VMware Tanzu Observability (formerly known as VMware Aria Operations for Applications) subscriptions are two types: original subscriptions and VMware Cloud Services subscriptions.
Examples of the Functionality Differences
Users, Roles, and Group Management
Most of the user and account management tasks done in the Tanzu Observability UI for original subscriptions, are done in the VMware Cloud services for VMware Cloud services subscriptions. For example, the following tasks related to managing users, roles, and groups can be done from the VMware Cloud Services Console.
- Invite new users
- Assign permissions
- Create and edit roles
- Create and edit groups
- Assign roles to users and groups
Admin Tasks
Some administrative tasks, done by Super Admins and users with the Accounts permission in original subscriptions, are done by VMware Cloud Organization Owners and VMware Cloud Organization Administrators in VMware Cloud services subscriptions. Others can be done by Tanzu Observability Admins in the Tanzu Observability UI.
With the 2023-38 release, we introduce the Admin permission and service role, which partially correspond to the Accounts permission for original subscriptions. Users with the Admin service role can manage service accounts and Tanzu Observability API tokens. They can also restrict access to new dashboards and alerts and set the organization settings. For example, they can restrict the access to the object creator only and set default settings, such as display settings, PromQL support, default way of building queries, and define Logs settings.
| Task | Original Subscription | VMware Cloud Services Subscription |
|---|---|---|
| Upgrade from trial |
|
|
| Purchase more PPS |
|
|
| Invite new Super Admins |
|
|
| Create and manage service accounts and their Tanzu Observability API tokens |
|
|
| Restore orphan dashboards and alerts |
|
|
| Restrict access to new dashboards and alerts |
|
|
| Set the service organization settings |
|
|
REST API Access
For original subscriptions, using the Tanzu Observability REST API requires an API token associated with a user account or a service account. To generate API tokens for your user account you need the API Tokens permission. To generate API tokens for service accounts and to manage the API tokens in your Tanzu Observability organization, you need the Accounts permission.
When your service is onboarded to VMware Cloud services and you want to access the Tanzu Observability REST API, you need a VMware Cloud services access token. In a few cases, when setting up a limited list of integrations, authentication with a Tanzu Observability API token is also supported. However, using a VMware Cloud services access token is the recommended way as we will deprecate the service accounts in the future. To obtain an access token, you can:
-
Generate a VMware Cloud services API token associated with your user account and exchange it for an access token.
-
Create a server to server app (which is the equivalent of a service account), obtain its OAuth credentials (app ID and app secret), and exchange them for an access token.
In-Depth Explanation of the Functionality Differences
| Functionality | Original Subscription | VMware Cloud Services Subscription |
|---|---|---|
| User Login | Users log in to their Tanzu Observability service instance by using the URL of the service cluster, https://<your_instance>.wavefront.com, and their Tanzu Observability accounts. If their corporate domain is configured for SAML SSO with Tanzu Observability, users log in with their corporate accounts.
|
Users log in to their Tanzu Observability service instance through the VMware Cloud Services Console with their VMware Cloud services accounts. If their corporate domain is federated with VMware Cloud services, users log in with their corporate accounts. For details, see Log In from the VMware Cloud Services Console. |
| User Accounts Management |
Who: Users with the Accounts permission.
Where: In the Tanzu Observability user interface. How: You can invite new users with or without assigning roles and permissions. For details, see Manage User Accounts. |
Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
Where: In the VMware Cloud Services Console. How: To add a user to your Tanzu Observability service instance, you must assign that user:
|
| Service Accounts and Server to Server OAuth Apps Management | Note: Only service accounts are supported.
Who: Users with the Accounts permission. Where: In the Tanzu Observability user interface. How: Service accounts authenticate with API tokens. Service accounts can be assigned with roles and permissions, as well as can be added to groups. For details, see Manage Service Accounts. |
Note: Server to server OAuth apps are recommended and fully supported. Service accounts are with limited support and will be deprecated in the future.
Who:
Where:
How:
|
| Permissions Management | Who: Users with the Accounts permission.
Where: In the Tanzu Observability user interface. How: Permissions can be assigned to roles as well as to individual user accounts and service accounts. See: Note: The permissions list includes the Accounts, SAML IdP Admin, and API token permissions, because they are required for all of the authorization and authentication tasks which are done in the Tanzu Observability. In addition, the Accounts permission grants privileges for managing the Tanzu Observability organization settings. See the Permissions Reference. |
Who:
Where:
How: Permissions can be assigned only to roles in the VMware Cloud services organization and service accounts - in the Tanzu Observability environment. See: Note: The Accounts, SAML IdP Admin, and API token permissions don't exist, because most of the authorization and authentication tasks requiring these permissions are done in the VMware Cloud Services Console. The Admin Tanzu Observability permission grants privileges for managing service accounts, Tanzu Observability API tokens, and the Tanzu Observability organization settings. See the Tanzu Observability Permissions in VMware Cloud Services. |
| Roles Management | Who: Users with the Accounts permission.
Where: In the Tanzu Observability user interface. How: Roles can be assigned with permissions. Roles can be assigned to user accounts, service accounts, and groups. For details, see Manage Roles and Permissions. |
Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
Where: In the VMware Cloud Services Console. How: Roles can be assigned with permissions. Roles can be assigned to users, groups, API tokens, and server to server apps. There are:
|
| Groups Management | Who: Users with the Accounts permission.
Where: In the Tanzu Observability user interface. How: A group of user and service accounts can be assigned with one or more roles. For details, see Create a Group. |
Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
Where: In the VMware Cloud Services Console. How: A group of users can be assigned with organization and service roles. A group can be shared with other VMware Cloud organizations. In a federated environment, you can add enterprise groups from your corporate domain. For details, see How do I work with groups in the VMware Cloud services documentation. |
| Self-Service SAML SSO |
Who: Users with the SAML IdP Admin permission.
Where: In the Tanzu Observability user interface. How: Tanzu Observability includes predefined authentication integrations. For details, see Single-Tenant Authentication and Self-Service SAML SSO. |
Who: A user with the VMware Cloud Organization Owner role together with an Enterprise Administrator.
Where: In the VMware Cloud Services Console. How: The VMware Cloud Organization Owner user kicks off the self-service federation workflow on behalf of the VMware Cloud organization and invites the Enterprise Administrator to complete the setup. For details, see Setting Up Enterprise Federation with VMware Cloud Services Console in the VMware Cloud services documentation. |
| Generating API Tokens | Note: Only Tanzu Observability API tokens are supported.
Who:
Where: In the Tanzu Observability user interface. How:
|
Note: It is recommended to use VMware Cloud services API tokens and server to server OAuth app credentials for obtaining VMware Cloud services access tokens. Tanzu Observability API tokens are with limited support and will be deprecated in a future release.
Who:
Where:
How:
|
| API Tokens Management |
Who:
Where: In the Tanzu Observability user interface. How:
|
Who:
Where:
How:
|
| Tanzu Observability REST API Access |
Who: Everyone who has a Tanzu Observability API token associated with a user account or a service account.
Where: An API client. How: Interacting with the Tanzu Observability REST API requires a Tanzu Observability API token.
|
Who: Everyone who has a VMware Cloud services API token or the credentials of a server to server OAuth app.
Where: An API client. How: Interacting with the Tanzu Observability REST API requires a VMware Cloud services access token.
|
| Tanzu Observability Organization Settings |
Who: Users with the Accounts permission.
Where: In the Tanzu Observability user interface. How: As a user with the Accounts permission, you can configure:
|
Who: Users with the Admin Tanzu Observability service role.
Where: In the Tanzu Observability user interface. How: As a user with the Admin service role, you can configure:
|
| Wavefront Proxy Installation | Note: The Wavefront proxy authenticates with a Tanzu Observability API token.
Who: Users with the Proxies permission. Where: In the Tanzu Observability user interface. How: As a user with the Proxies permission, you must configure the proxy to authenticate to Tanzu Observability with a Tanzu Observability API token that have the Proxies permission. For details, see Install a Proxy from the UI. |
Note: The Wavefront proxy authenticates with a VMware Cloud services access token obtained from server to server OAuth app credentials or from a VMware Cloud services API token. Proxy authentication with a Tanzu Observability API token is still possible and supported only for a limited list of integrations.
Who:
Where:
How: As a user with the Proxies service role, you configure the proxy to authenticate to Tanzu Observability. The proxy obtains a VMware Cloud services access token with the Proxies service role or use a Tanzu Observability API token of a service account with the Proxies permission. To obtain a VMware Cloud services access token:
|
| Integrations Installation | Note: All integrations that use a Wavefront proxy authenticate with a Tanzu Observability API token.
Who: Users or service accounts with the Proxies permission who have an active Tanzu Observability API token. Where: In the Tanzu Observability user interface. How: Follow the instructions on the Setup tab of the integration that you want to install. |
Note: Most of the integrations that use a Wavefront proxy authenticate with a VMware Cloud services access token. A limited list of integrations still use proxy authentication with a Tanzu Observability API token.
Who: Users with the Proxies Tanzu Observability service role who must have one of the following:
Where: In the Tanzu Observability user interface. How: Follow the instructions on the Setup tab of the integration that you want to install. |
| Metrics Security Policy Management | Who: Users with the Metrics permission.
Where: In the Tanzu Observability user interface. How: Privileged users can block or allow access to metrics for:
|
Who: Users with the Metrics Tanzu Observability service role.
Where: In the Tanzu Observability user interface. How: Privileged users can block or allow access to metrics for:
|