Security mechanism for cluster C1

Last published : Jun 19, 2026
When the VBS daemon on C1 is started, it reads the contents of the configuration file on the host to determine the clusters that are allowed to communicate with C1. In this case, VBS A consists of C1 and C2. The VBS daemon determines that C2 can communicate with C1. Hence, it adds the cluster IDs of C1 and C2 to the access control file,$VBS_HOME/web/admin/.xprtlaccess.
\# cat /opt/VRTSvbs/web/admin/.xprtlaccess\<ClusterId of C1\>@vbs_domain@\<Name of VIOM CMS\>.vx:user<ClusterId of C2>@vbs_domain@<Name of VIOM CMS>.vx:user
If cluster C3 tries to communicate with C1, the VBS daemon on C1 looks up the access control file and disallows C3 from communicating with C1. Also, no external hosts or clusters can pretend to be one of C1 or C2 because they do not have the credential.
Assume that there is a reconfiguration of VBS A such that a service group which belongs to an outside cluster is now part of VBS A. The new configuration is deployed to cluster C1 and the VBS daemon updates the access control file to include the cluster ID of the outside cluster.