diff --git a/images/new-vs-original-menu.png b/images/new-vs-original-menu.png index 06c620de5..f6fe7fece 100644 Binary files a/images/new-vs-original-menu.png and b/images/new-vs-original-menu.png differ diff --git a/pages/doc/csp_area_differences.md b/pages/doc/csp_area_differences.md index 63f1d2082..a993aa7f0 100644 --- a/pages/doc/csp_area_differences.md +++ b/pages/doc/csp_area_differences.md @@ -11,9 +11,9 @@ Operations for Applications subscriptions are two types: original subscriptions ## Examples of the Functionality Differences -### Users, Roles and Group Management +### Users, Roles, and Group Management -Most of the user and account management tasks done in the Operations for Applications UI for original subscriptions, are done in the VMware Cloud Services for VMware Cloud services subscriptions. For example, the tasks related to user, roles, and groups management: +Most of the user and account management tasks done in the Operations for Applications UI for original subscriptions, are done in the VMware Cloud services for VMware Cloud services subscriptions. For example, the following tasks related to managing users, roles, and groups can be done from the VMware Cloud Services Console. * Invite new users * Assign permissions @@ -28,7 +28,9 @@ Most of the user and account management tasks done in the Operations for Applica Some administrative tasks, done by **Super Admins** and users with the **Accounts** permission in original subscriptions, are done by VMware Cloud **Organization Owners** and VMware Cloud **Organization Administrators** in VMware Cloud services subscriptions. Others can be done by Operations for Applications **Admins** in the Operations for Applications UI. -With the 2023-XX release, we introduce the **Admin** permission and service role, which partially correspond to the **Accounts** permission for original subscriptions. Users with the **Admin** service role can manage service account and Operations for Applications API tokens. They can also restrict access to new dashboards and alerts and set the organization settings. For example, they can restrict the access to the object creator only and set default settings, such as display settings, PromQL support, default way of building queries, and define Logs settings. +With the 2023-XX release, we introduce the **Admin** permission and service role, which partially correspond to the **Accounts** permission for original subscriptions. Users with the **Admin** service role can manage service accounts and Operations for Applications API tokens. They can also restrict access to new dashboards and alerts and set the organization settings. For example, they can restrict the access to the object creator only and set default settings, such as display settings, PromQL support, default way of building queries, and define Logs settings. + +{% include note.html content="Service accounts are enabled only for a limited number of VMware Cloud services subscriptions, because in most cases they should use [server to server OAuth apps](csp_server_to_server_apps.html). To enable service accounts for your service instance, [contact](wavefront_support_feedback.html) our Technical Support team." %} ![A graphic showing the differences in the admin tasks for original and onboarded subscriptions. The information displayed is described in the table below.](images/csp-admin-tasks.png) @@ -207,7 +209,7 @@ For details, see Manage User Accounts.

Where: In the Operations for Applications user interface.

How: Service accounts authenticate with API tokens. Service accounts can be assigned with roles and permissions, as well as can be added to groups. For details, see Manage Service Accounts.

-Note: Server to server OAuth apps are recommended and fully supported. Service accounts are with limited support. +Note: Server to server OAuth apps are recommended and fully supported. Service accounts are with limited support and will be deprecated in the future.

Who:

For details, see Manage API Tokens.

-Note: It is recommended to use VMware Cloud services API tokens and server to server OAuth app credentials for obtaining VMware Cloud services access tokens. Operations for Applications API tokens are with limited support. +Note: It is recommended to use VMware Cloud services API tokens and server to server OAuth app credentials for obtaining VMware Cloud services access tokens. Operations for Applications API tokens are with limited support and will be deprecated in a future release.

Who:

diff --git a/pages/doc/csp_supported_integrations.md b/pages/doc/csp_supported_integrations.md index bfb207f7a..428b49085 100644 --- a/pages/doc/csp_supported_integrations.md +++ b/pages/doc/csp_supported_integrations.md @@ -37,7 +37,9 @@ The Wavefront proxy requires a VMware Cloud services access token with the **Pro **Operations for Applications API token** -For a limited number of integrations, you must still use an Operations for Applications API token. It is recommended that the API token is associated with a [service account](csp_service_accounts.html) that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. It is recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens. +For a limited number of integrations, you must still use an Operations for Applications API token, associated with a [service account](csp_service_accounts.html) that has the **Proxies** permission. As a user with the **Admin** service role, you can create a service account with the **Proxies** permission and generate an API token for it. Then, you can install the Wavefront proxy and set up your integration to pass the API token of the service account. + +{% include note.html content=" Service accounts are enabled only for a **limited number** of VMware Cloud services subscriptions, because in most cases they should use [server to server OAuth apps](csp_server_to_server_apps.html). Тo enable service accounts for your service instance, [contact](wavefront_support_feedback.html) our Technical Support team. It is recommended that you gradually switch to using server to server OAuth apps which authenticate with more secure VMware Cloud services access tokens." %} To understand how you can manage the API tokens for service accounts, see [Managing the Operations for Applications API Tokens for a Service Account](csp_api_tokens.html#managing-the-operations-for-applications-api-tokens-for-a-service-account). @@ -53,7 +55,7 @@ Before you add a proxy, you must have an API token associated with your user acc We're in the process of incrementally updating our integrations so that you can authenticate with a VMware Cloud services API token or OAuth server to server app credentials. -Here's the list of the integrations that are updated as of today. This list grows with each release. If you urgently need an integration to become available and configurable with a VMware Cloud services access token, please contact us at: `tanzu_saas_ops@vmware.com`. +When your Operations for Applications service **is onboarded** to the VMware Cloud services platform, the list of the integrations that are updated as of today is in the table below. This list grows with each release. If you urgently need an integration to become available and configurable with a VMware Cloud services access token, please contact [technical support](wavefront_support_feedback.html). diff --git a/pages/doc/csp_ui_differences.md b/pages/doc/csp_ui_differences.md index c5a101204..d81e26993 100644 --- a/pages/doc/csp_ui_differences.md +++ b/pages/doc/csp_ui_differences.md @@ -39,13 +39,17 @@ The gear icon menu also differs, because many of the tasks for VMware Cloud serv 1. The tenant name is missing, because it is shown in the VMware Cloud Services Console when you launch the service instance. In a multi-tenant environment, the current tenant is shown on the top-left of the menu bar and you can click it to switch between tenants. 1. The **Self Service SAML** menu item is missing, because the enterprise federation setup is done from the VMware Cloud Services Console. + 1. The **Accounts** menu item is available only for a **limited number** of VMware Cloud services subscriptions. See the section below. 1. The **Super Admin** menu item is replaced with **Orphaned Objects**, because Super Admin users can no longer invite new Super Admin users, but they can still see and recover orphaned objects, such as orphan dashboards and alerts. See the following bullet point. 1. The **Sign Out** menu item is missing, because signing out is done from the User/Organization drop-down menu on the top-right of the menu bar. + ## Accounts Page Most of the identity and access management tasks for VMware Cloud services subscribers are done by using the VMware Cloud Services Console. Therefore, if you are a user with the **Admin** service role assigned (this role partially covers the **Accounts** permission for original subscriptions), when you click the gear icon on the toolbar and select **Accounts**, you will see only the **Service Accounts** and the **API Tokens** tabs. +{% include note.html content=" This page is available only for a **limited number** of VMware Cloud services subscriptions, because in most cases you should use [server to server OAuth apps](csp_server_to_server_apps.html) and [VMware Cloud services API tokens](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-3A9C29E0-460B-4586-B51A-084443A960D0.html)." %} + ![An image showing the differences in the Accounts menu and the Service Accounts tab.](images/new-vs-original-accounts.png) 1. The **User Accounts**, **Groups**, and **Roles** tabs are missing, because the management of users, groups, and roles is done from the VMware Cloud Services Console. By using the **Accounts** menu item, the VMware Cloud services subscribers can manage only service accounts and the Operations for Applications API tokens associated with them. diff --git a/pages/doc/upgrade-and-purchase.md b/pages/doc/upgrade-and-purchase.md index 9d15cd7f5..01549ff61 100644 --- a/pages/doc/upgrade-and-purchase.md +++ b/pages/doc/upgrade-and-purchase.md @@ -97,4 +97,4 @@ In case of urgency, you can contact the Operations for Applications team by send After you place your order, you will see a purchase confirmation page. Typically, it takes 24 hours to fulfil an order. Once your subscription becomes active, you'll receive an email notification. - +