IBM DS8882F Introduction And Planning Manual page 66

so that they exist only between resources within each tenant's scope of resources,
and limiting a tenant's Copy Services operators to an "operator only" role.
When managing a single-tenant installation, the partitioning capability of resource
groups can be used to isolate various subsets of an environment as if they were
separate tenants. For example, to separate mainframes from distributed system
servers, Windows from UNIX, or accounting departments from telemarketing.
Using resource groups to limit Copy Service operations
Figure 6 illustrates one possible implementation of an exemplary environment that
uses resource groups to limit Copy Services operations. Two tenants (Client A and
Client B) are illustrated that are concurrently operating on shared hosts and
storage systems.
Each tenant has its own assigned LPARs on these hosts and its own assigned
volumes on the storage systems. For example, a user cannot copy a Client A
volume to a Client B volume.
Resource groups are configured to ensure that one tenant cannot cause any Copy
Services relationships to be initiated between its volumes and the volumes of
another tenant. These controls must be set by an administrator as part of the
configuration of the user accounts or access-settings for the storage system.
Hosts with LPARs
Switches
Client A
Client B
Client A
Client B
Site 1
Figure 6. Implementation of multiple-client volume administration
Resource groups functions provide additional policy-based limitations to users or
the DS8000 storage systems, which in conjunction with the inherent volume
addressing limitations support secure partitioning of Copy Services resources
between user-defined partitions. The process of specifying the appropriate
limitations is completed by an administrator using resource groups functions.
56
DS8882F Introduction and Planning Guide
Hosts with LPARs
Switches
Client A
Client B
Client A
Client B
Site 2