VMware Cloud services API token for an access token, instead of using the Operations for Applications API token. - - {% include important.html content="The TTL of the access tokens associated with user accounts is 30 minutes. Make sure that your script renews the access token periodically before it expires. The Wavefront proxy does this automatically. "%} -1. [Revoke](#how-to-view-and-manage-the-operations-for-applications-api-tokens) the Operations for Applications API token that you replaced. - - - - - -
 click for top of page
- -## What Happens with the Wavefront Proxies? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, all of the existing Wavefront proxies are **preserved** with their existing Operations for Applications API tokens. - -You should incrementally [replace](#how-to-replace-the-operations-for-application-api-token-of-a-wavefront-proxy) the tokens of your proxies to authenticate with the more secure VMware Cloud services access tokens. - -{% include tip.html content="From now on, the users with the **Proxies** service role can create and manage the proxies in your Operations for Applications service. New proxies must authenticate with VMware Cloud services access tokens unless used for the [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens."%} - -### How to Replace the Operations for Application API Token of a Wavefront Proxy? - -{% include important.html content="Make sure the version of your Wavefront proxy is 13.0 or later."%} - -1. Log in to the VMware Cloud Services Console. -1. Obtain OAuth app credentials (recommended) or a VMware Cloud services API token: - - - Create a server to server app with the **Proxies** service role, save its OAuth credentials (app ID and app secret), and add it to your VMware Cloud organization. See [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. - - Also, obtain the long ID of the VMware Cloud organization. See [View the Organization ID](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-CF9E9318-B811-48CF-8499-9419997DC1F8.html#view-the-organization-id-1) in the VMware Cloud services documentation. - - Generate a VMware Cloud services API token with the **Proxies** service role. See [How do I generate API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E2A3B1C1-E9AD-4B00-A6B6-88D31FCDDF7C.html) in the VMware Cloud services documentation. -1. Go to the [proxy configurations location](proxies_configuring.html#proxy-file-paths) and edit the `wavefront.conf` file with the OAuth app credentials or your VMware Cloud services API token: - - - Replace the `token` parameter with the `cspAppId`, `cspAppSecret`, and `cspOrgId` parameters: - - ``` - cspAppId= - cspAppSecret= - cspOrgId= - ``` - - Replace the `token` parameter with the `cspAPIToken` parameter: - - ``` - cspAPIToken= - ``` -1. [Revoke](#how-to-view-and-manage-the-operations-for-applications-api-tokens) the Operations for Applications API token that you replaced. - - - - - -
 click for top of page
- -## What Happens with the Integrations? - -During the process of onboarding your Operations for Applications service to VMware Cloud services, all of the existing integrations are **preserved** and continue to operate using proxy authentication with Operations for Applications API tokens. - -You should incrementally [replace](#how-to-replace-the-operations-for-application-api-token-of-a-wavefront-proxy) the proxy tokens of your [integrations](integrations_onboarded_subscriptions.html#integrations-that-use-vmware-cloud-services-access-tokens) that are updated to use proxy authentication with the more secure VMware Cloud services access token. - -{% include tip.html content="From now on, the users with the **Proxies** and **Integrations** service roles can set up integrations in your Operations for Applications service. New integrations must use proxy authentication with VMware Cloud services access tokens except for the [limited list of integrations](integrations_onboarded_subscriptions.html#integrations-that-use-operations-for-applications-api-tokens) that still authenticate with Operations for Applications API tokens."%} - - - - - -
 click for top of page
\ No newline at end of file diff --git a/pages/doc/csp_sign_up_or_log_in.md b/pages/doc/csp_sign_up_or_log_in.md index e2e24af67..89ac400d3 100644 --- a/pages/doc/csp_sign_up_or_log_in.md +++ b/pages/doc/csp_sign_up_or_log_in.md @@ -7,15 +7,15 @@ summary: Learn how you can sign up and log in to your service instance if it's o --- Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. -{% include note.html content="After July 3, 2023, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to VMware Cloud services and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally [onboarding](csp_migration.html) original subscriptions to VMware Cloud services. For information about original and VMware Cloud services subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html). "%} +{% include note.html content="After July 3, 2023, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to VMware Cloud services and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally onboarding original subscriptions to VMware Cloud services. For information about original and VMware Cloud services subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html). "%} -When your Operations for Applications instance is onboarded to VMware Cloud services, you use a single [VMware Cloud services account](csp_getting_started.html#whats-a-vmware-cloud-services-account) to access your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. +When your Operations for Applications instance is onboarded to VMware Cloud services, you use a single VMware Cloud services account to access your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. Here’s how the signup works: 1. If you don't belong to the VMware Cloud organization in which the Operations for Applications service instance is running, you can be added to that organization in one the following ways: - A VMware Cloud **Organization Owner** or **Organization Administrator** adds you individually. See [How do I add users to my organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-47AA313E-9DAC-447C-B6C8-DF71ED45B0D5.html) in the VMware Cloud services documentation. - A VMware Cloud **Organization Owner** and **Enterprise Administrator** federate your corporate domain with VMware Cloud services. See [What is enterprise federation and how does it work](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-76FAECB3-CFAA-461E-B9C9-2A49C39CD17F.html) in the VMware Cloud services documentation. -2. A VMware Cloud **Organization Owner** or **Organization Administrator** grants you access to the organization's resources with an [organization role](csp_getting_started.html#whats-a-vmware-cloud-organization-role). +2. A VMware Cloud **Organization Owner** or **Organization Administrator** grants you access to the organization's resources with an organization role. 3. A VMware Cloud **Organization Owner** or **Organization Administrator** grants you access to the Operations for Applications service instance with an [Operations for Applications service role](csp_users_roles.html). In addition, they can grant you a custom role with Operations for Application permissions. In a multi-tenancy environment, you can have different service and custom roles for the different Operations for Applications service instances (tenants). diff --git a/pages/doc/csp_supported_integrations.md b/pages/doc/csp_supported_integrations.md index 1d80a1bc3..f659c898f 100644 --- a/pages/doc/csp_supported_integrations.md +++ b/pages/doc/csp_supported_integrations.md @@ -9,7 +9,7 @@ summary: Learn how integration authentication happens, which integrations work w ## Subscription Types -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until [onboarded](csp_migration.html) to VMware Cloud services. +Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. For best performance, when you set up most of our integrations, it is recommended to use the Wavefront proxy. The Wavefront proxy ingests metrics and forwards them to Operations for Applications in a secure, fast, and reliable manner. @@ -39,7 +39,7 @@ The Wavefront proxy requires a VMware Cloud services access token with the **Pro For a limited number of integrations, you must still use an Operations for Applications API token, associated with a [service account](csp_service_accounts.html) that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. -{% include warning.html content=" It is strongly recommended that you gradually [switch to using server to server OAuth apps](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app) which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future." %} +{% include warning.html content=" It is strongly recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future." %} - - ![An image showing the differences in the Accounts menu and the Service Accounts tab.](images/new-vs-original-accounts.png) - - 1. The **User Accounts**, **Groups**, and **Roles** tabs are missing, because the management of users, groups, and roles is done from the VMware Cloud Services Console. By using the **Accounts** menu item, the VMware Cloud services subscribers can manage only service accounts and the Operations for Applications API tokens associated with them. - 1. VMware Cloud services subscribers cannot assign roles to service accounts and also can’t add them to groups. For VMware Cloud services subscriptions, service accounts are local entities in Operations for Applications, while roles and groups management is centralized in VMware Cloud services. VMware Cloud services subscribers can grant only permissions to service accounts. - 1. Filtering the service accounts can be done only by permissions, because they don’t have roles and don’t belong to groups. - -## Super Admin Page - -The **Super Admin** page is replaced with **Orphaned Objects**, because Super Admin users no longer can invite new Super Admin users, but they can still see and recover orphaned objects, such as orphan dashboards and alerts. - - ![An image showing the differences in the add new proxy page.](images/new-vs-original-super-admin.png) - -## Add New Wavefront Proxy Page - -When adding a Wavefront proxy, VMware Cloud services subscribers have two options for the proxy authorization to Operations for Applications. They can configure the proxy with server to server OAuth app credentials or with a VMware Cloud services API token. - - ![An image showing the differences in the add new proxy page.](images/new-vs-original-proxy.png) - -## Organization Settings Page - -The options for adding default groups for new user and service accounts as well as for setting the default permissions for new user accounts are removed, because VMware Cloud services subscribers manage users and roles through the VMware Cloud Services Console. Users with the **Super Admin** or **Admin** service role can still set the default display settings and language preferences for new users on the **Organization Settings** page. - - ![An image showing that the options mentioned above are removed from the UI for new subscribers.](images/new-vs-original-new-accounts-defaults.png) - -## Metrics Security Policy Rule Creation Page - -The option for creating a metrics security policy rule based on roles is removed, because VMware Cloud services subscribers can block or allow access to certain metrics only based on accounts (user accounts and service accounts) and groups. - - ![An image showing that the Roles option is removed from the UI for new subscribers.](images/new-vs-original-metricspolicy.png) diff --git a/pages/doc/csp_user_management.md b/pages/doc/csp_user_management.md index 7f01e7864..ebc71eb9c 100644 --- a/pages/doc/csp_user_management.md +++ b/pages/doc/csp_user_management.md @@ -16,7 +16,7 @@ VMware Cloud services provides identity access management for the users of your To add a user to your Operations for Applications service instance, you must assign that user: -1. An [organization role](csp_getting_started.html#whats-a-vmware-cloud-organization-role) for the VMware Cloud organization running the service instance. +1. An organization role for the VMware Cloud organization running the service instance. {% include note.html content="If you are a VMware Cloud **Organization Administrator**, you can assign only the VMware Cloud **Organization Member** role. Only a VMware Cloud **Organization Owner** can add VMware Cloud **Organization Owners** and VMware Cloud **Organization Administrators**."%} diff --git a/pages/doc/csp_users_account_managing.md b/pages/doc/csp_users_account_managing.md index 5de89a129..82ba2e122 100644 --- a/pages/doc/csp_users_account_managing.md +++ b/pages/doc/csp_users_account_managing.md @@ -8,7 +8,7 @@ summary: Learn how to manage your password and preferences. {% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for VMware Cloud services subscriptions. For **original** subscriptions, see [Customize Your Account](users_account_managing.html)."%} -When your Operations for Applications instance is onboarded to VMware Cloud services, you use a single [VMware Cloud services account](csp_getting_started.html#whats-a-vmware-cloud-services-account) to access your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. +When your Operations for Applications instance is onboarded to VMware Cloud services, you use a single VMware Cloud services account to access your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. ## Manage Your Password diff --git a/pages/doc/integrations_new_changed.md b/pages/doc/integrations_new_changed.md index 60bc3c4f3..f15f48889 100644 --- a/pages/doc/integrations_new_changed.md +++ b/pages/doc/integrations_new_changed.md @@ -11,7 +11,7 @@ VMware Aria Operations for Applications (formerly known as Tanzu Observability b ## Announcement -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the [VMware Cloud services platform](https://console.cloud.vmware.com/) and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally [onboarding](csp_migration.html) all original subscriptions to VMware Cloud services. +Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the [VMware Cloud services platform](https://console.cloud.vmware.com/) and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally onboarding all original subscriptions to VMware Cloud services. For details about the two subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). @@ -19,7 +19,7 @@ If your Operations for Applications service **is onboarded** to VMware Cloud ser {% include note.html content= "The integrations in the **Archived** section are approaching their end-of-life. For that reason, we will not update these integrations to authenticate with VMware Cloud services access tokens." %} -During the process of onboarding an original Operations for Applications service to VMware Cloud services, all of the existing integrations are preserved and continue to operate using Operations for Applications API tokens. You should incrementally switch to integration authentication with the more secure VMware Cloud services access tokens. See [What Happens with the Integrations?](csp_migration.html#what-happens-with-the-integrations). +During the process of onboarding an original Operations for Applications service to VMware Cloud services, all of the existing integrations are preserved and continue to operate using Operations for Applications API tokens. You should incrementally switch to integration authentication with the more secure VMware Cloud services access tokens. {% include note.html content= "Currently, if your service **is onboarded** to VMware Cloud services, direct ingestion by using the Wavefront Output Plugin for Telegraf is not supported. For best performance, use a Wavefront proxy. " %} diff --git a/pages/doc/purchase-additional-capacity.md b/pages/doc/purchase-additional-capacity.md index fcf9b0d1d..6c3871253 100644 --- a/pages/doc/purchase-additional-capacity.md +++ b/pages/doc/purchase-additional-capacity.md @@ -8,7 +8,7 @@ summary: Learn how to add capacity to your current VMware Aria Operations for Ap --- {% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. For information about VMware Cloud services subscriptions and original subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html).
-- For VMware Cloud services subscriptions, to purchase additional capacity, you must hold the [**Organization Owner** role](csp_getting_started.html#whats-a-vmware-cloud-organization-role) in the VMware Cloud organization running the service as well as at least one [Operations for Applications service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) for the service instance. If your enterprise domain is federated, to access the organization billing account, you must have a VMware account linked to your corporate account.
+- For VMware Cloud services subscriptions, to purchase additional capacity, you must hold the **Organization Owner** role in the VMware Cloud organization running the service as well as at least one [Operations for Applications service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) for the service instance. If your enterprise domain is federated, to access the organization billing account, you must have a VMware account linked to your corporate account.
- For original Operations for Applications subscriptions, to purchase additional capacity, you must be a **Super Admin** user."%} ## Supported Contracts diff --git a/pages/doc/wavefront_introduction.md b/pages/doc/wavefront_introduction.md index 31861de0a..04b1558ee 100644 --- a/pages/doc/wavefront_introduction.md +++ b/pages/doc/wavefront_introduction.md @@ -11,7 +11,7 @@ VMware Aria Operations for Applications (formerly known as Tanzu Observability b You need an account to get started. -Starting July 3, 2023, Operations for Applications is a service on the [VMware Cloud services platform](https://console.cloud.vmware.com/). After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until [onboarded](csp_migration.html) to VMware Cloud services. For information about the subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). +Starting July 3, 2023, Operations for Applications is a service on the [VMware Cloud services platform](https://console.cloud.vmware.com/). After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. For information about the subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). ## Intro Videos diff --git a/pages/doc/wavefront_obsolescence_policy.md b/pages/doc/wavefront_obsolescence_policy.md index 6e6e3b14e..3200c39cc 100644 --- a/pages/doc/wavefront_obsolescence_policy.md +++ b/pages/doc/wavefront_obsolescence_policy.md @@ -187,7 +187,7 @@ Starting July 3, 2023, VMware Aria Operations for Applications is a service on t Starting September 20, 2023, all **new trial** instances of Operations for Applications are **onboarded** to VMware Cloud services. -In October, 2023, we start to incrementally [onboard](csp_migration.html) all **original** subscriptions, which use Operations for Applications authentication and authorization, to VMware Cloud services. +In October, 2023, we start to incrementally onboard all **original** subscriptions, which use Operations for Applications authentication and authorization, to VMware Cloud services. -{% include warning.html content="The Operations for Applications authentication and authorization will be **deprecated** in the future. Therefore, after onboarding to VMware Cloud services, **replace** [your service accounts with server to server apps](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app) and [your Operations for Applications API tokens with VMware Cloud Services access tokens](csp_migration.html#how-to-replace-an-operations-for-applications-api-token-with-a-vmware-cloud-services-access-token), including [the Operations for Application API tokens of your Wavefront proxies](csp_migration.html#how-to-replace-the-operations-for-application-api-token-of-a-wavefront-proxy)." %} +{% include warning.html content="The Operations for Applications authentication and authorization will be **deprecated** in the future. Therefore, after onboarding to VMware Cloud services, **replace** your service accounts with server to server apps and your Operations for Applications API tokens with VMware Cloud Services access tokens, including the Operations for Application API tokens of your Wavefront proxies." %} diff --git a/pages/doc/wavefront_release_notes.md b/pages/doc/wavefront_release_notes.md index 3472fdd22..a1dc08ad1 100644 --- a/pages/doc/wavefront_release_notes.md +++ b/pages/doc/wavefront_release_notes.md @@ -37,9 +37,9 @@ For information about the two subscription types and how they differ, see [Subsc ### Onboarding Original VMware Aria Operations for Applications to VMware Cloud Services -In October, 2023, we start to incrementally [**onboard**](csp_migration.html) all original subscriptions to VMware Cloud services. You will receive a notification in your Operations for Applications UI with the date scheduled for your service onboarding to VMware Cloud services. Make sure that you get familiar with the VMware Cloud services platform and prepare for the onboarding. See [What Should I Do Before the Onboarding?](csp_migration.html#what-should-i-do-before-the-onboarding). +In October, 2023, we start to incrementally **onboard** all original subscriptions to VMware Cloud services. You will receive a notification in your Operations for Applications UI with the date scheduled for your service onboarding to VMware Cloud services. Make sure that you get familiar with the VMware Cloud services platform and prepare for the onboarding. -{% include warning.html content="The Operations for Applications authentication and authorization will be **deprecated** in the future. Therefore, after onboarding to VMware Cloud services, **replace** [your service accounts with server to server apps](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app) and [your Operations for Applications API tokens with VMware Cloud Services access tokens](csp_migration.html#how-to-replace-an-operations-for-applications-api-token-with-a-vmware-cloud-services-access-token), including [the Operations for Application API tokens of your Wavefront proxies](csp_migration.html#how-to-replace-the-operations-for-application-api-token-of-a-wavefront-proxy)." %} +{% include warning.html content="The Operations for Applications authentication and authorization will be **deprecated** in the future. Therefore, after onboarding to VMware Cloud services, **replace** your service accounts with server to server apps and your Operations for Applications API tokens with VMware Cloud Services access tokens, including the Operations for Application API tokens of your Wavefront proxies." %} - -As a user with the **Admin** service role, you can generate and manage the API tokens for [service accounts](csp_service_accounts.html) upon creation or at a later stage. - -To generate and manage the API tokens for an existing **service account**: - -1. Log in to your service instance as an **Admin** user. -2. Click the gear icon on the toolbar and select **Accounts**. -3. On the **Service Accounts** tab, click the ellipsis icon next to the service account, and select **Edit**. - 1. To generate a new token, in the **Tokens** section, click **Generate**. - - You can have up to 20 tokens per service account at any given time. If you want to generate a new token but already have 20 tokens, you must revoke one of the existing tokens. - 2. To revoke a token, click the **Revoke** button for the token. - - Revoking a token cannot be undone. - 3. To rename an API token, click the **Edit** icon for the token, enter the name, and press Enter. -6. Select the appropriate permissions for the service account and click **Update**. - - - -## Manage the Operations for Applications API Tokens in Your Service Instance - -As a user with the **Admin** service role, you can view and revoke the API tokens of any service account in your service instance. - -{% include warning.html content="If your original Operations for Applications subscription was onboarded to VMware Cloud services, for backward compatibility, you might have some legacy Operations for Applications API tokens that are associated with user accounts. It’s recommended that you incrementally replace them with VMware Cloud services API tokens."%} - -1. Log in to your service instance as an **Admin** user. -2. Click the gear icon on the toolbar and select **Accounts**. -3. Click the **API Tokens** tab. - - You see the API tokens for all service accounts in a paginated table format. - -![The API Tokens page shows the tokens table, the search field above the table, and the preconfigured filters and the saved searches in the left panel](/images/csp_API_tokens.png) - -{% include important.html content="Revoking a token cannot be undone. Any script that uses a revoked token returns an authorization error." %} - -On the API Tokens page, you can: -- Sort the API tokens table by column. -- Search and, optionally, save and share your search. -- Filter the API tokens by usage, particular accounts, or your saved search. -- Revoke an API token from the vertical ellipsis icon for the token. \ No newline at end of file diff --git a/pages/doc/csp_authentication.md b/pages/doc/csp_authentication.md deleted file mode 100644 index 891bd2acd..000000000 --- a/pages/doc/csp_authentication.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Authentication Model in Operations for Applications on VMware Cloud Services -keywords: -tags: [integrations, administration] -sidebar: doc_sidebar -permalink: csp_authentication.html -summary: Learn how to enable multi-tenant authentication. ---- - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for VMware Cloud services subscriptions. For **original** subscriptions, see [Authentication Model](wavefront-authentication.html)."%} - -VMware Cloud services provides a central single sign-on (SSO) to all of your services running on the platform, including VMware Aria Operations for Applications. Users authenticate with VMware Cloud services accounts. Server-to-server apps, which correspond to service accounts in Operations for Applications, authenticate with OAuth 2.0 client credentials and VMware Cloud services API tokens are issued directly to them. - -VMware Cloud services supports these user authentication options: -* **Authentication through a VMware ID**: The VMware Cloud services account is based on the VMware ID (VMware account) credentials that the user creates in the VMware Cloud Services Console. -* **Authentication through a federated domain**: The VMware Cloud services account is based on the corporate account credentials. - -VMware Cloud services also supports **multi-tenant SSO**, where each Operations for Applications tenant is onboarded as a separate Operations for Applications service instance in the same VMware Cloud organization. - -## VMware ID Authentication - -By default, to register with VMware Cloud services, you must create a VMware ID for your VMware Cloud services account. - -## Federated Domain Authentication - -As a user with the VMware Cloud **Organization Owner** role, you can initiate an enterprise domain federation and invite an **Enterprise Administrator**. See [Setting Up Enterprise Federation with VMware Cloud Services Guide](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-76FAECB3-CFAA-461E-B9C9-2A49C39CD17F.html) in the VMware Cloud services documentation. - -The users in a federated domain don't need to create a VMware ID unless they need to access billing information in the VMware Cloud organization. - -After you federated your enterprise domain, as a user with the VMware Cloud **Organization Owner** role, you can activate Identity Governance and Administration (IGA) and unlock additional identity and access management features, such as assigning default service roles for the users in the federated domain. For details see [What is Identity Governance and Administration and how does it work with VMware Cloud Services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E6661280-A88A-4E26-9008-4C1620641FA1.html) and [How do I assign default roles in my Organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-2307F55C-FB5C-4EE0-A2DE-43011509A9A1.html) in the VMware Cloud services documentation. - -## Multi-Tenant SSO - -Large customers can request multi-tenant SSO. Multi-tenancy is set up jointly by your **Organization Owner** and our Technical Support team. - -Users in different teams inside the company can authenticate to different tenants and cannot access the other tenant's data. diff --git a/pages/doc/csp_invite-AoA-users_tutorial.md b/pages/doc/csp_invite-AoA-users_tutorial.md index 1a4101ce7..ee36fdf9f 100644 --- a/pages/doc/csp_invite-AoA-users_tutorial.md +++ b/pages/doc/csp_invite-AoA-users_tutorial.md @@ -28,11 +28,11 @@ To invite new users, you assign them: Note that you can assign the **Organization Owner** role to another user only if you have the **Organization Owner** role. -* A role within the Operations for Applications service instance. We provide a number of [Operations for Applications service roles](csp_users_roles.html#operations-for-applications-service-roles-built-in). +* A role within the Operations for Applications service instance. We provide a number of Operations for Applications service roles. Note that in a multi-tenant Operations for Applications environment, you must specify the service instance (tenant) for which you want to assign the service role. You can assign different service roles for different service instances (tenants). You invite the users only to the tenants for which you assigned them service roles. -* Optionally, a custom role created in the VMware Cloud organization. [Custom roles](csp_users_roles.html#create-edit-or-delete-a-custom-role) are composed of different service permissions. +* Optionally, a custom role created in the VMware Cloud organization. Custom roles are composed of different service permissions. Note that a custom role with an Operations for Applications permission applies only if the user has at least one Operations for Applications service role. In a multi-tenant Operations for Applications environment, custom roles apply to all service instances (tenants) for which the user has at least one Operations for Applications service role. @@ -67,7 +67,7 @@ We provide a number of built-in Operations for Applications service roles. - A corresponding service role for each permission. - Two special service roles - one that grants full administrative access to the service, and another one that grants read-only access to the service. -For more information, see [Operations for Applications Service Roles (Built-in)](csp_users_roles.html#operations-for-applications-service-roles-built-in). +For more information, see Operations for Applications Service Roles (Built-in). ### Step 1: Enter the New User Details diff --git a/pages/doc/csp_metrics_security.md b/pages/doc/csp_metrics_security.md deleted file mode 100644 index 1940ec3ec..000000000 --- a/pages/doc/csp_metrics_security.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -layout: redirected -sitemap: false -permalink: csp_metrics_security.html -redirect_to: csp_security_policy.html ---- \ No newline at end of file diff --git a/pages/doc/csp_security_policy.md b/pages/doc/csp_security_policy.md deleted file mode 100644 index 8ebae8a72..000000000 --- a/pages/doc/csp_security_policy.md +++ /dev/null @@ -1,482 +0,0 @@ ---- -title: Security Policy Rules in Operations for Applications on VMware Cloud Services -keywords: administration -tags: [administration] -sidebar: doc_sidebar -permalink: csp_security_policy.html -summary: Use security policies to control access to metrics, such as time series, histograms, RED metrics, and delta counters, as well as traces. ---- - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscribers. For VMware Cloud services subscriptions, see [Metrics Security Policy Rules in Operations for Applications on VMware Cloud Services](csp_metrics_security.html)."%} - -You can create security policies on VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) to protect your metrics and traces security data. - -An overview image that shows metrics and traces security policies. - -In a large enterprise, certain data is confidential. Our service allows you to limit who can see or modify data in several ways. -* **Permissions** are **global** settings. - - Some permissions limit who can modify objects (e.g., proxies or events). For example, users with the **Dashboards** permission can modify all dashboards. - - Other permissions make certain information completely invisible. For example, only users with the **SAML IdP Admin** permission can see the **Self Service SAML** menu or access that page. -* **Access Control** allows administrators with the right permissions fine-grained control over individual dashboards or alerts. For example, it's possible to limit view and modify access to a Finance_2020 dashboard to just the Finance department. -* **Metrics Security** supports even finer-grained control. In the example above, access to the Finance_2020 dashboard is limited to the Finance department. With metrics security, you can limit access to confidential time series, histogram, and delta counter metrics to the leadership team. -* **Traces Security** supports finer-grained control and limit access to confidential trace data from applications or services. - -{% include important.html content="This feature is not available on all service instances." %} - - -## Block or Allow Access to Sensitive Data - -With a security policy, you can block or allow access: -* To metrics, optionally filtered by source or point tag. -* To traces, optionally filtered by source or point tag. -* Based on groups, and individual users. - -When an account attempts to access metrics or traces, the backend looks at the rules in priority order. Higher priority rules overwrite lower priority rules. - -### Metrics - -For example, assume you have two metrics security rules: - - - - - - - - - - - - - - - - - - - -
NamePriorityMetricsAccounts
BlockRevenueNumbers2All metrics that start with revenue*All accounts
AllowRevenueFinance1All metrics that start with revenue*All accounts in the Finance group
- -After the rules are in force, only users in the Finance group can access data that starts with `revenue*`. - -### Traces - -For example, assume you have two traces security rules: - - - - - - - - - - - - - - - - - - - -
NamePriorityTracesAccounts
BlockPaymentService2All spans that include the myapp.payment.* data.All accounts
AllowPaymentData1All spans that include the myapp.payment.* data.All accounts in Finance group
- -After the rules are in force, only the users in the Finance group can: - -* See the payment service on the Application Status page. -* See the RED metrics for the Payment service on the Operations Dashboard. -* See the trace data that includes the payments service on the Traces Browser. - - - - - -
 click for top of page
- -## Rule Priority and Rule Pairs - -Rules are evaluated in priority order. In many cases, it's useful to think of pairs of rules, for example: - -* Create a rule that blocks access to all metrics for a user group. For example, **Block all**. This rule is with lower priority. -* Create another rule to allow access to a small set of metrics for that user group. E.g., metrics starting with the `cpu.*` prefix and that are tagged with `env=dev`, i.e. developers environment. For example, **Allow CPU metrics**. This rule is with higher priority. - - - - - - - - - - - - - - - - - -
NamePriorityMetrics
Allow metrics1Allow access to metrics starting with the cpu.* prefix and with point tag env=dev.
Block all2Block all metrics
- -When you apply this policy, the users included in the user group will have access to the metrics starting with the `cpu.` prefix and point tag `env=dev`, because the **Allow metrics** rule overrides the **Block all** rule. - - - - - -
 click for top of page
- -## Metrics Security Policy - -You can block sensitive metrics data from time series, histograms, RED metrics, and delta counters so that they don't show on charts and dashboards, and alerts. - -{% include note.html content="Only a Super Admin user or users with the **Metrics** or **Applications** permission can view, create, and manage metrics security policy. " %} - -### Video: Metrics Security Policy - -Watch this videovideo camera icon for an overview. Note that this video was created in 2020 and some of the information in it might have changed. It also uses the 2020 version of the UI. - -

- -

- - -### Sensitive Data Becomes Invisible - -Data protected by a metrics security policy rule can become invisible to users. - -* **Not visible in charts**. The chart either includes a warning that some metrics are protected, or, if all metrics are protected, the chart shows only the message. -* **Not visible in alerts** (if **Secure Metrics Details** is selected for the alert). The alert fires based on the complete set of metrics, and the complete set is shown in notification images by default. A check box allows administrators to [hide alert details](alerts_notifications.html#alert-notification-with-secured-metrics-details) so that confidential metrics are not shown. -* **Not visible in auto-complete** in Chart Builder, Query Editor, Metrics browser, etc. - -### Alert Notifications - -To protect metrics or RED metrics from inclusion in alert notifications, use the **Secure Metrics Details** check box. Operations for Applications looks at all metrics when determining when an alert status should change and shows them in alert notifications. When the check box is selected, [details are not shown](alerts_notifications.html#alert-notification-with-secured-metrics-details) in the notification. - -### Derived Metrics and Events - - -The current implementation has limitations: -* Does not protect metrics in events. -* Does not protect metrics in the **Derived Metrics** browser. When you select **Browse > Derived Metrics**, you still see metrics on that page even if a metrics security policy rule blocks access for you elsewhere in the GUI. - - -### Warning Messages for Protected Metrics - -* **Charts in Dashboard**. If certain charts in a dashboard include protected metrics, those charts display that information, as follows: - * **Some metrics protected**. If some metrics in a chart are protected, the chart shows metrics but includes the following Warning message. - ``` - Some metrics returned by this query might be excluded due to metrics security policy rules. - ``` - * **All metrics protected**. If all metrics in a chart are protected, the chart shows only the following message: - ``` - All metrics in this chart are excluded due to metrics security policy rules. - ``` -* **Chart in Edit Mode**. When you edit a chart and your query result include protected metrics, the following message is displayed below the query. - - ``` - All metrics returned by this query are excluded due to metrics security policy rules. - ``` - - - - - -### Create a Metrics Security Policy Rule - -Privileged users can create rules, change rule priority, and change the scope of each rule. - -{% include note.html content="Only a Super Admin user or users with **Metrics** or **Applications** permission can view, create, and manage a metrics security policy. " %} - -#### Plan Your Strategy - -Before you create rules, plan your strategy. - -* **Metrics Dimensions** allow you to determine what to block or allow. - - Specify one or more metric prefixes. You can specify an exact match (e.g., `requests` or `request.`) or a wildcard match (e.g. `*.cpu.loadavg.*`, `cpu.*`). - - Specify a combination of metric sources or point tags to narrow down the metrics. For example, you can block visibility into production environments for some developers, or you can block some development environments metrics for contractors. -* **Access** allows you to allow or block access for a combination of accounts or groups. - -See the Examples further below. - -#### Create One or More Rules - -You create a metrics security policy rule following these steps. See the annotated screenshot below for an example. - -1. From the gear icon on the toolbar, select **Security Policy** and click **Create Rule**. -1. Make sure you are on the **Metrics Security Policy** tab. -1. Click **Create Rule**. -1. Specify a meaningful name and, optionally, a description. - - Users might later modify the rule, so a clear name is essential. The description is visible only when you edit the rule. The name is visible on the Metrics Security Policy page. - - 1. Specify and describe the metrics: - * You can specify the full metric name or use a wildcard character in metric names, sources, or point tags. The wildcard character alone (`*`) means all metrics. - * Specify key=value pairs, for example, `source="app-24"` or `env=dev`. - * If you want to specify multiple key=value pairs, select whether you want to combine them with `and` or `or` using the dropdown menu on the right. - 1. Specify the Access definition for the rule. - 1. Select **Allow** or **Block** from the menu. - 2. Specify accounts, or groups. - 1. Click **OK.** - - -Here's an annotated screenshot that shows the main actions: - -![Annotated Edit Rule screenshot. Highlights Press Enter in Prefix / Source and Point Tag section](images/csp_metrics_s_edit_rule.png) - -### Examples for Metrics Security Policies - -Before you start, plan your strategy. Here are some common scenarios. - -#### Example: Restrict Access to Confidential Metrics - -This example restricts access to specific ranges of highly-sensitive metrics, say revenue numbers, to the specified groups of users. - -![Screenshot of policy rules, where the finance group can access revenue numbers.](images/metrics_security_restrict.png) - -The image above shows how to restrict metrics starting with `revenue.*` to be accessible only by members of the group `Finance`. The policy grants all users access to all other metrics. - -* When the metric `revenue.saas` is queried by a user in the `Finance` group, this access matches Rule 1 (**Finance Group can access Revenue**). The rule grants the access, so the metric is shown to the user and no other rules are consulted. - -* When the metric `revenue.saas` is queried by a user **not** in the `Finance` group, the access does **not** match Rule 1. The engine moves on to Rule 2 (**No one else can access Revenue**), which matches because all users belong to the Everyone group. Because the rule denies the access, the metric is not shown to the user. No other rules are consulted. - -#### Example: Restrict Access for a Group of Users - -This example restricts access for a group of users, making only a subset of the metrics in the system available to them. - -![Screenshot of policy rules making only a subset of the metrics available to a group of users.](images/metrics_security_group.png) - -The image above shows how to restricts access for users in the group `Contractors`. Those users can only query metrics tagged with the point tag `env=dev`. This policy imposes no restrictions on any other groups. - -* When a user belonging to group `Contractors` runs a query for `cpu.usage` tagged with `env=dev`, this access matches Rule 1 (**Contractors can access dev environment metrics**) and access is granted. -* But when the user issues a query for `cpu.usage` tagged with `env=prod`, this access does not match Rule 1. Rule 2 (**Contractors cannot access any other metrics**) acts as a catch-all for users of group `Contractors` and denies them access to this metric. - - -{% include note.html content="Because the first rule (**Contractors can access dev environment metrics**) uses only point tags/sources as metrics dimensions, the users in the Contractors group will not see metrics in the Metrics Browser and when they create queries, autocomplete will not work for them."%} - -#### Example: Restrict Access to All Except Specific Metrics - -This example restricts access to all metrics except for two specific groups of metrics that are additionally narrowed down by specifying tags. - -![Screenshot of a policy rule restricting access to all metrics except for a specific group of metrics](images/metrics-security-policy-block-all.png) - -The image above shows how to restrict access for a specific user. The user cannot access any metrics except the ones specified in the first two rules. This Metrics Security Policy can also be applied to a user group. - -* Rule 3 (**Block all**) restricts access to all existing metrics for the user. -* Rule 2 (**Allow by tag**) provides access to all metrics that start with the prefix `customer.` and `customerStatus=ACTIVE` tag. -* Rule 1 (**Allow by tag for K8s integration**) provides access to all metrics with the `kubernetes.` prefix for a specific cluster. - - When you apply the above security policy, the user *CAN* see all metrics starting with the `customer.` and `kubernetes.` prefixes in the Metrics Browser. Also, the user *CAN* explore and create charts with the `customer.*` metrics having the `customerStatus=ACTIVE` tag and the `kubernetes.` metrics for the specific cluster. Autocomplete will work of these metrics. - - -#### Example: Strictly Limit Access on a Need-to-Know Basis - -Some companies want to make metric accessible only to the team that needs to know about it. Access to metrics outside a team’s scope of work is disabled. Only administrators are allowed access to all metrics. - -![Screenshot of policy rules making a metric accessible only to the team that needs to know about it](images/metrics_security_need_to_know.png) - -The image above shows how to use a set of rules to accomplish this. - -* Rule 4 (**Block All Metrics by default**) applies to any access that doesn't match a higher-up rule. It denies access to all users. Users get access only when an "exception" rule with higher priority access matches. -* Rule 3 (**Allow All Metrics to Admins**) grants access to all metrics to users in the `Admins` group. -* Rule 2 (**Allow Gadgets Team access to Gadget Metrics**) grants access to any metrics starting with `gadget.*` to members of the `Gadgets` group. -* Rule 1 (**Allow Widgets Team access to Widget Metrics**) grants access to any metrics starting with `widget.*` to members of the `Widgets` group. - -In this example, ordering (priority) between rules 1 and 2 does not matter because describe rules for independent metric regions. - -With this policy in place: -* Members of the `Widgets` group are granted access if the metric starts with `widget.*` (Rule 1) and denied otherwise (Rule 4). -* Members of the `Gadgets` group are granted access if the metric starts with `gadget.*` (Rule 2) and denied otherwise (Rule 4). -* Members of the `Admins` group are granted access to all metrics (Rule 3). -* Users who don’t belong to the groups covered by the rules have no access. - - - - - -
 click for top of page
- -## Traces Security Policies - -You can block application or service information for specific users so that they don't see the data on the Application Status page, Traces Browser, Application Map, or Operations Dashboards. - -{% include note.html content="Only a Super Admin user or users with the **Metrics** or **Applications** permission can view, create, and manage a traces security policy. " %} - -### Sensitive Data Become Invisible - -Data protected by a traces security policy rule can become invisible to users. - -* **Not visible on the Traces Browser**. If you are blocked from an application or service, you don't see the respective traces on the Traces Browser. -* **Not visible on the Application Status page**. You don't see the services that are blocked on this page for the table, app map, and grid view. -* **Not visible on the Service Dashboard**. The charts generated on the Service Dashboard do not have any data because the RED metrics related to the application or service are blocked. - {% include note.html content="Tracing security policies do not apply to Charts and Dashboard variables that use `~component.heartbeat`, such as cloned Service Dashboards or Operations Dashboards." %} -* **Not visible on the Operation Dashboard**. The charts generated on the Operations Dashboard do not have any data because the RED metrics related to the operations of the application or service are blocked. - {% include note.html content="Tracing security policies do not apply to Charts and Dashboard variables that use `~component.heartbeat`, such as cloned Service Dashboards or Operations Dashboards." %} - -### Create a Traces Security Policy Rule - -You create a traces security policy rule following these steps. See the annotated screenshot below for an example. - -1. From the gear icon on the toolbar, select **Security Policy** and click **Create Rule**. -1. Click the **Traces Security Policy** tab. -1. Click **Create Rule**. -1. Specify a meaningful name and, optionally, a description. - - Users might later modify the rule, so a clear name is essential. The description is visible only when you edit the rule. The name is visible on the Security Policy page. -1. Specify and describe the application or service: - * You can specify the full application, service, and operation name. You can also use a wildcard character in application name, service names, sources, or point tags. The wildcard character alone (`*`) means all traces. - * Specify key=value pairs, for example, `source="app-24"` or `env=dev`. - * If you want to specify multiple key=value pairs, select whether you want to combine them with `and` or `or` using the dropdown menu on the right. - - - - For example, assume that you have the following: - * A `supermarket` application with the `vegetablesGreen`, `vegetablesRed`, `fruits`, and `dairy` services. - * The `vegetablesGreen` service has the `add` and `purchased` operations. - * Another application named `supermarket200`. - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Tracing PrefixExampleDescription
- `applicationName*` - - `supermarket*` - - Using this prefix format, you can allow or block the trace data of all the applications that start with `supermarket`. In this example, trace data of the `supermarket` and `supermarket200` applications and their services can be blocked or shown to specific users. -
- `applicationName.*` - - `supermarket.*` - - Using this prefix format, you can allow or block the trace data of all the services in the `supermarket` application. It includes the `vegetablesGreen`, `vegetablesRed`, `fruits`, and `dairy` services. -
- `applicationName.serviceName*` - - `supermarket.vegtables*` - - Using this prefix format, you can block or allow the data of all the services that start with `vegetables`. In this example, the data of the `vegetablesGreen` and `vegetablesRed` services can be blocked or shown to specific users. -
- `applicationName.serviceName.*` - - `supermarket.vegtablesGreen.*` - - Using this prefix format, you can allow or block the data of the `supermarket` applications `vegtablesGreen` service, which includes the `add` and `purchased` operations. -
- 1. Specify the Access definition for the rule. - 1. Select **Allow** or **Block** from the menu. - 2. Specify accounts or groups. - 1. Click **OK.** - - - -Here's an annotated screenshot that shows the main actions: - -![Annotated create traces security rule screenshot](images/csp_traces_security_policy_create_rule.png) - -### Examples of Traces Security Policy - -In this example, you have a traces security policy created to block trace data from the RiderApp's passenger service for the Everyone user group. When the traces security policy is in place: -* Users who belong to the Everyone user group won't see the passenger service data on the Traces Browser, Service Dashboard, Operations Dashboard, and Application Status page. -* Super Admin users can see all the data. - -![A screenshot of the traces security policy created to block the user group everyone from seeing data of the RiderApp's passenger service.](images/csp_traces_security_policy_example.png) - -The screenshots below show you how the blocked trace data does not show up for a user in the Everyone user group and how the data shows up for a Super Admin user. - -* Traces Browser: The Super Admin user can see the passenger service on the Traces Browser, while the other user, who belongs to the Everyone group, cannot see the passenger service on the Traces Browser. - ![A screenshot of how the Super Admin user and a user that belongs to the everyone group sees data on the traces browser.](images/traces_security_policy_example_traces_browser.png) - - -* Application Map: The Super Admin user can see the passenger service on the Application Map, while the other user, who belongs to the Everyone group, cannot see the passenger service on the Application Map. - ![A screenshot of how the Super Admin user and a user that belongs to the everyone group sees data on the application map.](images/traces_security_policy_example_service_map.png) - - - - - -
 click for top of page
- -## Manage Multiple Security Policy Rules - -The following annotated screenshot gives an overview of rule management options: - -![screenshot, annotated with the items explained below](images/metrics_security_annotated.png) - - - -{% include note.html content="With the 2023-45.x release, the metrics security policy moved to a new framework. Therefore, new updates you make to your security policy start from version 1 on the **Version History** page. For details, see [2023-45.x Release Notes](wavefront_release_notes.html#2023-45x-release-notes)." %} - -Here's a tour: - -1. Click **Version History** to: - * Revert to an earlier version of the policy. - * Look at information on who last edited the security policy and when that happened. -1. Examine the **Metric Prefix** column to see the metrics affected by a rule. -1. Look at the **Access** column to see whether the rule allows or blocks access. -1. Select the check box to the left of a rule to select it, then use the icons above to clone or delete the selected rule. -1. Select the check boxes to the left of multiple rules to select them, use the icons to indicate changes, and click **Save** to commit the changes. -1. Click the six-dot icon to explicitly drag a rule where you want it and change the rule prioritization. -1. If you've moved, cloned, or deleted one or more rules, use the **Undo** button to undo the change, or **Redo** to revert the undo. - - - - - -
 click for top of page
\ No newline at end of file diff --git a/pages/doc/csp_server_to_server_apps.md b/pages/doc/csp_server_to_server_apps.md deleted file mode 100644 index b0b4ac454..000000000 --- a/pages/doc/csp_server_to_server_apps.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Manage VMware Cloud Services Server to Server Apps -keywords: administration -tags: [administration] -sidebar: doc_sidebar -permalink: csp_server_to_server_apps.html -summary: Create server to server apps and grant them access to VMware Aria Operations for Applications on VMware Cloud services. ---- - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for VMware Cloud services subscriptions. For **original** subscriptions, see [Manage Service Accounts](service-accounts.html)."%} - -VMware Cloud services supports server to server apps that you can use to automate management of Operations for Applications objects, such as dashboards, alerts, etc. A server to server app can't perform the **UI operations** that all user accounts can perform by default. - -You can also use a server to server app for a [Wavefront proxy authentication](proxies_installing.html#proxy-authentication-types). For example, see our [Windows Host Integration Tutorial](windows_host_tutorial.html), which includes installing a Wavefront proxy with server to server OAuth app credentials. - -{% include note.html content="A server to server app must hold roles with certain permissions to perform tasks. For example, to run queries, a server to server app must hold the [**Metrics** service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) or a [custom role](csp_users_roles.html#create-edit-or-delete-a-custom-role) with the **Metrics** permission. To manage dashboards and alerts, the server to server app might need both roles with permissions and [access](csp_access.html)." %} - -## What Are Server to Server Apps? - -Server to server apps are used for automating management tasks. - -* A server to server app uses **OAuth 2.0 client credentials** to get a VMware Cloud services **access token** and authenticate. -* A server to server app can be assigned with organization roles, service roles, and custom roles. - - {% include note.html content="You must explicitly grant each server to server app only the role with the permission required for the task that’s being automated (least required privilege). Doing so, you ensure that permissions for server to server app are always very limited." %} -* A server to server app can be used in multiple organizations. The owner of a server to server app is the organization in which it was created. - -{% include important.html content="For each server to server app with access to an Operations for Applications service instance, we create a corresponding **internal service account** in that service instance and add it the **Service Accounts** internal system group. So that, when you configure [the access control security settings](csp_access.html#change-the-access-control-security-setting), [ingestion polices](ingestion_policies.html#step-1-specify-the-scope-and-pps-limit), or [metrics security rules](csp_metrics_security.html), the server to server apps that are assigned with Operations for Applications service roles are represented as service accounts together with the [service accounts](csp_service_accounts.html) created in Operations for Applications."%} - -## How Server to Server Apps Work - -{% include note.html content="To manage server to server apps, you must hold either the VMware Cloud **Organization Owner** role or any other organization role paired with the **Developer** additional role. See [What organization roles are available in VMware Cloud Services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-C11D3AAC-267C-4F16-A0E3-3EDF286EBE53.html) in the VMware Cloud services documentation." %} - -If you build an application or tool that manages proxies or ingests data, then that tool must authenticate to the Operations for Applications REST API with a VMware Cloud services access token. Here's how it works: - -1. Create a server to server app in VMware Cloud services. See [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. -1. Assign the server to server app with one or more [Operations for Applications service roles](csp_users_roles.html#operations-for-applications-service-roles-built-in) for the service instance. - - {% include important.html content="Ensure that you assign the server to server app **only** with the roles and permissions that are needed. Do not assign all roles listed in the VMware Cloud Services Console." %} - - For example, to use a server to server app only for setting up the Operations for Applications integrations, assign only the **Proxies** service role to the app. - - If you plan to assign the server to server app a custom role, you must assign that server to server app at least one Operations for Applications service role, for example **Viewer**. - -1. Optionally, assign the server to server app a [custom role](csp_users_roles.html#create-edit-or-delete-a-custom-role) with an Operations for Applications permission. - - {% include important.html content="In a multi-tenant Operations for Applications environment, custom roles apply to **all** service instances (tenants) to which the server to server app has access, that is, for which the server to server app has at least one service role."%} - -1. Obtain the OAuth 2.0 client credentials of the server to server app and save them to a secure place. -1. Add the app to your VMware Cloud organization running the Operations for Applications service. -1. Configure your tool to pass the OAuth 2.0 client credentials to the REST API and exchange them to an access token. See [Make API Calls by Using a Server to Server App](using_wavefront_api.html#make-api-calls-by-using-a-server-to-server-app). - - The access token is directly issued to your tool and it authenticates seamlessly to the API. - -After you create a server to server app, you can change its roles, share it with other VMware Cloud organizations, and delete it when no longer need it. - -{% include important.html content="If you regenerate the app secret, the access token expires and cannot be reissued. You must update your scripts with the new app secret." %} \ No newline at end of file diff --git a/pages/doc/csp_supported_integrations.md b/pages/doc/csp_supported_integrations.md index f659c898f..990dc3174 100644 --- a/pages/doc/csp_supported_integrations.md +++ b/pages/doc/csp_supported_integrations.md @@ -37,7 +37,7 @@ The Wavefront proxy requires a VMware Cloud services access token with the **Pro **Operations for Applications API token** -For a limited number of integrations, you must still use an Operations for Applications API token, associated with a [service account](csp_service_accounts.html) that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. +For a limited number of integrations, you must still use an Operations for Applications API token, associated with a service account that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. {% include warning.html content=" It is strongly recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future." %} @@ -45,7 +45,7 @@ For a limited number of integrations, you must still use an Operations for Appli Last sentence: Тo temporarily enable service accounts for your service instance, [contact](wavefront_support_feedback.html) our Technical Support team.--> -To understand how you can manage the API tokens for service accounts, see [Managing the Operations for Applications API Tokens for a Service Account](csp_api_tokens.html#manage-the-operations-for-applications-api-tokens-for-a-service-account). +To understand how you can manage the API tokens for service accounts, see Managing the Operations for Applications API Tokens for a Service Account. ### Original Subscriptions diff --git a/pages/doc/csp_user_management.md b/pages/doc/csp_user_management.md deleted file mode 100644 index ad8777d69..000000000 --- a/pages/doc/csp_user_management.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Manage Users of Operations for Applications on VMware Cloud Services -keywords: administration -sidebar: doc_sidebar -permalink: csp_user_management.html -summary: Add and manage users of VMware Aria Operations for Applications on VMware Cloud services. ---- - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for VMware Cloud services subscriptions. For **original** subscriptions, see [Manage User Accounts](user-accounts.html)."%} - -VMware Cloud services provides identity access management for the users of your services, including Operations for Applications. For example, see our tutorial [Invite New Users from the VMware Cloud Services Console](csp_new_users_tutorial.html). - -{% include note.html content="To manage user access to the services in your VMware Cloud organization, you must hold the VMware Cloud **Organization Owner** or **Organization Administrator** role. See [What organization roles are available in VMware Cloud Services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-C11D3AAC-267C-4F16-A0E3-3EDF286EBE53.html) in the VMware Cloud services documentation."%} - -## Adding Users to Your Service Instance - -To add a user to your Operations for Applications service instance, you must assign that user: - -1. An organization role for the VMware Cloud organization running the service instance. - - {% include note.html content="If you are a VMware Cloud **Organization Administrator**, you can assign only the VMware Cloud **Organization Member** role. Only a VMware Cloud **Organization Owner** can add VMware Cloud **Organization Owners** and VMware Cloud **Organization Administrators**."%} - -1. An [Operations for Applications service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) for the service instance. - - You can assign a combination of service roles. For example, if the user that you want to invite will set up integrations, make sure that you assign that user both the **Integrations** and the **Proxies** service roles. - - If you plan to assign that user a custom role, you must assign that user at least the **Viewer** Operations for Applications service role, so that the user can access the service instance. - - {% include note.html content="In a multi-tenant environment, you assign service roles on a tenant basis. You can assign different service roles for different Operations for Applications instances (tenants). The users have access only to the tenants for which they have service roles. The users receive the `401 Unauthorized: User has no access to service` error message when trying to access a tenant for which they don't have service roles."%} - - {% include important.html content="Make sure that you assign the [**Super Admin** service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) to at least one user of your Operations for Applications service instance. There are some Super Admin tasks that no one else can perform. "%} - -1. Optionally, a [custom role](csp_users_roles.html#create-edit-or-delete-a-custom-role) with an Operations for Applications permission. - - {% include important.html content="In a multi-tenant Operations for Applications environment, custom roles apply to **all** service instances (tenants) to which the user has access, that is, for which the user has at least one Operations for Applications service role."%} - -You can assign users with these roles in the following ways: - -### Adding Users to Your Organization - -When you are adding an individual user or a list of users to the VMware Cloud organization running the service instance, you must assign that users organization roles. To grant the users access to the Operations for Applications instance, you assign that users service roles. Optionally, you can also assign the users custom roles, which apply only in combination with service roles. - -For details, see [How do I add users to my Organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-47AA313E-9DAC-447C-B6C8-DF71ED45B0D5.html). - -The newly added users receive an invitation email with an account activation link to sign up to the service instance. The invitations you send are valid for seven days. You can view the status of the invitation on the **Identity and Access Management** > **Pending Invitations** page. - -### Creating or Editing a Group - -When you are creating or editing a group in the VMware Cloud organization running the service instance, you can add a list of users as members of the group and you can assign organization, service, and custom roles to the group. - -You can add users who already belong to the VMware Cloud organization as well as new users who don't belong to the VMware Cloud organization yet. You can add users from your federated domain as well as users that are outside your federated domain. - -For details, see [How do I work with groups](hhttps://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-0BD8A07B-C3C0-4220-8CD0-18FA070D3DAD.html) in the VMware Cloud services documentation. - -The newly added users receive an invitation email with an account activation link to sign up to the service instance. The invitations you send are valid for seven days. You can view the status of the invitation on the **Identity and Access Management** > **Pending Invitations** page. - -### Editing a User's Roles - -If a user already belongs to the VMware Cloud organization running the service instance, you can edit the user's roles to assign that user with Operations for Applications service or custom roles. - -For details, see [How do I change user roles](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-A70DBFDC-86FD-4C84-8753-0E55C8C98F8E.html) in the VMware Cloud services documentation. - -## Remove a User - -- To remove a user from your service instance, you must remove their [Operations for Applications service roles](csp_users_roles.html#operations-for-applications-service-roles-built-in). - - If the roles are individually assigned to the user, edit the user's roles. See [How do I change user roles](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-A70DBFDC-86FD-4C84-8753-0E55C8C98F8E.html) in the VMware Cloud services documentation. - - If the roles are inherited from a group, edit the group and remove that user from the list of members. See [How do I work with groups](hhttps://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-0BD8A07B-C3C0-4220-8CD0-18FA070D3DAD.html) in the VMware Cloud services documentation. - -- To remove a user from your organization, therefore from all services in the organization, see [How do I remove users from my Organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-628143FC-7DB0-4399-8344-43F75F748ADF.html) in the VMware Cloud services documentation. - -## Sign Out a User - -As a user with the [**Super Admin** service role](csp_users_roles.html#operations-for-applications-service-roles-built-in), you can sign out other users by using the [REST API](wavefront_api.html). To sign out a user while you enabled Super Admin mode, simply run a POST request with the `logout` API call. For example: - -``` -POST https://.wavefront.com/api/logout/{identifier} -``` - -You must specify the `{identifier}`, which is the email address of the user that you want to log out. If you are not logged in to your service instance, when you run the POST request, you must also provide a valid API token. \ No newline at end of file diff --git a/pages/doc/csp_users_roles.md b/pages/doc/csp_users_roles.md deleted file mode 100644 index dd15b2e6a..000000000 --- a/pages/doc/csp_users_roles.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Manage Roles and Groups in VMware Cloud Services -keywords: administration -tags: [administration] -sidebar: doc_sidebar -permalink: csp_users_roles.html -summary: Manage Operations for Applications permissions with roles. ---- - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for VMware Cloud services subscriptions. For **original** subscriptions, see [Manage Roles, Groups, and Permissions](users_roles.html)."%} - -VMware Cloud services supports roles to manage authorization in your services on the platform, including VMware Aria Operations for Applications. - -From the VMware Cloud Services Console, users with the VMware Cloud **Organization Owner** or **Organization Administrator** role can: -* Create **groups** and add new and existing users to each group. -* Create **custom roles** and assign Operations for Applications permissions to each role. -* Assign one or more **service roles** and **custom roles** to each group. It's also possible to assign roles to individual users and server to server apps. - -In addition to the roles model, Operations for Applications also supports [access control for individual objects](csp_access.html), for example, users with the **Super Admin** service role can limit access to a sensitive dashboard. - -## Manage Roles - -The roles model allows you to make sure nobody can perform tasks without the corresponding permission. - -Assigning roles to groups of users is most efficient and least error prone. It's possible to assign a role to an individual account -- that might make sense during a POC. - -VMware Cloud services includes built-in **service roles** for each service on the platform, including Operations for Applications service roles. Additionally, VMware Cloud services supports **custom roles**. - -- A role can be assigned for a certain time period or without an expiration date. -- At least one Operations for Applications service role is required for a user to have access to the Operations for Applications service instance. Custom roles are optional. -- In a multi-tenant environment, a user can have different service roles for the different Operations for Applications service instances (tenants). Custom roles apply to **all** tenants for which the user has a service role. - - {% include note.html content="When you invite new users in a multi-tenant environment, make sure that you assign them the roles they need for each Operations for Applications service instance (tenant). For information on how to do this, see [Invite New Users from the VMware Cloud Services Console](csp_new_users_tutorial.html)."%} - -The VMware Cloud Services Console **Roles** page lists all service roles and custom roles in your VMware Cloud organization. To navigate to this page: - -1. Log in to the VMware Cloud Services Console as an **Organization Owner** or **Organization Administrator**. -1. If necessary, switch to the target organization. See [How do I access another one of my Organizations](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-432417CF-CE0C-48EB-BEBB-8C27751577D1.html). -1. In the left navigation pane, select **Identity & Access Management** > **Roles**. - -### Operations for Applications Service Roles (Built-in) - -The VMware Cloud Services Console **Roles** page includes the following built-in Operations for Applications service roles: -- A corresponding Operations for Applications service role for each Operations for Applications permission, that is, each of the following service roles has only one permission assigned: - - * **Admin** - * **Alerts** - * **Applications** - * **Batch Query Priority** - * **Charts Embedding** - * **Dashboards** - * **Derived Metrics** - * **Direct Data Ingestion** - * **Events** - * **External Links** - * **Ingestion Policies** - * **Integrations** - * **Logs** - * **Metrics** - * **Proxies** - * **Sources** -- Two special Operations for Applications service roles - one that grants full administrative access to the service, and another one that grants read-only access to the service: - - - - - - - - - - - - - - -
Service RoleDescription
Super AdminWhen users with that service role enable Super Admin mode, they: -

Tip: Combine the Super Admin service role with the roles that you want the user to have when Super Admin mode is disabled.

ViewerUsers with that service role:
    -
  • Don't have any Operations for Applications permissions.
    • -
  • Can perform only the default tasks.
    • -
-

Tip: Assign the Viewer service role individually or in combination with custom roles.

- -### Create, Edit, or Delete a Custom Role - -Custom roles let you combine service permissions of your choice, for example, Operations for Applications permissions. A custom role can have permissions for one or multiple services in your organization. For example, you can have a custom role that grants administrative permissions for one service and read-only permissions for another service. - -{% include important.html content="The Operations for Applications permissions in a custom role apply to **all** Operations for Applications service instances to which the target user account or server to server app has access. Therefore, to obtain the Operations for Applications permissions from a custom role for a given Operations for Applications service instance, the user account or server to server app assigned with that custom role must have at least one Operations to Applications service role for that service instance, for example, the **Viewer** service role."%} - -To create a custom role: - -1. On the VMware Cloud Services Console **Roles** page, click **Add Role**. -1. On the **Add permissions** tab, in the left panel, expand **VMware Aria Operations for Applications**. -1. In the panel on the right, select the permissions that you want to assign to the role, and click **Continue**. -1. On the **Role information** tab, enter a meaningful role name and description, and click **Continue**. -1. On the **Review added permission** tab, verify your selections and click **Save**. - -To edit a custom role: - -1. On the VMware Cloud Services Console **Roles** page, click the name of the target custom role. -1. Edit the role name, description, or permissions, and click **Save**. - -To delete a custom role: - -1. On the VMware Cloud Services Console **Roles** page, select one or more custom roles and click **Remove Roles**. -1. Click **Remove** to confirm. - -### Assign Default Roles for a Federated Domain - -For a [federated domain](csp_authentication.html#federated-domain-authentication), users with the **Organization Owner** role can configure a policy with default VMware Cloud organization and service roles for all users in the federated domain. For details, see [How do I assign default roles in my Organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-2307F55C-FB5C-4EE0-A2DE-43011509A9A1.html) in the VMware Cloud services documentation. - -## Manage User Groups - -For efficient user management, you can create groups of users and assign roles to these groups. You can add new and existing users to a group. You can assign [service roles](#operations-for-applications-service-roles-built-in) and [custom roles](#create-edit-or-delete-a-custom-role) to a group. - -See [How do I work with groups](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-0BD8A07B-C3C0-4220-8CD0-18FA070D3DAD.html) in the VMware Cloud services documentation. - -{% include note.html content="Operations for Applications includes an internal **Everyone** system group, where any new user account is added automatically. This group doesn't have any roles and permissions. This group can be used when managing [access to dashboards and alerts](csp_access.html), [metrics security policy rules](csp_metrics_security.html), and [ingestion policies](ingestion_policies.html)."%} - -## Grant or Revoke a User's Role Explicitly - -To change the roles that are individually assigned to a user, see [How do I change user roles](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-A70DBFDC-86FD-4C84-8753-0E55C8C98F8E.html). \ No newline at end of file diff --git a/pages/doc/direct_ingestion.md b/pages/doc/direct_ingestion.md index 7244f2461..d2c94aa9d 100644 --- a/pages/doc/direct_ingestion.md +++ b/pages/doc/direct_ingestion.md @@ -36,11 +36,7 @@ Because some customers wanted to send data directly to the Operations for Applic ## Direct Ingestion Example Commands The following examples illustrate how to send data directly to the Operations for Applications service. -* A token is required. Referred to as `` in the examples. Depends on your [subscription type](subscriptions-differences.html): - - - For VMware Cloud services subscriptions, a VMware Cloud services access token is required. You can retrieve an access token by exchanging your user API token or [server to server OAuth credentials](csp_server_to_server_apps.html#how-server-to-server-apps-work). - - For original subscriptions, an [API token](api_tokens.html) is required. The API token can be associated to a user account or service account. - +* An [API token](api_tokens.html) is required. The API token can be associated to a user account or service account. * You must know your Operations for Applications service instance name. This doc page uses `mydomain.wavefront.com`. * Currently, direct ingestion supports only [Operations for Applications Data Format](wavefront_data_format.html), which is named `wavefront`. If you don't specify `f=wavefront`, we still use that format. diff --git a/pages/doc/ingestion_policies.md b/pages/doc/ingestion_policies.md index eaef3864b..8f9859b60 100644 --- a/pages/doc/ingestion_policies.md +++ b/pages/doc/ingestion_policies.md @@ -54,13 +54,10 @@ In the **Data** panel, specify the scope and, optionally, a PPS limit and click Accounts - Depends on your subscription type. + Individual user and service accounts. Groups - Depends on your subscription type.
  • If your Operations for Applications service is onboarded to VMware Cloud services, groups of VMware Cloud services users. -

    You can also select the Everyone internal system group (which includes all users) or the Service Accounts internal system group (which includes all server to server apps that have access to your service as well as all service accounts in your service).

    • -
  • If your Operations for Applications service is an original subscription, groups of user and service accounts, including the Everyone and Service Accounts system groups.
+ Groups of user and service accounts, including the Everyone and Service Accounts system groups. diff --git a/pages/doc/integrations_cloudhealth.md b/pages/doc/integrations_cloudhealth.md index 3305efd41..935a8f51e 100644 --- a/pages/doc/integrations_cloudhealth.md +++ b/pages/doc/integrations_cloudhealth.md @@ -34,18 +34,6 @@ Here's what you need to get started. * You need access to a product cluster (`https://.wavefront.com`) that monitors the data source you're interested in. * A valid API token to let CloudHealth access our API. - - The API token must be a [valid Operations for Applications API token](api_tokens.html) of a user account or a service account that has access to the Operations for Applications sources that you want to ingest in CloudHealth. {% include tip.html content="Creating a service account is often the right approach." %} diff --git a/pages/doc/integrations_grafana.md b/pages/doc/integrations_grafana.md index 318feca07..eda34d1a7 100644 --- a/pages/doc/integrations_grafana.md +++ b/pages/doc/integrations_grafana.md @@ -13,11 +13,8 @@ When you set up VMware Aria Operations for Applications as a data source in Graf ## Set Up VMware Aria Operations for Applications as a Prometheus Data Source -To set up VMware Aria Operations for Applications as a PromQL data source in Grafana, you must provide an API Token. +To set up VMware Aria Operations for Applications as a PromQL data source in Grafana, you must provide an API Token. The API token must be a [valid Operations for Applications API token](api_tokens.html) of a user account or a service account that can run queries. - 1. Log in to your Grafana instance. 2. In the Navigation bar on the left, click **Configuration**. diff --git a/pages/doc/integrations_tmc.md b/pages/doc/integrations_tmc.md index 7e04ad2a5..4797c1ebd 100644 --- a/pages/doc/integrations_tmc.md +++ b/pages/doc/integrations_tmc.md @@ -18,17 +18,7 @@ You can set up seamless authentication from Tanzu Mission Control to VMware Aria ## Generate an API Token for Tanzu Mission Control - +Use the procedure below to create a service account API token and use it with Tanzu Mission Control. 1. Log in to your service instance as a user with the **Accounts** permission. 2. Click the gear icon in the top right of the toolbar, select **Accounts**, and provide your password again when prompted. diff --git a/pages/doc/integrations_tmc_howto.md b/pages/doc/integrations_tmc_howto.md index 242311b61..1b4519818 100644 --- a/pages/doc/integrations_tmc_howto.md +++ b/pages/doc/integrations_tmc_howto.md @@ -25,10 +25,6 @@ To get started, you set up the integration from Tanzu Mission Control to VMware ### Step 1: Generate an API Token - - In your product cluster, [Generate a Service Account API Token for Tanzu Mission Control](integrations_tmc.html#generate-an-api-token-for-tanzu-mission-control). ### Step 2: In Tanzu Mission Control, Set Up the Integration diff --git a/pages/doc/logging_log_alerts.md b/pages/doc/logging_log_alerts.md index 9adf081d8..88612d327 100644 --- a/pages/doc/logging_log_alerts.md +++ b/pages/doc/logging_log_alerts.md @@ -24,7 +24,7 @@ You can create alerts for your logs data and get email notifications when the al You need the Alerts and Logs permissions to create and manage logs alerts. -

The steps to add roles and permissions differ for onboarded and original subscriptions. For details, see how to manage roles, groups, and permissions for onboarded subscriptions and original subscriptions.

+

The steps to add roles and permissions differ for onboarded and original subscriptions. For details, see how to manage roles, groups, and permissions for onboarded subscriptions and original subscriptions.

{{site.data.alerts.end}} ## Alerts Browser diff --git a/pages/doc/logging_overview.md b/pages/doc/logging_overview.md index 3ca4ee6f5..07d115d27 100644 --- a/pages/doc/logging_overview.md +++ b/pages/doc/logging_overview.md @@ -40,7 +40,7 @@ summary: Learn about VMware Aria Operations for Applications (formerly known as
  • Only users with the Logs permission can view the Logs Browser and drill down into logs from charts, alerts, and traces. -

    The steps to add roles and permissions differ for Onboarded and Original subscriptions. See add permissions details for Onboarded subscriptions and Original subscriptions.

    +

    The steps to add roles and permissions differ for Onboarded and Original subscriptions. See add permissions details for Onboarded subscriptions and Original subscriptions.

    • {{site.data.alerts.end}} diff --git a/pages/doc/proxies_installing.md b/pages/doc/proxies_installing.md index 80a096bf8..f276b601d 100644 --- a/pages/doc/proxies_installing.md +++ b/pages/doc/proxies_installing.md @@ -33,26 +33,9 @@ In most cases, a Wavefront proxy must be running in your environment before metr -## Proxy Authentication Types +## Proxy Authentication Type -* If your Operations for Applications service instance **is** onboarded to VMware Cloud services, the proxy requires a VMware Cloud services access token with the **Proxies** [service role](csp_users_roles.html#operations-for-applications-service-roles-built-in). There are two options for the proxy to retrieve an access token. You can configure the proxy with: - * The credentials (ID and secret) of a VMware Cloud services server to server **OAuth app** and the ID of the VMware Cloud organization running the service. - - Before you add a proxy with an OAuth app, you must retrieve the credentials (ID and secret) of a server to server app that is assigned with the **Proxies** Operations for Applications service role and added to the VMware Cloud organization running the service. See [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html?hWord=N4IgpgHiBcIMpgE4DckAIAuB7NBnJqiaAhgA6kgC+QA) in the VMware Cloud services documentation. - - Also, you must retrieve the VMware Cloud organization long ID. See [View the Organization ID](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-CF9E9318-B811-48CF-8499-9419997DC1F8.html#view-the-organization-id-1) in the VMware Cloud services documentation. - - {% include note.html content="When the access token expires, depending on the token TTL configuration of the server to server app, the proxy automatically retrieves a new access token."%} - - * A VMware Cloud services **API token** that belongs to your user account. - - Before you add a proxy with an API token, you must have a VMware Cloud services API token that belongs to the VMware Cloud organization running the service and that is assigned with the **Proxies** service role. See [How do I generate API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E2A3B1C1-E9AD-4B00-A6B6-88D31FCDDF7C.html). - - {% include important.html content="You might need to regenerate and reconfigure the API token periodically depending on its TTL configuration."%} - -* If your Operations for Applications service instance **isn't** onboarded to VMware Cloud services, the proxy requires an Operations for Applications **API token**. - - Before you add a proxy, you must have an API token associated with your user account or a service account with the **Proxies** permission. See [Manage API Tokens](api_tokens.html) for details. +Before you add a proxy, you must have an API token associated with your user account or a service account with the **Proxies** permission. See [Manage API Tokens](api_tokens.html) for details. ## Install a Proxy @@ -66,7 +49,6 @@ To install and run a proxy: 1. Log in to your service instance and select **Browse** > **Proxies**. 1. Click **Add New Proxy**. -1. If your service instance is onboarded to VMware Cloud services, click the tab for the [proxy authentication type](#proxy-authentication-types) of your choice - **OAuth app** or **API token**. 1. Click the tab for your operating system and follow the steps on screen. {% include tip.html content="If your service instance isn't onboarded to VMware Cloud services, the latest API token of your user account is prepopulated in the proxy installation command but you can change it."%} @@ -183,8 +165,8 @@ You can test that a proxy is receiving and sending data as follows: 1. Send data by running the following command: ```shell -echo -e "test.metric 1 source=test_host\n" | nc 2878 - ``` + echo -e "test.metric 1 source=test_host\n" | nc 2878 + ``` where `` is the address of your Wavefront proxy. 1. Log in to service instance and select **Browse > Metrics**. 1. In the Metrics field, type `test.metric`. diff --git a/pages/doc/purchase-additional-capacity.md b/pages/doc/purchase-additional-capacity.md index 6c3871253..604afa595 100644 --- a/pages/doc/purchase-additional-capacity.md +++ b/pages/doc/purchase-additional-capacity.md @@ -7,9 +7,7 @@ permalink: purchase_additional_capacity.html summary: Learn how to add capacity to your current VMware Aria Operations for Applications subscription. --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. For information about VMware Cloud services subscriptions and original subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html).
    -- For VMware Cloud services subscriptions, to purchase additional capacity, you must hold the **Organization Owner** role in the VMware Cloud organization running the service as well as at least one [Operations for Applications service role](csp_users_roles.html#operations-for-applications-service-roles-built-in) for the service instance. If your enterprise domain is federated, to access the organization billing account, you must have a VMware account linked to your corporate account.
    -- For original Operations for Applications subscriptions, to purchase additional capacity, you must be a **Super Admin** user."%} +To purchase additional capacity, you must be a **Super Admin** user. ## Supported Contracts diff --git a/pages/doc/security_policy.md b/pages/doc/security_policy.md index 3ce6d3cf8..44f217757 100644 --- a/pages/doc/security_policy.md +++ b/pages/doc/security_policy.md @@ -7,8 +7,6 @@ permalink: security_policy.html summary: Use security policies to control access to metrics, such as time series, histograms, RED metrics, and delta counters, as well as traces. --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscribers. For VMware Cloud services subscriptions, see [Metrics Security Policy Rules in Operations for Applications on VMware Cloud Services](csp_metrics_security.html)."%} - You can create security policies on VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) to protect your metrics and traces security data. An overview image that shows metrics and traces security policies. diff --git a/pages/doc/users_roles.md b/pages/doc/users_roles.md index a8d06420a..653949da8 100644 --- a/pages/doc/users_roles.md +++ b/pages/doc/users_roles.md @@ -7,8 +7,6 @@ permalink: users_roles.html summary: Manage global permissions with roles. --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscriptions. For VMware Cloud services subscriptions, see [Manage Roles and Groups in VMware Cloud Services](csp_users_roles.html)."%} - VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) supports roles to fine-tune authorization in the Wavefront environment. Users with the **Accounts** permission can: From c675f444217c0a1f2973d80a835b1b0a3030fcc0 Mon Sep 17 00:00:00 2001 From: shavidissa Date: Thu, 27 Jun 2024 14:38:06 -0700 Subject: [PATCH 04/12] Update the pages with the note --- _data/sidebars/doc_sidebar.yml | 8 +- pages/doc/api_tokens.md | 2 - pages/doc/csp_subscription_types.md | 2 - pages/doc/csp_supported_integrations.md | 491 --------------------- pages/doc/integrations.md | 20 +- pages/doc/integrations_new_changed.md | 15 - pages/doc/integrations_new_changed_2023.md | 8 +- pages/doc/logging_logs_settings.md | 4 +- pages/doc/logging_overview.md | 3 +- pages/doc/logging_proxy_configurations.md | 36 -- pages/doc/permissions_overview.md | 2 - pages/doc/proxies_container.md | 4 - pages/doc/proxies_installing.md | 4 - pages/doc/proxies_troubleshooting.md | 2 - pages/doc/wavefront_administer.md | 2 - pages/doc/wavefront_api.md | 2 - pages/doc/wavefront_obsolescence_policy.md | 10 - pages/doc/wavefront_prometheus.md | 4 - 18 files changed, 8 insertions(+), 611 deletions(-) delete mode 100644 pages/doc/csp_supported_integrations.md diff --git a/_data/sidebars/doc_sidebar.yml b/_data/sidebars/doc_sidebar.yml index 3e48ae75a..b90e1855a 100755 --- a/_data/sidebars/doc_sidebar.yml +++ b/_data/sidebars/doc_sidebar.yml @@ -462,11 +462,7 @@ entries: - title: Integrations Overview url: /integrations.html - output: web - - - title: How Integration Authentication Works - url: /integrations_onboarded_subscriptions.html - output: web + output: webd - title: Complete List of Integrations url: /label_integrations%20list.html @@ -877,7 +873,7 @@ entries: url: /wavefront_clis.html output: web - - title: Administering Original Subscriptions + - title: Administration output: web folderitems: diff --git a/pages/doc/api_tokens.md b/pages/doc/api_tokens.md index a556a4130..242a7aadd 100644 --- a/pages/doc/api_tokens.md +++ b/pages/doc/api_tokens.md @@ -7,8 +7,6 @@ permalink: api_tokens.html summary: Learn how you can generate and manage API tokens in VMware Aria Operations for Applications (previously known as Tanzu Observability by Wavefront). --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscriptions. For VMware Cloud services subscriptions, see Manage Tokens."%} - Before you can invoke the [REST API](wavefront_api.html) using `curl` or from an API client, you must have an API token. An API token is a string of hexadecimal characters and dashes. For example: ``` diff --git a/pages/doc/csp_subscription_types.md b/pages/doc/csp_subscription_types.md index 336f0deb6..ed8121e17 100644 --- a/pages/doc/csp_subscription_types.md +++ b/pages/doc/csp_subscription_types.md @@ -11,9 +11,7 @@ Operations for Applications subscriptions are two types: original subscriptions ## Why the Two Subscription Types Differ? -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the [VMware Cloud services platform](https://console.cloud.vmware.com/) and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. -{% include note.html content="We will support both **original** and **onboarded** subscriptions until all original subscriptions are onboarded to VMware Cloud services." %} VMware Cloud services provides single sign-on (SSO) and identity access management (IAM) to your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. Therefore, there are differences in the experience for VMware Cloud services subscribers and original subscribers. diff --git a/pages/doc/csp_supported_integrations.md b/pages/doc/csp_supported_integrations.md deleted file mode 100644 index 990dc3174..000000000 --- a/pages/doc/csp_supported_integrations.md +++ /dev/null @@ -1,491 +0,0 @@ ---- -title: How Integration Authentication Works -keywords: integrations -tags: -sidebar: doc_sidebar -permalink: integrations_onboarded_subscriptions.html -summary: Learn how integration authentication happens, which integrations work with VMware Cloud services access tokens and which integrations still work with Operations for Applications API tokens. ---- - -## Subscription Types - -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. - -For best performance, when you set up most of our integrations, it is recommended to use the Wavefront proxy. The Wavefront proxy ingests metrics and forwards them to Operations for Applications in a secure, fast, and reliable manner. - -### VMware Cloud Services Subscriptions - -When your Operations for Applications service **is onboarded** to the VMware Cloud services platform you have the following choices for the [Wavefront proxy](proxies_installing.html) authentication: - -**VMware Cloud Services Access Token** - -The Wavefront proxy requires a VMware Cloud services access token with the **Proxies** service role. There are two options for the proxy to retrieve an access token. You can configure the Wavefront proxy to use: - -* OAuth App authentication (recommended): - - You must use the credentials (client ID and client secret) of an existing server to server OAuth app which has the **Proxies** service role assigned and is added to the VMware Cloud organization running the service. You must also provide the long ID of the VMware Cloud organization running the service. - - If you don’t have a server to server app already, you can create one in the VMware Cloud Services Console. For details, see [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. You can also try out the [Windows host integration tutorial](windows_host_tutorial.html). - - When the access token expires, depending on the token TTL configuration of the server to server app, the Wavefront proxy automatically retrieves a new access token. - -* API Token authentication: - - The API token must be generated in the VMware Cloud Services Console by an active user account. It also must have the **Proxies** service role assigned. For more information, see [How do I generate API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E2A3B1C1-E9AD-4B00-A6B6-88D31FCDDF7C.html). - - You might need to regenerate and reconfigure the API token periodically depending on the TTL configuration. - -**Operations for Applications API token** - -For a limited number of integrations, you must still use an Operations for Applications API token, associated with a service account that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. - -{% include warning.html content=" It is strongly recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens. Service accounts and Operations for Applications API tokens will be deprecated in the future." %} - - - -To understand how you can manage the API tokens for service accounts, see Managing the Operations for Applications API Tokens for a Service Account. - - -### Original Subscriptions - -When your Operations for Applications service instance **is not onboarded** to VMware Cloud services, the proxy requires an Operations for Applications **API token**. - -Before you add a proxy, you must have an API token associated with your user account or a service account with the **Proxies** permission. See [Manage API Tokens](api_tokens.html) for details. - - -## Integrations That Use VMware Cloud Services Access Tokens - -We're in the process of incrementally updating our integrations so that you can authenticate with a VMware Cloud services API token or OAuth server to server app credentials. - -{% include note.html content= "The integrations in the **Archived** section are approaching their end-of-life. For that reason, we will not update these integrations to authenticate with VMware Cloud services access tokens." %} - -When your Operations for Applications service **is onboarded** to the VMware Cloud services platform, the list of the integrations that are updated as of today is in the table below. This list grows with each release. If you urgently need an integration to become available and configurable with a VMware Cloud services access token, please contact [technical support](wavefront_support_feedback.html). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    IntegrationLink to Doc Page
    Chef Server[Chef Server](wavefront-chef.html)
    Micrometer[Micrometer](micrometer.html)
    Tanzu Application Service[Tanzu Application Service Integration](tas_v4.html)
    Kubernetes[Kubernetes Integration](kubernetes.html)
    Linux Host[Linux Host Integration](linux.html)
    Suse Linux Host[Suse Linux Host Integration](suse.html)
    Oracle Linux Host[Oracle Linux Host Integration](oel.html)
    Fedora Linux Host[Fedora Linux Host Integration](fedora.html)
    Amazon Linux AMI Host[Amazon Linux AMI Host Integration](aws_linux.html)
    Red Hat Enterprise Linux Host[Red Hat Enterprise Linux Host Integration](redhat.html)
    Ubuntu Host[Ubuntu Host Integration](ubuntu.html)
    Debian Host[Debian Host Integration](debian.html)
    CentOS Host[CentOS Host Integration](centos.html)
    Mac Host[Mac Host Integration](mac.html)
    Windows Host[Windows Host Integration](windows.html)
    NetBSD Host[NetBSD Host Integration](netbsd.html)
    VMware vSphere[VMware vSphere Integration](vsphere.html)
    StatsD[StatsD Integration](statsd.html)
    Prometheus[Prometheus Integration](prometheus.html)
    OpenTelemetry[OpenTelemetry Integration](opentelemetry_overview.html)
    SNMP [SNMP Integration](snmp.html)
    Apache ActiveMQ[Apache ActiveMQ Integration](activemq.html)
    Apache HTTP[Apache HTTP Integration](apache.html)
    Apache HTTP[Apache HTTP Integration](apache.html)
    Apache Hadoop HDFS[Apache Hadoop HDFS Integration](hadoop-hdfs.html)
    Apache Hadoop MapReduce [Apache Hadoop MapReduce Integration](hadoop-mapreduce.html)
    Apache Hadoop YARN[Apache Hadoop YARN Integration](hadoop-yarn.html)
    Apache Impala[Apache Impala Integration](impala.html)
    Apache Kudu[Apache Kudu Integration](kudu.html)
    Apache Mesos[Apache Mesos Integration](mesos.html)
    Apache Solr[Apache Solr Integration](solr.html)
    Apache Spark[Apache Spark Integration](spark.html)
    Apache Tomcat[Apache Tomcat Integration](tomcat.html)
    Atlassian Bitbucket[Atlassian Bitbucket Integration](bitbucket.html)
    Cassandra[Cassandra Integration](cassandra.html)
    Catchpoint[Catchpoint Integration](catchpoint.html)
    Ceph[Ceph Integration](ceph.html)
    Chef[Chef Integration](chef.html)
    Concourse CI Integration[Concourse CI Integration](concourse.html)
    Consul[Consul Integration](consul.html)
    Convox[Convox Integration](convox.html)
    Couchbase[Couchbase Integration](couchbase.html)
    CouchDB[CouchDB Integration](couchdb.html)
    Elasticsearch[Elasticsearch Integration](elasticsearch.html)
    Envoy Proxy[Envoy Proxy Integration](envoy.html)
    etcd KV store[etcd KV store Integration](etcd.html)
    FoundationDB[FoundationDB Integration](fdb.html)
    Fluentd[Fluentd Integration](fluentd.html)
    Github[Github Integration](github.html)
    GitLab[GitLab Integration](gitlab.html)
    VMware Tanzu Greenplum[VMware Tanzu Greenplum Integration](greenplum.html)
    HAProxy[HAProxy Integration](haproxy.html)
    Java[Java Integration](java.html)
    JBoss AS [JBoss AS Integration](jboss.html)
    Jenkins[Jenkins Integration](jenkins.html)
    JMX[JMX Integration](jmx.html)
    Kafka[Kafka Integration](kafka.html)
    Kong[Kong Integration](kong.html)
    Lighttpd[Lighttpd Integration](lighttpd.html)
    Marathon[Marathon Integration](marathon.html)
    Memcached[Memcached Integration](memcached.html)
    MongoDB[MongoDB Integration](mongodb.html)
    MySQL[MySQL Integration](mysql.html)
    Nagios[Nagios Integration](nagios.html)
    NGINX [NGINX Integration](nginx.html)
    NGINX Plus [NGINX Plus Integration](nginxplus.html)
    NVIDIA [NVIDIA Integration](nvidia.html)
    Oracle RDBMS[Oracle RDBMS Integration](oracle.html)
    Papertrail[Papertrail Integration](papertrail.html)
    PHP-FPM[PHP-FPM Integration](phpfpm.html)
    Pingdom[Pingdom Integration](pingdom.html)
    PostgreSQL [PostgreSQL Integration](postgresql.html)
    Puppet Server[Puppet Server Integration](puppet.html)
    RabbitMQ[RabbitMQ Integration](rabbitmq.html)
    Redis[Redis Integration](redis.html)
    Riak KV Store[Riak KV Store Integration](redis.html)
    Rollbar[Rollbar Integration](rollbar.html)
    Runscope[Runscope Integration](runscope.html)
    Twemproxy[Twemproxy Integration](twemproxy.html)
    Varnish Cache[Varnish Cache Integration](varnishcache.html)
    Hashicorp Vault[Hashicorp Vault Integration](vault.html)
    Oracle WebLogic Server[Oracle WebLogic Server Integration](weblogic.html)
    IBM WebSphere Application Server[IBM WebSphere Application Server Integration](websphere.html)
    ZooKeeper[ZooKeeper Integration](zookeeper.html)
    Active Directory[Active Directory Integration](activedirectory.html)
    Cernan[Cernan Integration](cernan.html)
    Docker with cAdvisor[Docker with cAdvisor Integration](docker.html)
    .NET[.NET Integration](dotnet.html)
    Filebeat Log Data[Filebeat Log Data Integration](filebeat.html)
    Microsoft Hyper-V[Microsoft Hyper-V Integration](hyperv.html)
    IIS[IIS Integration](iis.html)
    Microsoft Exchange[Microsoft Exchange Integration](msexchange.html)
    OpenTSDB[OpenTSDB Integration](opentsdb.html)
    SharePoint [SharePoint Integration](sharepoint.html)
    Splunk[Splunk Integration](splunk.html)
    Microsoft SQL Server[Microsoft SQL Server Integration](sqlserver.html)
    Uptime[Uptime Integration](uptime.html)
    Windows Performance Counters[Windows Performance Counters Integration](winperf.html)
    Windows Service[Windows Service Integration](winserv.html)
    Zabbix [Zabbix Integration](zabbix.html)
    Zipkin [Zipkin Integration](zipkin.html)
    Velero [Velero Integration](velero.html)
    - - -## Integrations That Use Operations for Applications API Tokens - -Here's the list of the integrations that still use API tokens. Currently, if your service **is onboarded** to VMware Cloud services, direct ingestion by using the Wavefront Output Plugin for Telegraf is supported only when you use a service account. - -* [Spring Boot](springboot.html) -* [VMware Tanzu Mission Control Advanced](tmc.html) -* [VMware GemFire](gemfire.html) -* [VMware Tanzu Kubernetes Grid Integration](tkgi.html) -* [Terraform Provider](wavefront-terraform-provider.html) -* [VMware Aria Operations for Logs](log-insight-cloud.html) -* [VMware Spring Cloud Data Flow for Kubernetes](scdf.html) -* [Datadog](datadog.html) -* [Grafana](grafana.html) -* [C Sharp](csharp.html) - -## List of Unaffected Integrations - -The following integrations do not depend on the subscription type and work as expected, no matter whether your Operations for Applications service is onboarded to VMware Cloud services platform or not. - -### Cloud Integrations - -* [Google Cloud Platform](gcp.html) -* [Amazon Web Services](aws.html) -* [Microsoft Azure](azure.html) -* [AppDynamics](appdynamics.html) -* [Dynatrace](dynatrace.html) -* [New Relic](newrelic.html) -* [VMware Aria Operations (SaaS)](integrations_vrops.html) - - Note that currently this integration works with a VMware Cloud services API token only. - -* [Snowflake](snowflake.html) - -### Notification Integrations - -* [BigPanda](bigpanda.html) -* [Microsoft Teams](msteams.html) -* [PagerDuty](pagerduty.html) -* [Slack](slack.html) -* [Jira](jira.html) -* [OpsGenie](opsgenie.html) -* [ServiceNow](servicenow.html) -* [Splunk On-Call](victorops.html) - -### Other Integrations - -* [Webhooks](webhooks.html) -* [Graphite](graphite.html) -* [Operations for Applications Usage Integration](wavefront_monitoring.html) - diff --git a/pages/doc/integrations.md b/pages/doc/integrations.md index d7b452af9..ce7dcede7 100644 --- a/pages/doc/integrations.md +++ b/pages/doc/integrations.md @@ -11,8 +11,6 @@ Integrations are one easy way to get data from external systems into VMware Aria We update our [integrations release notes](integrations_new_changed.html) frequently. -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the [VMware Cloud services platform](https://console.cloud.vmware.com/) and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until they migrate to VMware Cloud services. For information about the subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). - ## Watch a Video In this video, Jason talks about the different integrations we have, and how you can use them to get your data into the product. You can also watch the video here video camera icon. Note that this video was created in 2017 and some of the information in it might have changed. It also uses the 2017 version of the UI. @@ -25,23 +23,7 @@ In this video, Jason talks about the different integrations we have, and how you Sign up for a trial version to try our integrations. Detailed setup steps for each integration are in the product UI. -When the integration setup requires a token for the proxy authentication, the setup instructions of some integrations (such as all integrations for Linux distributions, Windows host integration, MacOS integration, Prometheus, and so on) vary depending on whether your service is onboarded to VMware Cloud services or not. For details, see [Integrations Supported for Onboarded Subscriptions](integrations_onboarded_subscriptions.html). For the latest and most recent instructions on how to set up an integration, see the steps on the **Setup** tab of the integration that you're interested in. - -* If your Operations for Applications service **is** onboarded to VMware Cloud services, you have two choices: - - * Use OAuth App authentication (recommended): - - You must use the credentials (client ID and client secret) of an existing server to server app which has the **Proxies** service role assigned and is added to the VMware Cloud organization running the service. You must also provide the ID of the VMware Cloud organization running the service. - - If you don’t have a server to server app already, you can create one in the VMware Cloud Services Console. For details, see [How to use OAuth 2.0 for server to server apps](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-327AE12A-85DB-474B-89B2-86651DF91C77.html) in the VMware Cloud services documentation. - - - * Use API Token authentication: - - The API token must be generated in the VMware Cloud Services Console by an active user account. It also must have the **Proxies** service role assigned. For more information, see [How do I generate API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E2A3B1C1-E9AD-4B00-A6B6-88D31FCDDF7C.html). - - -* If your Operations for Applications service is **not** onboarded to VMware Cloud services, generate the API token in the Operations for Applications UI. It is recommended that you use a service account API token. For more information, see [Manage API tokens](api_tokens.html). +You need to generate the API token in the Operations for Applications UI. It is recommended that you use a service account API token. For more information, see [Manage API tokens](api_tokens.html). Here's a sample of what you see when you select one of our integrations: * The **Overview** tab explains how the integration works and what's included, often a sample dashboard with commonly used charts. diff --git a/pages/doc/integrations_new_changed.md b/pages/doc/integrations_new_changed.md index f15f48889..21d7b417d 100644 --- a/pages/doc/integrations_new_changed.md +++ b/pages/doc/integrations_new_changed.md @@ -8,21 +8,6 @@ summary: New and changed integrations. --- VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) continuously adds new integrations to the existing set, and improves available integrations. We update our [**complete list of all integrations**](https://docs.wavefront.com/label_integrations%20list.html) each time we add new integrations. - -## Announcement - -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the [VMware Cloud services platform](https://console.cloud.vmware.com/) and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. We are in the process of incrementally onboarding all original subscriptions to VMware Cloud services. - -For details about the two subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). - -If your Operations for Applications service **is onboarded** to VMware Cloud services, most of the integrations authenticate with VMware Cloud services **access tokens**. Only a limited list of integrations still authenticate with Operations for Applications API tokens. For details, see [How Integration Authentication Works](integrations_onboarded_subscriptions.html). - -{% include note.html content= "The integrations in the **Archived** section are approaching their end-of-life. For that reason, we will not update these integrations to authenticate with VMware Cloud services access tokens." %} - -During the process of onboarding an original Operations for Applications service to VMware Cloud services, all of the existing integrations are preserved and continue to operate using Operations for Applications API tokens. You should incrementally switch to integration authentication with the more secure VMware Cloud services access tokens. - -{% include note.html content= "Currently, if your service **is onboarded** to VMware Cloud services, direct ingestion by using the Wavefront Output Plugin for Telegraf is not supported. For best performance, use a Wavefront proxy. " %} - ## January 2024 We improved the following integration in January 2024: diff --git a/pages/doc/integrations_new_changed_2023.md b/pages/doc/integrations_new_changed_2023.md index 53c75d95c..104a0fbd6 100644 --- a/pages/doc/integrations_new_changed_2023.md +++ b/pages/doc/integrations_new_changed_2023.md @@ -23,7 +23,7 @@ We made improvements to the following integrations in December 2023: * Tanzu Application Service -- Fixed an issue with the **Error Rate** chart in the **Workload Monitoring** dashboard. * VMware Tanzu Kubernetes Grid Integration -- Removed the `limit()` function from the queries in the VMware Tanzu Kubernetes Grid integration system dashboards, because this function [may return No Data](ts_limit.html#summary). -We updated the following integrations to support VMware Cloud Services access token authentication when your Operations for Applications service **is onboarded** to VMware Cloud services. See [Integrations That Use VMware Cloud Services Access Tokens](integrations_onboarded_subscriptions.html#integrations-that-use-vmware-cloud-services-access-tokens). +We updated the following integrations to support VMware Cloud Services access token authentication when your Operations for Applications service **is onboarded** to VMware Cloud services. * Chef Server @@ -65,7 +65,7 @@ Also, we made improvements to the following integrations in October 2023: * Go -- Removed references of deprecated SDKs. * C Sharp -- Removed references of deprecated libraries. -In addition, we updated the following integrations to support VMware Cloud Services access token authentication when your Operations for Applications service **is onboarded** to VMware Cloud services. See [Integrations That Use VMware Cloud Services Access Tokens](integrations_onboarded_subscriptions.html#integrations-that-use-vmware-cloud-services-access-tokens). +In addition, we updated the following integrations to support VMware Cloud Services access token authentication when your Operations for Applications service **is onboarded** to VMware Cloud services. * Catchpoint * Nagios @@ -92,7 +92,7 @@ We made improvements to the following integrations in August 2023: 3. Search for **Velero** and click its tile. 4. Click the **Setup** tab. -* Tanzu Application Service -- We added support for Tanzu Application Service setup when your Operations for Applications service **is onboarded** to VMware Cloud services. See [Integrations Supported for Onboarded Subscriptions](integrations_onboarded_subscriptions.html). +* Tanzu Application Service -- We added support for Tanzu Application Service setup when your Operations for Applications service **is onboarded** to VMware Cloud services. * Kubernetes: * We added [new alerts templates](https://github.com/wavefrontHQ/observability-for-kubernetes/blob/main/docs/alerts/alerts.md). @@ -100,8 +100,6 @@ We made improvements to the following integrations in August 2023: * We added support for Kubernetes setup when your Operations for Applications service **is onboarded** to VMware Cloud services. * We now support a number of integrations on Kubernetes. The list includes: Cassandra, Ceph, Envoy Proxy, etcd, Fluentd, Kafka, NVIDIA, Rabbit MQ, and Redis. - For the latest list of integrations, see [Integrations Supported for Onboarded Subscriptions](integrations_onboarded_subscriptions.html). - * Operations for Applications Usage -- Made bug fixes to the **Committed Rate vs Monthly Usage (PPS P95) for Billable** and **Usage (PPS) vs Remaining Balance (PPS P95) for Burndown** dashboards. * Fluentd -- Updated the setup steps and instructions. You can now set up the integration and the Kubernetes Metrics Collector by using the Observability for Kubernetes Operator. diff --git a/pages/doc/logging_logs_settings.md b/pages/doc/logging_logs_settings.md index 1899b5f4d..c9c74d5a4 100644 --- a/pages/doc/logging_logs_settings.md +++ b/pages/doc/logging_logs_settings.md @@ -8,9 +8,7 @@ summary: Learn how you can customize logs settings from the Organization Setting Users with access to the logs settings can map metrics tags to logs tags, traces tags to logs tags, and customize the time window you see on a chart or Traces Browser when you drill into logs from a chart and trace. -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. For information about VMware Cloud services subscriptions and original subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html).
    -- For VMware Cloud services subscriptions, only users with the **Super Admin** service role in Super Admin mode can customize the logs settings.
    -- For original Operations for Applications subscriptions, users with the **Accounts** permission can customize the logs settings."%} +Users with the **Accounts** permission can customize the logs settings. ## Map Tags diff --git a/pages/doc/logging_overview.md b/pages/doc/logging_overview.md index 07d115d27..c72f34e59 100644 --- a/pages/doc/logging_overview.md +++ b/pages/doc/logging_overview.md @@ -39,8 +39,7 @@ summary: Learn about VMware Aria Operations for Applications (formerly known as Our service retains logs for 30 days during the Logs free trial or retains logs for 7 days when on the freemium subscription! To retain logs for a longer period, contact your account representative or [technical support](wavefront_support_feedback.html#support).
  • - Only users with the Logs permission can view the Logs Browser and drill down into logs from charts, alerts, and traces. -

    The steps to add roles and permissions differ for Onboarded and Original subscriptions. See add permissions details for Onboarded subscriptions and Original subscriptions.

    + Only users with the Logs permission can view the Logs Browser and drill down into logs from charts, alerts, and traces. See for details..

    • {{site.data.alerts.end}} diff --git a/pages/doc/logging_proxy_configurations.md b/pages/doc/logging_proxy_configurations.md index afef7d064..c670a3b6d 100644 --- a/pages/doc/logging_proxy_configurations.md +++ b/pages/doc/logging_proxy_configurations.md @@ -162,42 +162,6 @@ We've added the following configuration properties for logs to the already exist -### Properties for VMware Cloud Services Subscriptions - -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until they migrate to VMware Cloud services. The content in this section is valid for **onboarded** subscribers. For information about original and new subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html)." %} - -VMware Cloud services provides access to both VMware Aria Operations for Logs and VMware Aria Operations for Applications. Therefore, to send logs data and see the data on the Operations for Applications Logs Browser, you must configure the proxy with the Operations for Logs URL and token. - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription
    - logServerIngestionURL - - The URL you use to send data to Operations for Logs. -
    - logServerIngestionToken - - The authorization token that was given by Operations for Logs. -
    - ## Proxy Preprocessor Rules for Logs The Wavefront proxy includes a preprocessor that applies rules before the log data is sent to our service. Logs store data in tags, that are key-value pairs. The rules listed below, update the log tag value. diff --git a/pages/doc/permissions_overview.md b/pages/doc/permissions_overview.md index e87c21aaf..41e704dd4 100644 --- a/pages/doc/permissions_overview.md +++ b/pages/doc/permissions_overview.md @@ -7,8 +7,6 @@ permalink: permissions_overview.html summary: Learn about the permissions in the service. --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscriptions. For VMware Cloud services subscriptions, see Operations for Applications permissions in VMware Cloud services."%} - Permissions allow access control for the feature sets in VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront). [Super Admin users](authorization-faq.html#who-is-the-super-admin-user) and users with the **Accounts** permission can manage permissions for groups and accounts. {% include note.html content="Every user can [perform certain tasks](user-accounts.html#what-can-a-new-user-do). However, you must have the appropriate permission to manage objects. If you do not have permission, UI menu selections and buttons required to perform management tasks are not visible." %} diff --git a/pages/doc/proxies_container.md b/pages/doc/proxies_container.md index e415ad31c..65f10be1d 100644 --- a/pages/doc/proxies_container.md +++ b/pages/doc/proxies_container.md @@ -12,10 +12,6 @@ VMware Aria Operations for Applications (formerly known as Tanzu Observability b You can run a proxy in a Docker container by running one of the following commands: -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The [proxy authentication](proxies_installing.html#proxy-authentication-types) to Operations for Applications differs for VMware Cloud services subscriptions and original subscriptions. For details, see [Subscription Types](subscriptions-differences.html).
    -- For VMware Cloud services subscriptions, starting with version 13.0, the Wavefront proxy supports authentication to Operations for Applications with a VMware Cloud services API token or OAuth app.
    -- For original Operations for Applications subscriptions, the Wavefront proxy 13.0 still supports authentication with Operations for Applications tokens. "%} - **dockerhub:** Example: Run the Wavefront proxy in a container with a limit of 2 GB of memory: diff --git a/pages/doc/proxies_installing.md b/pages/doc/proxies_installing.md index f276b601d..1e79c25cf 100644 --- a/pages/doc/proxies_installing.md +++ b/pages/doc/proxies_installing.md @@ -11,10 +11,6 @@ In most cases, a Wavefront proxy must be running in your environment before metr {% include note.html content="You must have the [**Proxies** permission](permissions_overview.html) to install and manage Wavefront proxies." %} -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. For information about VMware Cloud services subscriptions and original subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html).
    -- For VMware Cloud services subscriptions, starting with version 13.0, the Wavefront proxy supports authentication to Operations for Applications with a VMware Cloud services access token.
    -- For original Operations for Applications subscriptions, the Wavefront proxy 13.0 still supports authentication with an Operations for Applications API token."%} - ## Proxy Host Requirements - Internet access - Run `timeout 3s curl -fIsS ` from the host and make sure you get a response and not a timeout. diff --git a/pages/doc/proxies_troubleshooting.md b/pages/doc/proxies_troubleshooting.md index f3de61442..c6df2881f 100644 --- a/pages/doc/proxies_troubleshooting.md +++ b/pages/doc/proxies_troubleshooting.md @@ -278,8 +278,6 @@ INFO [AbstractReportableEntityHandler:reject] [] blocked input: [WF-300 Ca 2021-02-18 22:52:28,376 ERROR [proxy:checkinError] HTTP 401 Unauthorized: Please verify that your server and token settings are correct and that the token has Proxy Management permission! ``` * Explanation: The proxy cannot connect using the token provided. - - {% include important.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The [proxy authentication](proxies_installing.html#proxy-authentication-types) to Operations for Applications differs for VMware Cloud services subscriptions and original subscriptions."%} diff --git a/pages/doc/wavefront_administer.md b/pages/doc/wavefront_administer.md index 5063b7c6d..0604a9dfd 100644 --- a/pages/doc/wavefront_administer.md +++ b/pages/doc/wavefront_administer.md @@ -7,8 +7,6 @@ permalink: wavefront_administer.html summary: Understand what you can do if you have administrative privileges. --- -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. The content in this chapter is valid for **original** subscribers. For information about VMware Cloud services subscriptions and original subscriptions and how they differ, see [Subscription Types](subscriptions-differences.html)."%} - In VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront), Super Admin users and users with the **Accounts** permission can perform a variety of tasks, such as: * Manage the authorization and access to the Operations for Applications environment. diff --git a/pages/doc/wavefront_api.md b/pages/doc/wavefront_api.md index d584c7317..998e91848 100644 --- a/pages/doc/wavefront_api.md +++ b/pages/doc/wavefront_api.md @@ -19,8 +19,6 @@ The current version of the REST API is v2. You can access the API at ` Date: Fri, 28 Jun 2024 14:41:41 -0700 Subject: [PATCH 05/12] continue to remove and update paged for non-csp --- _data/sidebars/doc_sidebar.yml | 8 - pages/doc/2022-39.x_release_notes.md | 1 - pages/doc/csp_invite-AoA-users_tutorial.md | 181 --------------------- pages/doc/csp_subscription_types.md | 41 ----- pages/doc/integrations_tas_howto.md | 11 +- pages/doc/logging_log_alerts.md | 2 +- pages/doc/proxies_container.md | 158 ++++-------------- pages/doc/proxies_kube_container.md | 17 -- pages/doc/proxies_manual_install.md | 19 +-- pages/doc/purchase-additional-capacity.md | 2 +- pages/doc/wavefront_api.md | 22 +-- pages/doc/wavefront_interfaces.md | 6 +- pages/doc/wavefront_introduction.md | 6 - pages/doc/wavefront_release_notes.md | 18 -- pages/doc/windows_host_tutorial.md | 120 +------------- pages/labels/label_integrations%20list.md | 2 - 16 files changed, 40 insertions(+), 574 deletions(-) delete mode 100644 pages/doc/csp_invite-AoA-users_tutorial.md delete mode 100644 pages/doc/csp_subscription_types.md diff --git a/_data/sidebars/doc_sidebar.yml b/_data/sidebars/doc_sidebar.yml index b90e1855a..c1b2567bf 100755 --- a/_data/sidebars/doc_sidebar.yml +++ b/_data/sidebars/doc_sidebar.yml @@ -22,10 +22,6 @@ entries: - title: Purchase Additional Capacity url: /purchase_additional_capacity.html output: web - - - title: "Onboarding Original to VMware Cloud Services" - url: /csp_migration.html - output: web - title: Quickstart & Tutorials output: web @@ -45,10 +41,6 @@ entries: output: web subfolderitems: - - title: "Invite New Users Tutorial" - url: /csp_new_users_tutorial.html - output: web - - title: "AWS Integration Tutorial" url: /hello_wavefront_aws_tutorial.html output: web diff --git a/pages/doc/2022-39.x_release_notes.md b/pages/doc/2022-39.x_release_notes.md index 0d52a2892..b2f0c8efb 100644 --- a/pages/doc/2022-39.x_release_notes.md +++ b/pages/doc/2022-39.x_release_notes.md @@ -103,7 +103,6 @@ We extended the Usage Portal to Usage and Subscriptions, so Super
  • Follow the wizard to increase your monthly commitment of PPS.

    • -See Purchase Additional Capacity for details.     - @@ -271,23 +187,9 @@ To add the CA certificates of the HTTPS proxy to the Wavefront proxy that runs i Example: Run a command like the following for testing (see the Docker documentation for the command in production environments): -* For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app: - - ``` - docker run -it -e WAVEFRONT_URL=xxxxxxx -e CSP_APP_ID=xxxxxx CSP_APP_SECRET=xxxxxx CSP_ORG_ID=xxxxxx -p 2878:2878 -v /Users/user42/wavefront/ca_certs_test/to_docker:/tmp/ca proxy - ``` - -* For VMware Cloud services subscriptions and proxy authentication with an API token: - - ``` - docker run -it -e WAVEFRONT_URL=xxxxxxx -e CSP_API_TOKEN=xxxxxx -p 2878:2878 -v /Users/user42/wavefront/ca_certs_test/to_docker:/tmp/ca proxy - ``` - -* For original subscriptions: - - ``` - docker run -it -e WAVEFRONT_URL=xxxxxxx -e WAVEFRONT_TOKEN=xxxxxx -p 2878:2878 -v /Users/user42/wavefront/ca_certs_test/to_docker:/tmp/ca proxy - ``` +``` +docker run -it -e WAVEFRONT_URL=xxxxxxx -e WAVEFRONT_TOKEN=xxxxxx -p 2878:2878 -v /Users/user42/wavefront/ca_certs_test/to_docker:/tmp/ca proxy +``` You must specify: * WAVEFRONT_URL: The URL of your Operations for Applications service (e.g., https://example.wavefront.com) diff --git a/pages/doc/proxies_kube_container.md b/pages/doc/proxies_kube_container.md index 2ee6355bc..2e5f5c8ac 100644 --- a/pages/doc/proxies_kube_container.md +++ b/pages/doc/proxies_kube_container.md @@ -82,23 +82,6 @@ spec: env: - name: WAVEFRONT_URL value: .wavefront.com/api/ - # Uncomment the lines for your subscription type and proxy authentication type. - # For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app, uncomment the below lines: - #- name: CSP_APP_ID - # value: - #- name: CSP_APP_SECRET - # value: - #- name: CSP_ORG_ID - # value: - # For VMware Cloud services subscriptions and proxy authentication with an API token, uncomment the below lines: - #- name: CSP_API_TOKEN - # value: - # For original subscriptions: - #- name: WAVEFRONT_TOKEN - # value: - # Uncomment the below lines to consume Zipkin/Istio traces - #- name: WAVEFRONT_PROXY_ARGS - # value: --traceZipkinListenerPorts 9411 - name: WAVEFRONT_PROXY_ARGS value: --preprocessorConfigFile /preprocessor-config/preprocessor_rules.yaml --histogramDistListenerPorts 40000 --traceListenerPorts 2878 ports: diff --git a/pages/doc/proxies_manual_install.md b/pages/doc/proxies_manual_install.md index ec002782e..32a4ed124 100644 --- a/pages/doc/proxies_manual_install.md +++ b/pages/doc/proxies_manual_install.md @@ -22,8 +22,6 @@ Follow these steps to install a proxy on a host with full network access (incomi - **Networking:** [Test connectivity](proxies_manual_install.html#testing-proxy-host-connectivity) between the target proxy host and your Operations for Applications service. - {% include important.html content="For VMware Cloud services subscriptions, to retrieve a VMware Cloud services access token, the Wavefront proxy calls the VMware Cloud services API. For that reason, you must also test connectivity between the target proxy host and the VMware Cloud services platform (`https://console.cloud.vmware.com/`). For details about original and VMware Cloud services subscriptions, see [Subscription Types](subscriptions-differences.html)."%} - - **JRE:** The Wavefront proxy is a Java jar file and requires a JRE - for example, openjdk11. See the requirements in the [Wavefront Proxy README file](https://github.com/wavefrontHQ/wavefront-proxy#requirements). {% include note.html content="Starting with Wavefront proxy 11.1, the proxy installation packages don't include JRE. Before you can install the proxy `.rpm` or `.deb` file, you must have the JRE in the execution path." %} @@ -53,20 +51,7 @@ Before you can customize the proxy configuration, you have to find the values fo - - - - - - - - - - - + @@ -147,8 +132,6 @@ In some cases, you might need to run the proxy on a host with limited network ac - **Networking:** The minimum requirement is an outbound HTTPS connection to your Operations for Applications service, so the proxy can send metrics to the service. For metrics, by default the proxy uses port 2878. You can change this port and you can configure [separate proxy ports](proxies_configuring.html#configuration-properties) for histograms and traces. - {% include important.html content="For VMware Cloud services subscriptions, to retrieve a VMware Cloud services access token, the Wavefront proxy calls the VMware Cloud services API. For that reason, your environment must also allow an outbound HTTPS connection to the VMware Cloud services platform (`https://console.cloud.vmware.com/`). For details about original and VMware Cloud services subscriptions, see [Subscription Types](subscriptions-differences.html)."%} - You can use an [HTTP proxy](#configure-wavefront-proxy-with-an-httphttps-proxy) for the connection. - **JRE:** The Wavefront proxy is a Java jar file and requires a JRE - for example, openjdk11. See the requirements in the [Wavefront Proxy README file](https://github.com/wavefrontHQ/wavefront-proxy#requirements). diff --git a/pages/doc/purchase-additional-capacity.md b/pages/doc/purchase-additional-capacity.md index 604afa595..78a7747d0 100644 --- a/pages/doc/purchase-additional-capacity.md +++ b/pages/doc/purchase-additional-capacity.md @@ -26,7 +26,7 @@ Currently, you can buy additional capacity only if you have a billable commit co 1. Verify the resulting **New commitment** of PPS per [billing period](glossary.html#b) and the **Current Level** pricing tier, and click **Next**. 1. Select the billing model and commit duration for the additional capacity, and click **Proceed to checkout**. - The billing model and commit duration for the additional capacity are the same as for the original subscription. Billing model and commit duration cannot be changed. + The billing model and commit duration for the additional capacity are the same. Billing model and commit duration cannot be changed. After checking out, you will see an order confirmation message. Typically, it takes 24 hours to fulfil an order. Once your additional capacity becomes available, you'll receive an email notification. diff --git a/pages/doc/wavefront_api.md b/pages/doc/wavefront_api.md index 998e91848..dcfd2a1b5 100644 --- a/pages/doc/wavefront_api.md +++ b/pages/doc/wavefront_api.md @@ -33,8 +33,6 @@ To access the Operations for Applications REST API documentation: ![REST API in a product instance](/images/rest_api.png) -{% include important.html content="For VMware Cloud services subscriptions, to access the VMware Cloud services API documentation, go to [https://console.cloud.vmware.com/csp/gateway/portal/#/api-docs](https://console.cloud.vmware.com/csp/gateway/portal/#/api-docs)."%} - ## API Documentation (VMware Developer) If you don't have access to a service instance, you can have a look at our [Operations for Applications API doc](https://developer.vmware.com/apis/714/) on the VMware Developer website. @@ -43,22 +41,14 @@ We include an overview and a Swagger-generated API Reference. We update the refe ![REST API in VMware Developer](/images/vmware_code_api.png) -{% include important.html content="For VMware Cloud services subscriptions, you can have a look at the [VMware Cloud services API doc](https://developer.vmware.com/apis/csp/csp-iam/latest/) on the VMware Developer website."%} - The [VMware Developer website](https://developer.vmware.com/samples?categories=Sample&tags=wavefront) also includes some samples, for example, for getting data into Operations for Applications. We're providing these samples as is - some are from our team, others will come from the community. ## Invoking the Operations for Applications REST API -You can invoke the API using `curl` or from an API client. In either case, you must use a token. - -The token that you need depends on your [subscription type](subscriptions-differences.html). - -* For VMware Cloud services subscriptions, invoking the Operations for Application REST API requires a VMware Cloud services access token. -* For original subscriptions, invoking the Operations for Application REST API requires an Operations for Application API token. - -See [Use the Operations for Applications REST API](using_wavefront_api.html) for details and examples. +You can invoke the API using `curl` or from an API client. In either case, you must use an Operations for Application API token.. +For details,see [Use the Operations for Applications REST API](using_wavefront_api.html) for details and examples. ## Generate an API Client Using Swagger @@ -92,12 +82,8 @@ The REST API supports the following objects corresponding to different categorie - **Access Policy** - Lets you allow or deny access to embedded charts. For information, see [Allow or Deny Access to Embedded Charts](ui_sharing.html#allow-or-deny-access-to-embedded-charts). - **Access** - Provides information on the access level of an entity. See [Notes on the Access Category](#access) below. - **Account (User and Service Account)** - Allows users with [**Accounts** permission](permissions_overview.html) to retrieve a list of all [accounts](users_roles.html), create, update, and delete accounts and manage permissions and groups associated with accounts. - - {% include note.html content="Applies only to original subscriptions. See the [Operations for Applications subscription types](subscriptions-differences.html)."%} - **Alert** - Retrieve active, snoozed, in-maintenance, and invalid alerts. Users with [**Alerts** permission](permissions_overview.html) can create and update alerts. - **ApiToken** - Allows users with [**Accounts** permission](permissions_overview.html) to retrieve, create, and manage API tokens. Used primarily in conjunction with service accounts. - - {% include note.html content="Applies only to original subscriptions. See the [Operations for Applications subscription types](subscriptions-differences.html)."%} - **Cloud Integration** - Retrieve cloud integration data types such as those available with the [AWS integration](integrations_aws_metrics.html), [Google Cloud Platform Integration](gcp.html), [Google Cloud Billing Integration](gcp_billing.html), [New Relic Integration](newrelic.html), [AppDynamics Integration](appdynamics.html), [Dynatrace Integration](dynatrace.html), [Microsoft Azure Integration](azure.html), [VMware Aria Operations (SaaS) Integration](vrops.html), and the [Snowflake Integration](snowflake.html). Users with [**Proxies** permission](permissions_overview.html) can add and remove cloud integration data types. - **Dashboard** - Retrieve data about dashboards, list dashboards, and return version history. Users with [**Dashboards** permission](permissions_overview.html) can save, create, delete, clone, undelete dashboards. - **Derived Metric** - Manage derived metrics. @@ -112,16 +98,12 @@ The REST API supports the following objects corresponding to different categorie - **Proxy** - Retrieve information about Wavefront proxies. Users with [**Proxies** permission](permissions_overview.html) can add and remove Wavefront proxies. - **Query** - Perform queries. - **Role** - Retrieve information about a role and manage roles and role assignees. - - {% include note.html content="Applies only to original subscriptions. See the [Operations for Applications subscription types](subscriptions-differences.html)."%} - **Saved Search** - Retrieve, add, and remove saved searches. - **Search** - Search agents, alerts, integrations, dashboards, external links, maintenance windows, sources, and webhook alert targets. - **Source** - Retrieve sources and tags associated with a source. Users with [**Source Tags** permission](permissions_overview.html) can add and remove source tags and set descriptions. - **Usage** - Retrieve information about usage associated with ingestion policies and manage policies. - **User** - Deprecated API. Use **Account (User and Service Account)** instead. - **UserGroup** - Allows users with [**Accounts** permission](permissions_overview.html) to retrieve a list of all groups, create, update, and delete groups, and manage the users and roles associated with a group. - - {% include note.html content="Applies only to original subscriptions. See the [Operations for Applications subscription types](subscriptions-differences.html)."%} - **Webhook** - Retrieve webhooks. Users with [**Alerts** permission](permissions_overview.html) can create, update, and delete webhooks. diff --git a/pages/doc/wavefront_interfaces.md b/pages/doc/wavefront_interfaces.md index 6b6e3bbf9..f03efeb4c 100644 --- a/pages/doc/wavefront_interfaces.md +++ b/pages/doc/wavefront_interfaces.md @@ -21,11 +21,7 @@ Operations for Applications provides different kinds of interfaces for performin - - - - + diff --git a/pages/doc/wavefront_introduction.md b/pages/doc/wavefront_introduction.md index 04b1558ee..2d4b35ea1 100644 --- a/pages/doc/wavefront_introduction.md +++ b/pages/doc/wavefront_introduction.md @@ -7,12 +7,6 @@ summary: Learn about the architecture, interfaces, and how to get started. --- VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) is a high-performance streaming analytics platform that supports observability for metrics, counters, histograms, and traces/spans. The product is unique because it scales to very high data ingestion rates and query loads. You can collect data from many services and sources across your entire application stack, and can look at details for earlier data that were ingested earlier. -## Where Do I Start? - -You need an account to get started. - -Starting July 3, 2023, Operations for Applications is a service on the [VMware Cloud services platform](https://console.cloud.vmware.com/). After this date, we support two types of subscriptions: Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform and **original** subscriptions. Original subscriptions are the existing ones and they remain as is until onboarded to VMware Cloud services. For information about the subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). - ## Intro Videos The first videovideo camera icon is a 90 second overview of **how you can use** explore data and create alerts. Note that this video was created in 2020 and some of the information in it might have changed. It also uses the 2020 version of the UI. diff --git a/pages/doc/wavefront_release_notes.md b/pages/doc/wavefront_release_notes.md index a1dc08ad1..cdbb91cb0 100644 --- a/pages/doc/wavefront_release_notes.md +++ b/pages/doc/wavefront_release_notes.md @@ -23,24 +23,6 @@ If you require assistance or would like to submit a ticket on or after May 6, al For details, see the KB article [VMware Tanzu Support moving to Broadcom Support Portal May 6th](https://support.cloudhealthtech.com/hc/en-us/articles/26164366649741-VMware-Tanzu-Support-moving-to-Broadcom-Support-Portal-May-6th). - -### VMware Aria Operations for Applications on VMware Cloud Services - -Starting July 3, 2023, VMware Aria Operations for Applications is a service on the [VMware Cloud services platform](https://console.cloud.vmware.com/). After this date, we support two types of subscriptions: - -* **Onboarded Subscriptions**: Operations for Applications subscriptions that are onboarded to the VMware Cloud services platform. -* **Original Subscriptions**: Existing subscriptions which remain as is until onboarded to VMware Cloud services. - -For information about the two subscription types and how they differ, see [Subscription Types](subscriptions-differences.html). - -{% include note.html content="We will support both original and onboarded subscriptions until all original subscriptions are onboarded to VMware Cloud services."%} - -### Onboarding Original VMware Aria Operations for Applications to VMware Cloud Services - -In October, 2023, we start to incrementally **onboard** all original subscriptions to VMware Cloud services. You will receive a notification in your Operations for Applications UI with the date scheduled for your service onboarding to VMware Cloud services. Make sure that you get familiar with the VMware Cloud services platform and prepare for the onboarding. - -{% include warning.html content="The Operations for Applications authentication and authorization will be **deprecated** in the future. Therefore, after onboarding to VMware Cloud services, **replace** your service accounts with server to server apps and your Operations for Applications API tokens with VMware Cloud Services access tokens, including the Operations for Application API tokens of your Wavefront proxies." %} -
    The Add more capacity button on the Subscriptions tab. diff --git a/pages/doc/csp_invite-AoA-users_tutorial.md b/pages/doc/csp_invite-AoA-users_tutorial.md deleted file mode 100644 index ee36fdf9f..000000000 --- a/pages/doc/csp_invite-AoA-users_tutorial.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Invite New Users from the VMware Cloud Services Console -keywords: -tags: [tutorials] -sidebar: doc_sidebar -permalink: csp_new_users_tutorial.html -summary: Learn how to invite new users to VMware Aria Operations for Applications through the VMware Cloud Services Console. ---- - -Starting July 3, 2023, Operations for Applications is a service on the VMware Cloud services platform. After this date, we support two types of subscriptions: -* Operations for Applications subscriptions **onboarded** to the VMware Cloud services platform. -* **Original** subscriptions -- the existing ones which remain as is until they migrate to VMware Cloud services. - -In this tutorial, you’ll learn how to invite new users to Operations for Applications through the VMware Cloud Services Console. - -## Requirements - -When your service **is onboarded** to VMware Cloud services, all new users are invited through the VMware Cloud Services Console. - -To invite users, you must have the VMware Cloud **Organization Owner** or **Organization Administrator** role. You can invite users to your organization and grant them access to the services associated with it - in this case, this is Operations for Applications. You can also track the invitations you send. Invitations are valid for up to seven days. If you have sent an invitation in error, you can revoke it. - - -## Roles to Assign - -To invite new users, you assign them: - -* A role within the VMware Cloud organization, such as **Organization Administrator**, **Organization Owner**, or **Organization Member**. See [What organization roles are available in VMware Cloud services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-C11D3AAC-267C-4F16-A0E3-3EDF286EBE53.html) in the VMware Cloud services documentation. - - Note that you can assign the **Organization Owner** role to another user only if you have the **Organization Owner** role. - -* A role within the Operations for Applications service instance. We provide a number of Operations for Applications service roles. - - Note that in a multi-tenant Operations for Applications environment, you must specify the service instance (tenant) for which you want to assign the service role. You can assign different service roles for different service instances (tenants). You invite the users only to the tenants for which you assigned them service roles. - -* Optionally, a custom role created in the VMware Cloud organization. Custom roles are composed of different service permissions. - - Note that a custom role with an Operations for Applications permission applies only if the user has at least one Operations for Applications service role. In a multi-tenant Operations for Applications environment, custom roles apply to all service instances (tenants) for which the user has at least one Operations for Applications service role. - - -## Verify That You Have the Required Organization Role - -### Step 1: Log in to the VMware Cloud Services Console - -1. Open a Web browser window and go to [https://console.cloud.vmware.com/](https://console.cloud.vmware.com/). -1. Enter your account email and click **Next**. -2. Type your password then click **Sign In**. - -### Step 2: Navigate to Your Organization - -VMware Cloud uses organizations to provide controlled access to one or more services. As an enterprise using multiple cloud services, Organizations provide an easy way to map your business groups and processes to different organizations. If you belong to more organizations, you must navigate to the organization to which Operations for Applications is onboarded. - -1. Click your username and click **Change Organization**. -2. Select the name of the organization to which Operations for Applications is **onboarded**. - -### Step 3: Find Your Roles Within the Organization - -1. Click your username and click **My Account**. -2. On the **My Roles** tab you can see what organization roles are assigned to you. - -If you do not have the VMware Cloud **Organization Owner** or **Organization Administrator** role assigned, you need to request them. To understand who the VMware Cloud **Organization Owner** or **Organization Administrator** users are, you can chat with our Technical Support team or file a VMware Cloud services support request. See [How do I get support](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E4DC731F-C039-4FB2-949E-9A61584CD5BF.html) in the VMware Cloud services product documentation. - - -## Example 1: Invite a New User and Assign Service Roles - -We provide a number of built-in Operations for Applications service roles. - -- A corresponding service role for each permission. -- Two special service roles - one that grants full administrative access to the service, and another one that grants read-only access to the service. - -For more information, see Operations for Applications Service Roles (Built-in). - -### Step 1: Enter the New User Details - -1. Click **Identity & Access Management** in the navigation on the left and click **Active Users**. -2. Click the **Add Users** button on top of the table. -3. In the **Users** text box, enter the email addresses of the users that you want to invite. - - The email addresses or account names of the users must be delimited by comma, space, or a new line. - -### Step 2: Assign Roles and Invite the User - -In a multi-tenant environment, you assign service roles on a tenant basis. You can assign different service roles for different Operations for Applications instances (tenants). Let’s first assign the mandatory organization role and then assign different service roles for two Operations for Applications instances. - -1. Under **Assign Organization Roles**, select a mandatory organization role to assign. - - The **Organization Member** role is selected by default and is the minimum mandatory role to assign. - - You can also assign an additional role, for example, **Support User**. This means that the user will have read-only access to the VMware Cloud organization resources and will be able to submit and manage support tickets. For information about the VMware Cloud organization roles, see [What Organization roles are available in VMware Cloud Services](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-C11D3AAC-267C-4F16-A0E3-3EDF286EBE53.html). - - ![A screenshot with the Organization Member role, selected by default and the Support user additional role selected.](images/csp-mandatory-roles.png) - -2. Assign Operations for Applications service roles for the first Operations for Applications instance (tenant) to which you want to invite the new user. - 1. Under **Assign Service Roles**, click **Add a Service**. - 1. From the first drop-down menu, select **VMware Aria Operations for Applications**. - ![A screenshot with the Operations for Applications service selected.](images/csp-select-service.png) - 1. From the **in** drop-down menu, select the target service instance (tenant). - ![A screenshot with the Operations for Applications service instance selected.](images/csp-select-aoa-service.png) - - {% include note.html content="This drop-down menu is available only for multi-tenant environments. If you want to grant access to all tenants, you must assign service roles for each tenant individually (see the next Step 3). If you miss selecting the target service instance, the users receive the `401 Unauthorized: User has no access to service` error message when trying to access that tenant."%} - - 1. From the **with roles** drop-down menu, select the service roles to assign for the selected service instance (tenant). - - Let's say that the user you're inviting will: - - * Set up external integrations - * Install and uninstall integration dashboards and alerts - * Create, manage, and delete dashboards and charts and manage dashboard tags - * Create, edit, and delete alerts, alert targets, and maintenance windows. Also, will manage alert tags and view alert history. - - For this purpose, select the following service roles: **Proxies**, **Integrations**, **Dashboards**, and **Alerts**. - - ![A screenshot with the Operations for Applications roles selected.](images/csp-assign-service-roles.png) - 1. Leave the never expires access field as is. - -3. Assign another Operations for Applications service role for the second Operations for Applications instance (tenant) to which you want to invite the new user. - - 1. Click **+ Add an Instance**. - 1. From the **in** drop-down menu, select the target service instance (tenant). - ![A screenshot with the Operations for Applications service instance selected.](images/csp-select-another-service.png) - 1. From the **with roles** drop-down menu, select the **Super Admin** service role, so that you grant full administrative privileges for the selected service instance. - - ![A screenshot with the Operations for Applications roles selected.](images/csp-assign-superadmin-service-role.png) - 1. Leave the never expires access field as is. -4. Leave the **Send emails to all invited users notifying them of this role assignment** selected and click **Add**. - -The invitations you send are valid for seven days. You can view the status of the invitation by expanding **Identity & Access Management** and then clicking **Pending Invitations**. - -## Example 2: Invite a New User and Assign a Custom Role - -If you have created custom roles and want to assign custom roles to a user, you must make sure that you assign: - -* A mandatory organization role -* At least one service role, for example **Viewer** -* The custom roles of interest - -Custom roles work only in combination with service roles. In a multi-tenant environment, the Operations for Applications permissions in a custom role apply to all service instances (tenants) for which the user has at least one Operations for Applications service role. - -### Step 1: Enter the New User Details - -1. Click **Identity & Access Management** in the navigation on the left and click **Active Users**. -2. Click the **Add Users** button on top of the table. -3. In the **Users** text box, enter the email addresses of the users that you want to invite. - - The email addresses or account names of the users must be delimited by comma, space, or a new line. - -### Step 2: Assign the Roles and Invite the User - -Let's assign **Organization Administrator** as a mandatory organization role, then assign the **Viewer** service role for one tenant and the **Ingestion Policies** service role for another tenant. After that, we assign the custom role and it applies to the two tenants for which the user has service roles. - -1. Under **Assign Organization Roles**, select the **Organization Administrator** role. - - ![A screenshot with the Organization Administrator role selected.](images/csp-assign-org-admin.png) - -2. Assign the **Viewer** service role for the first Operations for Applications service instance (tenant) to which you want to invite the new user. - 1. Under **Assign Service Roles**, click **Add a Service**. - 1. From the first drop-down menu, select **VMware Aria Operations for Applications**. - ![A screenshot with the Operations for Applications service selected.](images/csp-select-service.png) - 1. From the **in** drop-down menu, select the target service instance (tenant) and leave the **Viewer** service role selected. - ![A screenshot with the Operations for Applications service instance and the Viewer role selected.](images/csp-select-aoa-service-viewer.png) - 1. Leave the never expires access field as is. -3. Assign the **Ingestion Policies** service role for the second Operations for Applications service instance (tenant) to which you want to invite the new user. - 1. Click **+Add an Instance**. - 1. From the **in** drop-down menu, select the target service instance (tenant). - 1. From the **with roles** drop-down menu, select the **Ingestion Policies** service role to assign it to the user for the selected tenant. - ![A screenshot with the Operations for Applications service instance and the Viewer and the Ingestion Policies service roles selected.](images/csp-assign-two-service-roles.png) - 1. Leave the never expires access field as is. - -3. Assign the custom role for the already selected Operations for Applications service instances (tenants). - - 1. Click **+ Add Custom Roles Access**. - 1. In the **Add custom role access** popup window, search for, select the custom role that you want to assign, and click **Add**. - 1. Leave the never expires access field as is. - - The custom role will be assigned to the user for the two tenants that we have already specified as shown in the screenshot below. - - ![A screenshot with the added custom role](images/csp-add-custom-role.png) - -4. Leave the **Send emails to all invited users notifying them of this role assignment** selected and click **Add**. - - -The invitations you send are valid for seven days. You can view the status of the invitation by expanding **Identity & Access Management** and then clicking **Pending Invitations**. diff --git a/pages/doc/csp_subscription_types.md b/pages/doc/csp_subscription_types.md deleted file mode 100644 index ed8121e17..000000000 --- a/pages/doc/csp_subscription_types.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: VMware Cloud Services vs Original Subscriptions -keywords: -tags: [introduction] -sidebar: doc_sidebar -permalink: subscriptions-differences.html -summary: Learn about the VMware Aria Operations for Applications subscription types and the advantages of VMware Cloud services subscriptions over original subscriptions. ---- - -Operations for Applications subscriptions are two types: original subscriptions and VMware Cloud services subscriptions. - -## Why the Two Subscription Types Differ? - - - -VMware Cloud services provides single sign-on (SSO) and identity access management (IAM) to your entire VMware Cloud services portfolio across hybrid and native public clouds, including Operations for Applications. Therefore, there are differences in the experience for VMware Cloud services subscribers and original subscribers. - -## Advantages of VMware Cloud Services Subscriptions Over Original Subscriptions - -* **VMware Cloud SSO**: VMware Cloud services provides centralized authentication for your entire VMware Cloud services portfolio. After you log in to the VMware Cloud Services Console, you can access each of your services and you can easily switch between them. - -* **Improved SAML SSO**: Enterprise federation is supported for a wider list of IdPs, such as: - * Okta - * PingIdentity - * Microsoft Active Directory Federation Services (ADFS) - * OneLogin - * Azure Active Directory - - You can also configure any other SAML 2.0 compliant third-party IdP that is not part of the list above. See [Configure the identity provider](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-320CDE08-FD8F-4540-BB19-BE9647F31075.html) in the VMware Cloud services documentation. - -* **Enterprise Groups Synchronization**: The enterprise groups from your federated corporate domain are available for you to assign them roles, including default roles. In addition, you can nest an enterprise group into a custom group. -* **Centralized Authorization with Role-Based Access Control**: The VMware Cloud Services Console provides access management for your entire VMware Cloud services portfolio. It includes organization roles, service-specific roles, and custom roles, which can be assigned to users, API tokens, and sever to server apps (which correspond to service accounts in Operations for Applications). -* **Improved Security**: - * VMware Cloud services supports authentication polices for user access, such as multi-factor authentication, IP authentication preferences, and user access at domain level. - * An API token can be assigned with a subset of the roles that its associated user owns. - * Users can secure their API tokens using multi-factor authentication. - * Interacting with the REST API requires a VMware Cloud services access token, which can be exchanged from a user's API token or server to server app credentials. -* **Improved Multi-Tenancy**: Support of switching between tenants on different clusters. This unlocks better experience in multi-tenant environments. -* **Centralized Billing and Subscriptions**: The VMware Cloud Services Console displays billing and subscriptions details, and allows payment methods management. This brings the billing and subscriptions experience at a completely new level as we had no such ability before. - - diff --git a/pages/doc/integrations_tas_howto.md b/pages/doc/integrations_tas_howto.md index 003398e18..b269059cf 100644 --- a/pages/doc/integrations_tas_howto.md +++ b/pages/doc/integrations_tas_howto.md @@ -169,7 +169,7 @@ Ensure that your environment meet requirements on the Ops Manager side and on th VMware Tanzu Observability by Wavefront nozzle has the following requirements: * Read-only access to the Doppler Firehose and Cloud Controller. * Access to an Operations for Applications instance. - * Authentication credentials. The authentication credentials depend on whether your Operations for Applications service is onboarded to VMware Cloud services. + * Authentication credentials. * **Tanzu Observability by Wavefront Requirements** To set up the Tanzu Application Service integration on your Operations for Applications instance, you must have: * Access to an Operations for Applications instance. @@ -204,8 +204,6 @@ Download the Tanzu Observability by Wavefront nozzle file from the [Tanzu Networ The tile is now available, but the orange bar at the bottom indicates that the product is not yet configured. - - **To configure the nozzle:** In Ops Manager, click the Tanzu Observability by Wavefront tile. With **Settings** selected (the default), follow these steps: @@ -229,12 +227,7 @@ In Ops Manager, click the Tanzu Observability by Wavefront tile. With **Settings Step 2. Click Wavefront Proxy Config and specify:
    1. The URL of your Operations for Applications instance, for example, https://example.wavefront.com.
    2. - The authentication credentials for your Wavefront proxy. -
        -
      • If your Operations for Applications service is onboarded to VMware Cloud services, use server to server OAuth app credentials, such as app ID and app secret. The server to server app must have the Proxies service role and must belong to the VMware Cloud organization running the Operations for Applications service instance.
        • -
      • If your Operations for Applications service is not onboarded to VMware Cloud services, you can still use a valid Operations for Applications API token.
        • -
      -

      For information about the original and onboarded subscriptions and how they differ, see Subscription Types.

      + Add the Wavefront API token. To get the token, see Operations for Applications API token.
    3. User-friendly name for the proxy.
    4. Click Save or click Custom (see the next step). diff --git a/pages/doc/logging_log_alerts.md b/pages/doc/logging_log_alerts.md index 88612d327..9fa7e65ff 100644 --- a/pages/doc/logging_log_alerts.md +++ b/pages/doc/logging_log_alerts.md @@ -24,7 +24,7 @@ You can create alerts for your logs data and get email notifications when the al You need the Alerts and Logs permissions to create and manage logs alerts.
      5. -

      The steps to add roles and permissions differ for onboarded and original subscriptions. For details, see how to manage roles, groups, and permissions for onboarded subscriptions and original subscriptions.

      +

      For details, see how to manage roles, groups, and permissions.

      {{site.data.alerts.end}} ## Alerts Browser diff --git a/pages/doc/proxies_container.md b/pages/doc/proxies_container.md index 65f10be1d..27e991a5b 100644 --- a/pages/doc/proxies_container.md +++ b/pages/doc/proxies_container.md @@ -16,118 +16,38 @@ You can run a proxy in a Docker container by running one of the following comman Example: Run the Wavefront proxy in a container with a limit of 2 GB of memory: -* For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app: - - ``` - docker run -d \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e CSP_APP_ID= \ - -e CSP_APP_SECRET= \ - -e CSP_ORG_ID= \ - -e WAVEFRONT_PROXY_ARGS='-- -- ' \ - -e JAVA_HEAP_USAGE="1650m"\ - -m 2g \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` - -* For VMware Cloud services subscriptions and proxy authentication with an API token: - - ``` - docker run -d \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e CSP_API_TOKEN= \ - -e WAVEFRONT_PROXY_ARGS='-- -- ' \ - -e JAVA_HEAP_USAGE="1650m"\ - -m 2g \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` - -* For original subscriptions: - - ``` - docker run -d \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e WAVEFRONT_TOKEN= \ - -e WAVEFRONT_PROXY_ARGS='-- -- ' \ - -e JAVA_HEAP_USAGE="1650m"\ - -m 2g \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` +``` +docker run -d \ +-e WAVEFRONT_URL=https://.wavefront.com/api \ +-e WAVEFRONT_TOKEN= \ +-e WAVEFRONT_PROXY_ARGS='-- -- ' \ +-e JAVA_HEAP_USAGE="1650m"\ +-m 2g \ +-p 2878:2878 \ + wavefronthq/proxy:latest +``` Example: Run the proxy with preprocessor rules by using the WAVEFRONT_PROXY_ARGS. Specify the volume to use: -* For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app: - - ``` - docker run \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e CSP_APP_ID= \ - -e CSP_APP_SECRET= \ - -e CSP_ORG_ID= \ - -e WAVEFRONT_PROXY_ARGS='--preprocessorConfigFile /etc/wavefront/wavefront-proxy/preprocessor_rules.yaml' \ - -v /preprocessor_rules.yaml:/etc/wavefront/wavefront-proxy/preprocessor_rules.yaml:ro \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` - -* For VMware Cloud services subscriptions and proxy authentication with an API token: - - ``` - docker run \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e CSP_API_TOKEN= \ - -e WAVEFRONT_PROXY_ARGS='--preprocessorConfigFile /etc/wavefront/wavefront-proxy/preprocessor_rules.yaml' \ - -v /preprocessor_rules.yaml:/etc/wavefront/wavefront-proxy/preprocessor_rules.yaml:ro \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` -* For original subscriptions: - - ``` - docker run \ - -e WAVEFRONT_URL=https://.wavefront.com/api \ - -e WAVEFRONT_TOKEN= \ - -e WAVEFRONT_PROXY_ARGS='--preprocessorConfigFile /etc/wavefront/wavefront-proxy/preprocessor_rules.yaml' \ - -v /preprocessor_rules.yaml:/etc/wavefront/wavefront-proxy/preprocessor_rules.yaml:ro \ - -p 2878:2878 \ - wavefronthq/proxy:latest - ``` +``` +docker run \ +-e WAVEFRONT_URL=https://.wavefront.com/api \ +-e WAVEFRONT_TOKEN= \ +-e WAVEFRONT_PROXY_ARGS='--preprocessorConfigFile /etc/wavefront/wavefront-proxy/preprocessor_rules.yaml' \ +-v /preprocessor_rules.yaml:/etc/wavefront/wavefront-proxy/preprocessor_rules.yaml:ro \ +-p 2878:2878 \ +wavefronthq/proxy:latest +``` **Harbor:** -* For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app: - - ``` - docker run -d\ - -e WAVEFRONT_URL=https://.wavefront.com/api/ \ - -e CSP_APP_ID= \ - -e CSP_APP_SECRET= \ - -e CSP_ORG_ID= \ - -e WAVEFRONT_PROXY_ARGS=''-- -- ''\ - -p 2878:2878 projects.registry.vmware.com/tanzu_observability/proxy:latest - ``` - -* For VMware Cloud services subscriptions and proxy authentication with an API token: - - ``` - docker run -d\ - -e WAVEFRONT_URL=https://.wavefront.com/api/ \ - -e CSP_API_TOKEN= \ - -e WAVEFRONT_PROXY_ARGS=''-- -- ''\ - -p 2878:2878 projects.registry.vmware.com/tanzu_observability/proxy:latest - ``` -* For original subscriptions: - - ``` - docker run -d\ - -e WAVEFRONT_URL=https://.wavefront.com/api/ \ - -e WAVEFRONT_TOKEN= - -e WAVEFRONT_PROXY_ARGS=''-- -- ''\ - -p 2878:2878 projects.registry.vmware.com/tanzu_observability/proxy:latest - ``` +``` +docker run -d\ +-e WAVEFRONT_URL=https://.wavefront.com/api/ \ +-e WAVEFRONT_TOKEN= +-e WAVEFRONT_PROXY_ARGS=''-- -- ''\ +-p 2878:2878 projects.registry.vmware.com/tanzu_observability/proxy:latest +``` Options: @@ -135,11 +55,7 @@ Options:
    AuthenticationDepends on your subscription type and proxy authentication type. -
      -
    • For VMware Cloud services subscriptions and proxy authentication with a server to server OAuth app, CSP_APP_ID and CSP_APP_SECRET are the server to server app credentials (ID and secret). The server to server app must be assigned with the Proxies service role and must be added to the VMware Cloud organization running the Operations for Applications service instance. CSP_ORG_ID is the ID of the VMware Cloud organization.
      • -
    • For VMware Cloud services subscriptions and proxy authentication with an API token, CSP_API_TOKEN is the VMware Cloud services API token. The API token and its associated user account must be assigned with the Proxies service role.
      • -
    • For original subscriptions, WAVEFRONT_TOKEN is the Operations for Applications API token. The user account or service account associated with the API token must be assigned with the Proxies permission.
    +    		The WAVEFRONT_TOKEN is the Operations for Applications API token. The user account or service account associated with the API token must be assigned with the Proxies permission.
    tokenA valid Operations for Applications token associated with an active user or service account. The account must have the Proxies permission.

    Note: Applies only to original Operations for Applications subscriptions that are not onboarded to VMware Cloud services, i.e. when the proxy authenticates to Operations for Applications with an Operations for Applications API token.

    cspAppId

    cspAppSecret

    cspOrgId

    		Server to server OAuth app credentials - ID and secret (cspAppId and cspAppSecret), and the VMware Cloud organization ID (cspOrgId) running the Operations for Applications service instance. The server to server app must have the Proxies service role and must belong to the VMware Cloud organization running the Operations for Applications service instance. -

    Note: Applies only to Operations for Applications subscriptions on VMware Cloud services if the proxy authenticates to Operations for Applications with a VMware Cloud services OAuth app.

    cspAPITokenA valid VMware Cloud services API token associated with an active user account. The user and the token must have the Proxies service role. -

    Note: Applies only to Operations for Applications subscriptions on VMware Cloud services if the proxy authenticates to Operations for Applications with a VMware Cloud services token.

    -    		A valid Operations for Applications token associated with an active user or service account. The account must have the Proxies permission.
    Operations for Applications user interface (UI) Interacting directly with Operations for Applications from your browser. Sample tasks include visualizing metrics, histograms, and trace data in charts and dashboards, running queries, setting up alerts and alert notifications, installing and managing integrations, creating events, and so on. -

    In the original Operations for Applications subscriptions, this interface also provides support for managing users, user groups, roles, permissions, and preferences. For information about original and onboarded subscriptions and the differences between them, see Subscription Types.

    VMware Cloud Services ConsoleIn the onboarded Operations for Applications subscriptions, VMware Cloud services provides support for managing users, user groups, roles, and preferences. For information about original and onboarded subscriptions and the differences between them, see Subscription Types.
    [Operations for Applications REST API](wavefront_api.html)