This section discusses the roles required to be assigned to the vCenter user for integration with NSX Advanced Load Balancer.
Create the following roles:
AviRole-Global
AviRole-Folder
AviRole-Global
This role must apply Global Permissions. It allows the user to upload SE OVF to the content library, allocate space on datastore to create a virtual machine (VM) and assign networks to it.
Role Summary
The AviRole-Global needs the following permissions:
Content Library
Add library items
Delete library items
Update files
Update library items
Datastore
Allocate space
Remove files
Network
Assign network
Remove
vAPP
Import
Virtual Machine
Change Configuration
Add new disk
Creating AviRole-Global
To create AviRole-Global,
Log in to the vCenter UI as admin.
Navigate to Administration > Roles as shown below:
Click on the + sign to create a new role.
Figure 1. 
Click on Content Library and select the permissions as shown below:
Click on Datastore and select Allocate space and Remove file.
Click on Network and select Assign network and Remove.
Click onVirtual Machine and select Add new disk.
Click on vApp and select Import.
Click on Next.
Enter the Role name as AviRole-Global and enter a Description, if required.
Click on Finish.
AviRole-Folder
This role must be applied to the folder where the admin wants the Avi service engine VMs to be created. It contains the permissions to create an SE folder, create SE VM from template, assign it to a resource pool, and perform operations on the VM like adding devices, powering it on/off, and connecting its vNICs to networks. This role restricts the VM operations only to the folder to which the role is applied.
Role Summary
Folder
Create folders
Network
Assign networks
Remove networks
Resource
Assign virtual machine to resource pool
Tasks
Create tasks
Update tasks
vApp
Add virtual machine
Assign resource pool
Assign vApp
Create
Delete
Export
Import
Power off
Power on
vApp application configuration
vApp instance configuration
Virtual machine
Change Configuration
Add existing disk
Add new disk
Add or remove device
Advanced configuration
Change CPU count
Change Memory
Change Settings
Change resource
Display connection settings
Extend virtual disk
Modify device settings
Remove disk
Edit Inventory
Create new
Remove
Register
Unregister
Interaction
Connect devices
Install VMware Tools
Power off
Power on
Reset
Provisioning
Allow disk access
Allow file access
Allow read-only disk access
Deploy template
Mark as virtual machine
Creating AviRole-Folder
To create AviRole-Folder,
Log in to the vCenter UI as admin.
Navigate to Administration > Roles as shown in the previous section.
Click on the + sign to create a new role.
Click on Folder and select the permissions Create folder.
Click on Network, and select Assign network and Remove.
Click on Resource and select the permissions as shown below:
Click on Tasks and select the permissions as shown below:
Click on Virtual Machine and select the permissions as shown below:
Figure 2. 
Figure 3. 
Click on vApp and select the permissions as shown below:
Click on Next.
Enter the Role name as
AviRole-Folderand enter a Description, if required.
Click on Finish.
While creating the folder at vCenter, you should select New VM and Template Folder option.
Combined AviRole
If the vCenter admin does not want to restrict VM operations to a folder and wants to assign the permissions globally, a single AviRole can be created with permissions as shown below and applied as Global Permissions instead of creating AviRole - Global and AviRole - Folder.
Role Summary
Content Library
Add library item
Delete library item
Update files
Update library item
Datastore
Allocate space
Remove file
Folder
Create folder
Network
Assign network
Remove
Resource
Assign virtual machine to resource pool
Tasks
Create task
Update task
vApp
Add virtual machine
Assign resource pool
Assign vApp
Create
Delete
Export
Import
Power off
Power on
vApp application configuration
vApp instance configuration
Virtual machine
Change Configuration
Add existing disk
Add new disk
Add or remove device
Advanced configuration
Change CPU count
Change Memory
Change Settings
Change resource
Display connection settings
Extend virtual disk
Modify device settings
Remove disk
Edit Inventory
Create new
Remove inventory
Register
Unregister
Interaction
Connect devices
Install VMware Tools
Power off
Power on
Reset
Provisioning
Allow disk access
Allow file access
Allow read-only disk access
Deploy template
Mark as virtual machine
Assigning the Roles
Assign the global and folder level roles, as discussed below:
Assigning AviRole - Global
Log in to vCenter UI and navigate to Global Permissions.
Click on the + sign to add a new permission:
Select the Domain.
Search for and select the required username (this will be used for authentication in the Avi cloud configuration).
Click on Propogate to children. The Add Permission screen is as shown below:
Click onOK.
Assigning AviRole - Folder
Log in to vCenter UI and navigate to VMs and Templates.
Select the VM folder in which the Avi SEs have to be created.
Figure 4. 
Click on the Permissions tab.
Click on the + sign to add a new permission.
Figure 5. 
Select theDomain.
Search for and select the required username (this will be used for authentication in the Avi cloud configuration).
Click on Propogate to children. The Add Permission screen is as shown below:
Figure 6. 
Click on OK.
