End of Support

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

CloudVision Studios

CloudVision Studios is a powerful tool for managing the configuration of network features. The intuitive interface is fully customizable, meaning that you can create and edit your own network features for configuration. This gives you complete control over the configuration of your network.

Sections in this chapter include:

Requirements

To use Studios, the following requirements must be installed:

CloudVision minimum version: 2021.2.0

Features

The following features are available:

Out-of-the-box support for common workflow configurations
Unified Day-1 and Day-2 workflows
Customizable Studios for bespoke workflow configuration
In-depth and accessible change control
Simultaneous configuration and management of separate network features
First-class gRPC + REST APIs that easily integrate third-party resources

Known Limitations

The following is a list of known limitations in the beta-version of CloudVision Studios:

Configuration-reconciliation: this is handled by the Network Provisioning UI
CloudVision Studios cannot be applied to devices in an undefined container
Studios rollback: once a Workspace and its configuration have been submitted, a user will need to undo those changes by creating and submitting a new Workspace
Studio input actions: scripts that automatically complete Studio inputs on a user's behalf (e.g. integrating with an IPAM) are not yet supported
Per-Studio or per-device RBAC: Phase 1 will include per-user roles and permission management that let users read and write Studio data, but do not limit user roles to specific Studios
Users should only have one Workspace open at a time. If users have two open Workspaces that contain conflicts with one another and submit one of those Workspaces, the other may not be able to build correctly. Consequently, that second Workspace may need to be abandoned or reconfigured
Workspaces should not be created on CloudVision clusters that manage more than 100 devices

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Getting Started with Studios

Before using Studios, it is important to understand the two main elements: the Studios and Workspaces. You will use the two of these together to make changes to the mainline configuration of your network.

Studio

A Studio is an input template for a particular aspect or feature of a network, and it defines the attributes of any devices belonging to that feature. All your Studios are visible on the Studios home screen.

When you visit Studios for the first time, you’ll see that there are already several built-in Studios. These cover some common network features, and each is explained separately in the section Built-In Studios. You can create your own custom-built Studios so that you can determine a new network feature for configuration.

Workspace

A Workspace is what you use to create, configure, or edit a Studio’s inputs, and to tag the devices that a Studio affects. It can be used to configure one or more Studios, which means that you can implement configuration changes across multiple network features at the same time.

There are three states a Workspace can have:

Submitted: A Workspace that has configured one or more Studios and been submitted for approval in Change Control
Open: A Workspace that has been created but not yet submitted
Abandoned: A Workspace that has been discarded before submission

Note: Give any Workspace or Studio you create a relevant name and description so it can be determined how it relates to the configuration of your network.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Accessing Studios

Studios is currently in beta-version and needs to be enabled in the CloudVision settings before it can be used.

To enable Studios

Select the Settings icon in the top-right of CloudVision and browse the list of features for Studios (Beta). Switch the toggle to the ON position.
Figure 1. Enabling Studios
Once you have enabled Studios, click on the Provisioning tab.
Figure 2. Provisioning Tab
Select Studios on the sidebar.
Figure 3. Selecting Studios from the sidebar

The Studios home screen is displayed.This is where you will initiate all your configurations.You can view your Workspaces and see their statuses by selecting on Workspaces under Studios.

For more information, refer to Per-Studio Role Based Access Control

Per-Studio Role Based Access Control

Per-Studio Role Based Access Control (RBAC) provides CloudVision users with granular control over access permissions for individual studios. A relevant user can grant differing permissions to other users for both management and input configuration of individual studios. Management includes the studio creation and deletion, its template, and its schema; input configuration includes the assignment of tags and the configuration of a studio’s inputs.

A user’s permissions are controlled and assigned through the use of roles in Access Control. Each role is configured with separate No Access, Read Only, or Read and Write access for the Management and Input Configuration permissions of a studio.

By default there are no per-studio permissions for CloudVision built-in roles.

Role Permissions

On a per-studio basis, the permissions have the following effect:

Table 1. Role Permissions
Permission	Management	Input Configuration
No Access	The user will not be able to access the studio’s schema and template or be able to delete the studio	The user will not be able to see the studio in Studios
Read Only	The user will only be able view a studios schema and template, and will not be able to delete the studio	A user can only view the input configuration and device assignment of the studio
Read and Write	The user can edit the schema and template of a studio and can delete the studio	A user can configure the device assignment and inputs of the studio

Users may encounter on-screen errors when configuring roles if the permissions set for Management and Input Configuration do not result in a valid combination. A summary of the valid combinations is available here:

Table 2. Valid Role Based Combinations
Management	Input Configuration
No Access	No Access
Read Only	No Access Read Only Read and Write
Read and Write	Read and Write

Enabling and Accessing Per-Studio Permissions

The Studio Role Based Access Control must be enabled before it can be accessed.

Enabling Per-Studio Permissions

Per-Studio Role Based Access Control must be enabled in the Features section of General Settings.

Select the Setting icon to open the General Settings page.
Select the toggle for Studios Enhanced RBAC (Beta).

Figure 5. Studios Role Based Access Control (RBAC) Toggle

Accessing Per-Studio Permissions

Once Studios Role Based Access Control (RBAC) is enabled, any existing roles can be edited with per-studio permissions or new roles can be created with those permissions and assigned to users.

The permissions can be accessed through Roles in Access Control when editing or creating a role. Scroll down to Studios, which can be expanded to show the Per-Studio Permissions.

Each studio available in Studios can be added and permissions assigned to the role for that studio. Any studio that is not added to the list will have the global permissions defined above.

Configuring Permissions for Studios Role Based Access Control

Create a new role or edit an existing role, which will bring up the permissions modal. Scroll down to Studios and expand it. You will then begin the process by configuring the default (global) permissions.After the default permissions are set, you will configure the per-studio permissions.

Select a role from the list or select Add Role.

Figure 7. Roles List
From Module Access menu, open Studios.

Figure 8. Module Access Menu
Configure the default settings for Studios, which apply to all studios.

Note: The default permissions will be overridden by any per-studio permissions you assign for a selected studio.

Figure 9. Studios Default Permissions
Open the Per-Studio Permissions section of the menu.

Figure 10. Per-Studio Permissions
Select a Studio from the list or select Add Studio,
Set the Management and Input Configuration for the Studio.

Note: The permissions are set by default to the default permissions for Studios. Changing the permissions will override the default permissions for the selected Studio.
You can add more Studios and configure the per-studio permissions for each. When you are finished select Save.

Updating Workspace Permissions

The permissions for Workspaces are impacted by any per-studio permissions.

A user with Read and Write permissions for any studios will not be able to create or manage workspaces if they do not have Read and Write permissions for Workspace Management. This means another user with the relevant permissions will need to create and build workspaces. Similarly, a user must have Read and Write access to Workspace Submission in order to submit a workspace. If a user has Read and Write access for a studio, they will be unable to submit any workspaces they use to configure the studio.

An error will be displayed when the user’s per-studio permissions conflict with their Workspace Submission permission.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Workflow Overview

Whenever you use Studios, you will begin by either creating a new Workspace or selecting an open Workspace. You will use a Workspace to implement any changes you want to make to one or more Studios. Once you have configured the changes, you will submit the Workspace. It will then be available in Change Control for the relevant user to approve or reject.

If you aree using Studios for the first time, create a Workspace and then select the Inventory and Topology Studio to commission devices for use in Studios.

Note: Once a Workspace has been submitted, it cannot be used again. If you wish to make further changes to a Studio, you’ll need to create a new Workspace or select an open Workspace.

For more information, refer to:

Commissioning Devices for Use in Studios

To configure any devices in Studios and Workspaces, you will first need to commission them for use in Studios. This is the purpose of the Inventory and Topology Studio.

To commission devices, you will first create a Workspace and then select the Inventory and Topology Studio. There you will add devices and configure their interface connections. These devices can then be assigned to another Studio using tags.

Note: You will not be able to assign devices to any Studios until you have commissioned devices using the Inventory and Topology Studio.

Creating a Workspace

Click Create Workspace, which will bring up the Create New Workspace modal.

Figure 2. Create a Workspace
Give your new Workspace a name and a description, and then click Create.

Figure 3. Name and Describe the Workspace

The Workplace you have created can now be used to manage the configuration of one or more Studios. It will be available for use in the Workspace dropdown menu.

Configuring an Existing Studio

To begin the process of configuring a Studio, you will need to either create a Workspace or already have an open Workspace available for use.

Create a Workspace or click the Workspace dropdown menu and select the open Workspace that you want to configure the Studio inputs with.

Figure 4. Selecting a Workspace
Click on the existing Studio that you want to edit.
Manage the devices the Studio is assigned to by clicking Tag Assignment and selecting Assign Tags.

Figure 5. Tag Assignment

For more information on how to use Tags, see Tags.

Note:If the devices you wish to use for the Studio are not available for selection, you will need to commission them for Studios with the Inventory and Topology Studio.
Navigate through the Studio interface and configure your new input values.

If you want to add or remove the input variables themselves, see Editing a Studio’s Schema.
Once all the changes have been made, you can click Review Workspace.

Figure 6. Review Workspace

You will now be brought to the Build Screen that forms part of the Workspace submission process.

Note: If you want to make changes to multiple Studios with the same Workspace, do not click Review Workspace at Step 4. Return to the Studios home screen and repeat Steps 1-3, selecting the same Workspace for each Studio you want to configure.

Creating a New Studio

A new Studio will add a custom network feature to your Studio Suite, which you can then configure by defining its inputs. When creating a new Studio, you select these inputs and build its interface with the use of Schema.

Click the Workspace menu and select the Workspace you want to use to create the new Studio.

Figure 7. Select Workspace
Click the New Studio button in the header.

Figure 8. Create New Studio
The Edit screen is displayed. You must enter a name and description for the new Studio.
After providing the Studio a name and description, you can configure the data that the Studio will collect as inputs. First click Schema then click Add Root Input.

Figure 9. Add Root Input
Select one of the inputs to configure a variable of the Studio from the section labelled Add New Input.For an explanation of schema inputs, see Input Types.

Figure 10. Add New Input

Note: You can configure the Schema input as a CLI configuration by using the Template function once you have created the new input with Schema.
Once all the changes have been made, click Review Workspace to begin the build process. Once that is completed, the Studio will appear in your Studio Suite.

Submitting a Workspace

Click the Review Workspace button in the header.

Figure 11. Review Workspace
The Workspace will be automatically built for submission, which includes input validation, compiling the configuration, and the validation of the configuration. On the Build screen, you will be able to review the proposed configuration changes.

Note: The Workspace is automatically built only for the first time that you click Review Workspace. Any subsequent changes made after that will require that you re-build the Workspace by clicking Build.
Once satisfied, you can click Submit Workspace.

Figure 12. Submit Workspace
You will be presented with a modal that will bring you to Change Control.

Figure 13. Workspace Submitted

The relevant user will then be able to approve the Workspace, and its configuration will then become part of the mainline configuration of your network.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Studio Elements and Functions

To make the most of Studios, you will need to know a little more about the tools you have control over. This section explains the full use of the different components that make up the Studios interface, which all either form a part of or enhance the workflows.

For more information, refer to:

Reviewing a Workspace

The Workspace build screen appears after you have clicked Review Workspace. It provides you with important information on the Workspace’s configuration before submitting to Change Control for approval.

There are several elements in the screen.

For more information, refer to:

Build Progress

The most important element for indicating if there are any problems with the Workspace configuration is the Build Progress section. It shows you if the Workspace configuration contains any conflicts and if device configlets have been compiled correctly. It is composed of three components:

Input Validation: Checks whether the values of the inputs follow the schema rules.
Configlet Compilation: Identifies any coding errors.
Config Validation: Determines whether the affected devices can support the proposed configuration.

By clicking View Build Details, you can see each of these components for the individual devices that the configuration affects.

This shows you the build progress for each device, and it helps you identify the devices the build progress has failed on.

Workspace Summary

The Workspace Summary table provides a brief overview of the type of modifications that a Workspace will make.

On the left-hand side, you can see each of the Studios that the configuration affects. On the right is displayed the type of change that has been made with the Workspace. By clicking on the type of configuration change, you will be brought to the screen in which that change was implemented.

Click View All Modification Details, to view all the configuration changes displayed together in the manner of Schema inputs.

Proposed Configuration Changes

Review the Proposed Configuration Changes to compare the Workspace configuration changes with what currently exists in the network.

This is shown for each individual device, and clicking on the device name will show you its proposed configuration.

Figure 5. Proposed Configuration - Compare

On the left are your proposed changes and on the right is the existing configuration. It is color-coded for easy reference:

Green = additions
Blue = modifications
Red = deletion

Schema

Schema are the input variables of a Studio and are used to collect data from a CloudVision User. They are defined when either Creating a New Studio or editing an existing Studio. You do this by selecting an input type in the Studio Edit screen and then completing a form.

For more information, refer to:

Editing a Studio Schema

Only custom Studios can be edited.

Note: Built-in Studio schemas cannot be edited.

To edit a custom Studio Schema, create a new Workspace or select an open Workspace and then click the Edit button within a Studio.

At the Studio Edit screen, you can select Schema and the process will be the same as creating a new Studio.

Note: While you cannot edit built-in Studios, you can export and then import the Studio as a clone that you can edit.

Input Types

Schema inputs can be broadly classified into two categories:Base Types and Container Types.

Base Types are inputs that hold a real value and have a defined format. In general, these inputs can be validated to ensure that their value matches the defined format. You can also add constraints that restrict the values that can be entered in their fields.

Container Types are inputs that group one or more Base Types into a unit. They can be used to assign a set of inputs to a specific group of devices, allow a Studio to provide multiple values for a given input, or to group multiple Base Types and make them into an input unit.

Each input type is further divided into different data types:

Base Types consist of:

String
Integer
Float
Boolean

Container Types consist of:

Resolver
Collection
Group

You can find a full description of each data type in Appendix 2: Schema Input Types.

Template

Once you have defined an the variables for an input under Schema, you can use Template to convert the input into a CLI configuration. You can click on the input you want to configure, and then click Template.

For more information, refer to Mark-Up Language.

Mark-Up Language

You have a choice of two languages when writing a Template, Mako or Jinja2. The default setting is Mako, but you can select Jinja2 or change back to Mako by using the below toggle:

Both Mako and Jinja2 have a lightweight syntax that allows you to leverage the underlying Python of Studios to create an effective Template.

You can find a primer on Mako syntax here and for Jinja2 here. There is also a short guide for using Mako for Template in Appendix 1: Mako Syntax.

Importing and Exporting Studios

Studios are saved and distributed as .yaml files. The file contains the entire schema definition, template, and input values. You can easily import and export Studios using CloudVision.

Importing

Click Create Workspace or select an open Workspace from the dropdown menu.
Click Import.
Figure 16. Import
On the Import Studio modal, select the Studio file and then click Import.

The imported Studio will now be part of your Studio Suite.

Exporting

From your Studio Suite, select the Studio you wish to export.
Within the Studio screen, click Export.
Figure 17. Export
A pop-up box will appear, which will ask you the details for downloading the file. Enter the details and click Download or Save.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

About Users and Roles

Account management is based on users and roles. In the CloudVision Portal, users and roles have specific meaning.

About defeault roles, refer to Default Roles.


Users	A user is a person who uses the CVP application and is authenticated by the system through the use of account credentials (username and password). which is maintained by CVP or external enterprise servers. Only the users with account management module credentials (Account management administrator) can create and manage users. The account management administrator specifies the authentication credentials, name and contact information, status, and CVP permissions when creating user accounts for new users. Account management administrators control which CVP modules users are authorized to use by assigning roles to users (the role assignments can be changed as needed at any time). Note: Activity of CVP users is logged and can be viewed in the Audit Logs page.
Roles	A role is a set of read and write module permissions that defines user authorization to modules in CloudVision Portal. The account management administrator specifies the read and write permissions of each module when they create roles. Only account management administrators can create and manage roles. Roles enable account management administrators to efficiently manage user permissions by assigning roles to users, and by changing the role assigned to users. CloudVision Portal provides two default roles, one for the system administrator (network-admin) and one for a basic operator (network-operator).

Default Roles

CloudVision Portal provides two default roles. These default roles can be assigned to users as needed.


network-admin	A user with the default “network-admin” role has read and write permissions for all CVP modules. In addition, this role has both device-level write permissions and database-level write permissions.
network-operator	A user with the default “network-operator” role has only read permissions for all CVP modules. Users with this role cannot make changes to the CVP database.

Note: The read and write permissions cannot be changed for the default roles. But, custom roles can be created where read and write permissions can be modified.

For more information, see Managing User Accounts.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Managing User Accounts

The system uses the following functionalities to manage user accounts:

Adding New User Accounts

When you create a new user account, you specify the login information (authentication credentials) of a person that needs to use one or more CVP modules. Personal information for the new user account is optional and can be specified when you create the new user or at a later time.

By default, new user accounts are enabled. The new user is able to use the CVP modules they are permitted to use, based on the role assigned to them. If you do not want the new user to use CVP at this time, select the Disable option (a Status option). You can enable the user account at a later time.

Note: As an alternative to creating user accounts in CVP, you can point CVP to an external AAA server that automatically creates users and maps them to roles during first login.

Complete these steps to create a new user:

Navigate to the Access Control page.
Under Access Control in the left menu, click Users.

The Users page lists all current users.

Figure 1. Users Page
Click + New User at the upper right corner of the Users page.

The system pops-up the New User window.

Note: The New User pop-up window creates users only with the ‘Local’ authentication type.

Figure 2. New User Pop-Up Window
Provide the required information in corresponding fields.
Click Save.
The new user account is created.

Note: If the specified role is unavailable in the local CVP, then the network-operator role is automatically assigned to either the RADIUS or TACACS user. Unless you set the account status to disabled, the new user is active using CVP modules based on the role assigned to the user. If user roles conflict when multiple roles are assigned to a user account, the user role with higher privileges is applied to the user account.

Related topics:

Modifying User Accounts

Modifying user accounts enables you to change the following aspects of existing user accounts:

Login information (password)
Contact information (email address)
Status (enabled or disabled)
Role(s) (the CVP role(s) assigned to the user)
Personal information (first and last names)

Note: Once changes are saved, they are implemented immediately.

Complete these steps to modify a user account.

Navigate to the Access Control page.
Under Access Control, click Users.
In the Users page, click the edit icon available next to the corresponding user name.

The system pops-up the Edit User window displaying all information related to the corresponding user.

Figure 3. Edit User Pop-Up Window
Modify the required information.
Click Save.
Related Topics:

Removing User Accounts

Complete these steps to remove a user account:

Navigate to the Access Control page.
Under Access Control in the left, click Users.

The Users page appears displays all current user accounts.
Select the users for removal.
Click Remove User/Remove Users at the upper right corner of the Users page.

The system prompts to confirm deletion.

Figure 4. Remove User Account
Click Delete.
The system deletes selected user accounts.

Related Topics:

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Managing User Roles

The system uses the following functionalities to manage user roles:

Adding New User Roles

CloudVision Portal enables you to create new roles as needed to ensure that you are able to efficiently manage CVP user permissions. When you create a new role, you specify the read and write permissions for each CVP module.

Once a role has been created, it is automatically added to the list of Available roles, and you can assign it to users that should have the permissions defined in the role. When you assign the role to a user, they inherit the read and write permissions defined in the role.

Complete the following steps to create new roles:

Navigate to the Access Control page.
Under Access Control in the left menu, click Roles.

The Roles page lists all current roles.

Figure 1. Roles Page
Click + New Role at the upper right corner of the Roles page.

The system pops-up the New Role window.

Figure 2. New Role Pop-Up Window
Provide the required information in corresponding fields.
Click Save.

The new role is saved to the CVP database and is available to be assigned to users.

Note: The roles created can be assigned to locally created users or by the external AAA server to its known users.
Related topics:

Modifying User Roles

CloudVision Portal provides the functionality required to change the permissions of an existing role. This enables you to efficiently change the permissions of all users that are assigned the role. After you modify the role, all users assigned the role inherit the read and write permissions defined in the new version of the role.

Complete the following steps to modify an existing role:

Navigate to the Access Control page.
Under in the left menu, click Roles.
In the Roles page, click the edit icon available next to the corresponding role name.

The system pops-up the Edit Role window displaying all information related to the corresponding role.

Figure 3. Edit Role Pop-Up Window
Modify the required Information.
Click Save.
The new version of the role is saved to the CVP database.

Note: All users assigned the role inherit the read and write permissions defined in the new version of the role.

Related topics:

Removing User Roles

Complete these steps to remove a user role:

Navigate to the Access Control page.
Under Access Control in the left menu, click Roles.

The Roles page lists all current user roles.
Select the required user roles for removal.
Click Remove Role/Remove Roles at the upper right corner of the Roles page.

The system prompts to confirm removal.

Figure 4. Remove User Role
Click Delete.
The system deletes selected user roles.

Note: A role assigned to user(s) cannot be deleted.

Related topics:

Roles Mapping from SAML to CloudVision

Creating an attribute for your SAML provider allows you to pass CloudVision roles from the corresponding identity provider to CloudVision. This allows CloudVision user accounts to be automatically created with these roles when a new user logs in with that provider.

To use this feature, the Allow Roles Mapping with Providers toggle must be enabled in General Settings. Roles mapping can be set up for a new or existing SAML identity provider. You will need to configure attributes in the identity provider and then add the corresponding provider to CloudVision or edit the provider if it is already connected to CloudVision.

Mapping Roles

To map roles from a SAML provider, you need to configure a custom attribute for CloudVision roles and enter the details in Providers.

Register CloudVision with a SAML provider or reconfigure an existing SAML provider.
Create a custom field that lists CloudVision roles in the SAML provider’s user profiles.

Tip: User profiles contain information such as first name, last name, email, phone number, and other fields.

Note: CloudVision role names must be entered exactly as they appear in CloudVision, for instance network-operator, network-admin, no-access.
Assign a role to a user in the SAML provider.

Note: To enable mapping provider roles to CloudVision roles, extra steps are required to create a custom attribute. The created attribute name can be anything, but cv_roles is a recommended default. CloudVision requires the Roles Attribute Name to be an array of strings.
Enable the Allow Roles Mapping with Providers toggle in General Settings.
Add the SAML provider to CloudVision or edit the provider if it has already been added.
In Providers, enter the attribute name that was created for the SAML provider in the Roles Attribute Name field and fill in the Username Attribute Name field.
The Username Attribute Name allows you to map usernames from the SAML provider to CloudVision by specifying how the provider identifies the username in the SAML assertion. For most providers, this will be user or username.

Note: When mapping roles from Launchpad to CloudVision, you will also need to enter an Organization Attribute Name.

New users signing in with that identity provider will have their CloudVision user account automatically created and the roles defined in the corresponding SAML provider automatically assigned to them.

Action Execution Permission

The role permission, Action Execution, is available to control the execution of custom actions when they are run in isolation, such as via Studio Autofill actions and standalone executions in the Action editor. A custom action is a user-created action that has either been installed via a package or has been created using python script and arguments.

The Action Management and Action Execution permissions must be set to Read & Write for a user to modify and execute a custom action via standalone execution or using the Studio Autofill actions.

Note: Due to existing role-based access control permissions for Change Control and Studios, the Action Execution Permission does not limit any functionality in those workflows.

Enabling Action Execution Permission

To enable the Action Execution permission,

Navigate to Settings > Roles
Select a role.
Under Provisioning, select a permission level for Action Execution.
There are three permissions:
- No Access: The user will not be able to execute custom actions in isolation
- Read Only: The user will be able to access details of previous executions and their associated logs via rAPIs.
- Read and Write: The user will be able to execute custom actions executed in isolation .
Click Save.Users assigned with the selected role will have their permissions updated.

Note: If Action Execution is set to Read and Write or Read Only, Action Management must also be set to at least Read Only.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Service Accounts

The service accounts in CloudVision access APIs in a controlled manner. You must create authentication tokens for service accounts to validate APIs.

To access the Service Accounts screen, navigate to the Settings screen (Click the gear icon at the upper right corner of the screen) > Access Control > Service Accounts.

The Service Accounts screen provides brief information of all service accounts in a tabular format. See the figure below.

Note: The red exclamation mark on service accounts indicates expired tokens. Hovering the cursor on the red exclamation mark displays the count of expired tokens.

You can perform the following tasks from this screen:

Adding Service Accounts

Perform the following steps to add a service account:

On the Service Accounts screen, click + Add Service Account.
The system displays the Add Service Account screen.
Figure 2. Add Service Account Screen
Type the service account name and description in respective fields.
Select preferred roles (optional) and status from respective dropdown menus.
Note:
- Enabled service accounts must have one or more roles assigned to it.
- Disabled service accounts may not have any roles assigned to it.
Click Save.

Note: If the Service Accounts screen does not display the new service account, Click Refresh.

Editing Service Accounts

Perform the following steps to edit a service account:

On the Service Accounts screen, click the required service account listed in the table.
CVP opens the Edit Service Account: service_name screen.
Figure 3. Edit Service Account Screen

Note: Alternatively, select the checkbox of required service account and click + Add Token to Service Account.
Update required changes in the Description field, Roles dropdown and Status dropdown.
Note:
- Enabled service accounts must have one or more roles assigned to it.
- Disabled service accounts may not have any roles assigned to it.
Click Save.

Adding Tokens to Service Accounts

Perform the following steps to create a token for service accounts:

On the Service Accounts screen, click the required service account listed in the table.
CVP opens the Edit Service Account: service_name screen.
Note: Alternatively, select the checkbox of required service account and click + Add Token to Service Account.
Under Generate Service Account Token, type brief summary in the Description field.
See the figure below.
Figure 4. Generate Service Account Token
Click Pick Time and select the expiry date.

Note: The maximum duration for validity is one year.
Click Generate.

Note: If the table under Current Service Account Tokens does not display the new token, click Refresh. The new token gets access to APIs based on roles selected for the service account.

Deleting Service Account Tokens

Perform the following steps to delete a service account:

On the Service Accounts screen, click the required service account listed in the table.
CVP opens the Edit Service Account: service_name screen. Tokens associated to this service accounts are listed in the table under Current Service Account Tokens.
Note: Alternatively, select the checkbox of the required service account and click + Add Token to Service Account.
Select token(s) to be deleted.
Click Remove Token(s).
See the figure below.
Figure 5. Delete Service Account Tokens

CVP prompts to confirm the initiated task.
Click Remove on the confirmation box.
See the figure below.
Figure 6. CVP Confirmation to Delete Tokens
Click Save.
Note:
- If the table continues to display deleted token(s), click Refresh.
- To simultaneously delete all expired tokens across all service accounts, click Remove all Expired tokens (n) on the Service Accounts screen where n stands for the number of expired tokens.

The configuration guide is no longer being updated. Please refer to the CloudVision Help Center going forward.

Viewing Activity Logs

The Audit Logs page displays activity logs of user accounts and user roles.

Complete these steps to view activity logs:

Click the gear icon at the upper right corner of the CVP page.
Click Audit Logs on the left menu.

The system displays the Audit Logs page.
Select desired options from View logs for drop-down menus.

The system displays corresponding logs.

Figure 1. Audit Logs Page

Page 5 of 19

End of Support

CloudVision Studios

Requirements

Features

Known Limitations

Getting Started with Studios

Studio

Workspace

Accessing Studios

Per-Studio Role Based Access Control

Role Permissions

Enabling and Accessing Per-Studio Permissions

Enabling Per-Studio Permissions

Accessing Per-Studio Permissions

Configuring Permissions for Studios Role Based Access Control

Updating Workspace Permissions

Workflow Overview

Commissioning Devices for Use in Studios

Creating a Workspace

Configuring an Existing Studio

Creating a New Studio

Submitting a Workspace

Studio Elements and Functions

Reviewing a Workspace

Build Progress

Workspace Summary

Proposed Configuration Changes

Tags

User Tags and System Tags

Creating Tags

Applying Tags in Studios

Resolver Input

Studio Tag Assignment

Schema

Editing a Studio Schema

Input Types

Template

Mark-Up Language

Importing and Exporting Studios

Importing

Exporting

About Users and Roles

Default Roles

Managing User Accounts

Adding New User Accounts

Modifying User Accounts

Removing User Accounts

Managing User Roles

Adding New User Roles

Modifying User Roles

Removing User Roles

Roles Mapping from SAML to CloudVision

Mapping Roles

Action Execution Permission

Enabling Action Execution Permission

Service Accounts

Adding Service Accounts

Editing Service Accounts

Adding Tokens to Service Accounts

Deleting Service Account Tokens

Viewing Activity Logs