Standalone Harvester has basic auth; real multi-tenancy comes from Rancher:
- Create Projects in the Harvester cluster (via Rancher) and move namespaces into them.
- Assign users/groups project roles (Owner, Member, Read-only, or custom
RoleTemplates). - Apply resource quotas per project/namespace (CPU, memory, storage requests) — Harvester respects these for VMs.
- Scope VM networks and LB IP pools to namespaces/projects.
- Keep shared images/templates in
harvester-public.
Example custom role: allow VM power operations and console, but not deletion — build a RoleTemplate granting get/list/watch on VMs plus the subresources.kubevirt.io verbs for start/stop/restart/console/vnc.