The best method to provide access for a user to view real-time performance metrics for all VMs on all clusters across the datacenter is to configure AD authentication create a custom role, assign the user to the role, and apply the role to all clusters and VMs. This method accomplishes this with the least effort and ongoing maintenance because:

AD authentication allows Nutanix Prism Central to integrate with an existing Active Directory (AD) domain and use AD users and groups for authentication and authorization 5 . This simplifies user management and avoids creating local users on Prism Central.

Creating a custom role allows Nutanix Prism Central to define granular permissions for different actions and entities based on specific needs 6 . This ensures that users only have access to what they need and nothing more.

Assigning the user to the custom role allows Nutanix Prism Central to grant access rights for that user based on the role definition 7 . This avoids assigning permissions individually for each user.

Applying the role to all clusters and VMs allows Nutanix Prism Central to propagate the access rights for that role across all entities in scope 8 . This ensures that users can view real-time performance metrics for all VMs on all clusters without having to configure each entity separately.

References:  1 :  Health Dashboard - Prism Element Guide   2 :  Understanding Native VLANs - Cisco   3 :  VMs may lose network connectivity if connected to virtual network with … - Nutanix Support & Insights   4 :  VLAN Configuration - AHV Networking Guide   5 :  Active Directory Authentication - Prism Central Guide   6 :  Create Custom Roles - Prism Central Guide   7 :  Assign Roles - Prism Central Guide   8 :  Apply Roles - Prism Central Guide

The critical alerts listed are indicating that the default passwords are still in use for IPMI, the host, and the Controller Virtual Machine (CVM). This suggests that the passwords for these components were not changed from the default during the initial cluster configuration and deployment process, which is a critical security practice.

A. CVM password changes : The alert for the CVM using the default password indicates that the CVM password has not been changed. It is a standard security measure to change default passwords to prevent unauthorized access.

C. Host password changes : Similarly, the alert for the host using the default password indicates that the default password for the host has not been updated. This applies to the passwords used to access the hypervisor host directly.

Changing default passwords is a critical step in securing the Nutanix environment. This is highlighted in Nutanix ' s best practices and security guidelines, which recommend changing default passwords as part of the initial configuration to ensure that the environment is not left vulnerable to unauthorized access due to known default credentials. This process is typically part of the initial setup procedures outlined in the Nutanix documentation for cluster deployment and security configuration.

The IPMI alert also points to the need for changing default passwords, but since IPMI (Intelligent Platform Management Interface) is not specifically mentioned in the provided options, it falls under the broader category of host-level password changes, which would be covered by option C.

BIOS password changes (Option B) and Password policy changes (Option D) are also important but were not directly flagged by the alerts mentioned. BIOS password changes are usually a separate task and not indicated by the alerts given, while password policy changes are related to the policies governing password complexity and rotation rather than the initial password setup.

Nutanix provides two types of granular RBAC for AHV hosts: category based and cluster based 3 . Category based RBAC allows administrators to assign roles to users or groups based on categories, which are key-value pairs that can be applied to various entities in Prism Central, such as clusters, hosts, VMs, images, and networks. Categories can be used to group entities by different criteria, such as department, project, environment, or location. For example, an administrator can create a category key named Department and assign different values to it, such as Finance, Marketing, or Engineering. Then, the administrator can apply this category to different clusters or hosts and assign roles to users or groups based on this category.  This way, users or groups can have different levels of access to different clusters or hosts depending on their department 4 .

Cluster based RBAC allows administrators to assign roles to users or groups based on specific clusters registered in Prism Central. For example, an administrator can create a role named Cluster Admin and assign it to a user or group for a particular cluster.  This way, the user or group can have full access to that cluster and its hosts and VMs, but not to other clusters 5 .

ht tps://portal.nutanix.com/page/documents/det ails/?targetId=Web_Console_Guide-Prism_v4_7:lic_licensing_manag ing_c.html

Re claiming Licenses (Includi ng License Renewal)

You can reclaim and optionally re-apply licenses for nodes in your clusters:

You must reclaim licenses when you plan to destroy a cluster. First reclaim the licenses, then destroy the cluster. You do not need to reclaim Starter licenses. These licenses are automatically applied whenever you create a cluster, including after you have destroyed a cluster.

Return licenses to your inventory when you remove one or more nodes from a cluster. Also, if you move nodes from one cluster to another, first reclaim the licenses, move the nodes, then re-apply the licenses.

You can reclaim licenses for nodes in your clusters in cases where you want to make modifications or downgrade licenses. For example, applying an Ultimate license to all nodes in a cluster where some nodes are currently licensed as Pro and some nodes are licensed as Ultimate. You might also want to transition nodes from Ultimate to Pro licensing.

You must reclaim licenses when you renew licenses. First reclaim the expired licenses, then apply new licenses.

 When a node with Erasure Coding fails, the cluster will automatically rebuild the missing data using replication factor (RF) 2 or 3, depending on the cluster configuration.  This means that the data that was previously stored using Erasure Coding will now be stored using full copies, which may increase the amount of data stored in the SSD tier 1 .

https://portal.nutanix.com/page/documents/solutions/details/?targetId=BP-2029_AHV:BP-2029_AHV

Administrators can use Acropolis with IPAM to deliver a complete virtualization deployment, including network management, from the unified Prism interface. This capability radically simplifies the traditionally complex network management associated with provisioning VMs and assigning network addresses. To avoid address overlap, be sure to work with your network team to reserve a range of addresses for VMs before enabling the IPAM feature.

The Acropolis master assigns an IP address from the address pool when creating a managed VM NIC; the address releases back to the pool when the VM NIC or VM is deleted.

Configure VM-Host affinity for the nodes that meet the application’s GPU requirement.  This is because VM-Host affinity allows the administrator to specify which nodes a VM can run on or must not run on 1 . By creating a VM-Host affinity rule that binds the application VM to the three nodes that have the physical GPU, the administrator can ensure that the VM will always run on a node that meets its requirement, regardless of any HA or migration events. This also allows the other nodes in the cluster to host other VMs without any restrictions.

A managed network is a type of network that can be created on an AHV cluster and allows VMs to automatically be assigned an IP address at creation time. A managed network uses the Nutanix IP Address Management (IPAM) service, which provides DHCP and DNS functionality for the VMs on the network. A managed network can be configured with a subnet range, a default gateway, and DNS servers. The IPAM service will allocate IP addresses from the subnet range to the VMs and register their hostnames in the DNS servers.  The IPAM service will also release the IP addresses when the VMs are deleted or moved to another network 1 .

To create a managed network on an AHV cluster, the administrator can use Prism Element or Prism Central.  The steps are as follows 2 :

In Prism Element, go to the Network Configuration page and click Create Network.

In Prism Central, go to the Networks page and click Create.

Enter a name and description for the network.

Select Managed as the network type.

Enter the subnet range, default gateway, and DNS servers for the network.

Optionally, enable VLAN tagging and enter a VLAN ID for the network.

Click Save.

The cluster time zone is a setting that determines the time zone used by all CVMs in the cluster. The cluster time zone affects the timestamps of Nutanix logs, events, alerts, and reports. The cluster time zone also affects the scheduling of tasks such as snapshots, replication, and upgrades.  By default, the cluster time zone is set to UTC (Coordinated Universal Time) when the cluster is created 3 .

To change the cluster time zone, the administrator needs to use the ncli (Nutanix command-line interface) on any CVM in the cluster.  The steps are as follows 4 :

Log in to any CVM using SSH.

Run  ncli cluster get-timezone  to check the current cluster time zone.

Run  ncli cluster set-timezone timezone= < timezone >  to change the cluster time zone, where  < timezone >  is a valid time zone identifier (for example, America/New_York).

Run  ncli cluster get-timezone  again to verify that the cluster time zone has been changed.

Note that changing the cluster time zone does not affect the time zone of Prism Element or Prism Central VMs.  To change their time zone, the administrator needs to use Prism Element UI or Prism Central UI respectively 5 .