F OpenNebula/one#7339 Add required vCenter permissions to documentation

content/software/migration_from_vmware/oneswap.md

@@ -33,6 +33,112 @@ Run `oneswap` on a dedicated server with sufficient disk space to buffer VM imag
 
 {{< image path="/images/oneswap/oneswap_architecture.svg" alt="Architecture of the OneSwap Migration Tool" align="center" width="90%" pb="20px" >}}
 
+## vCenter Permissions Requirements
+
+OneSwap requires specific vCenter permissions depending on the conversion mode used. Below are the required privileges for vCenter 8.
+
+### Minimum Permissions (All Conversion Modes)
+
+**Datastore**:
+- **Browse datastore** - Required to discover VMDK files and VM storage configuration
+- Used by: All conversion modes (standard virt-v2v, custom, hybrid, clone)
+
+**Network**:
+- **Assign network** - Required to read VM NIC configuration and network mappings
+- Used by: All conversion modes
+
+**Resource**:
+- **Assign virtual machine to resource pool** - Required to read VM placement and resource allocation
+- Used by: All conversion modes
+
+**Virtual machine > Change Configuration**:
+- **Change Settings** - Required to read VM hardware configuration (CPU, RAM, disks)
+- **Query unowned files** - Required to access VM configuration files
+- Used by: All conversion modes
+
+**Virtual machine > Edit Inventory**:
+- **Create from existing** - Required to read VM metadata and state
+- Used by: All conversion modes
+
+**Virtual machine > Guest operations**:
+- **Guest operation queries** - Required to read guest OS information, IP addresses, and installed tools
+- Used by: All conversion modes
+
+### Additional Permissions for Clone Mode (`--clone`)
+
+**Datastore**:
+- **Allocate space** - Required to provision storage for the cloned VM (thin provisioning)
+- Used by: `--clone` mode only
+
+**Folder**:
+- **Create folder** - **CRITICAL** - Required to create the cloned VM in the same folder as the original
+  - Without this permission, clone operations will fail with `FileLocked: Unable to access file since it is locked`
+- Used by: `--clone` mode only
+
+**Virtual machine > Edit Inventory**:
+- **Create new** - Required to create the cloned VM
+- **Remove** - Required to delete the clone after successful conversion
+- Used by: `--clone` mode only
+
+**Virtual machine > Provisioning**:
+- **Clone virtual machine** - Required to execute the CloneVM_Task operation
+- **Customize guest** - Required for VM customization during cloning
+- Used by: `--clone` mode only
+
+### Additional Permissions for Custom/Fallback/Hybrid Modes
+
+**Datastore**:
+- **Low level file operations** - Required to download VMDK files directly from datastores
+- Used by: `--custom`, `--fallback`, `--hybrid` modes
+
+### Permission Setup Example
+
+Create a custom role in vCenter 8:
+
+```
+Role Name: OneSwap-Standard
+Description: Minimum permissions for standard virt-v2v conversions
+
+Permissions:
+  - Datastore > Browse datastore
+  - Network > Assign network
+  - Resource > Assign virtual machine to resource pool
+  - Virtual machine > Change Configuration > Change Settings
+  - Virtual machine > Change Configuration > Query unowned files
+  - Virtual machine > Edit Inventory > Create from existing
+  - Virtual machine > Guest operations > Guest operation queries
+```
+
+For clone mode support, create an extended role:
+
+```
+Role Name: OneSwap-Clone
+Description: Permissions for clone-based conversions (zero production impact)
+
+Includes all permissions from OneSwap-Standard, plus:
+  - Datastore > Allocate space
+  - Folder > Create folder
+  - Virtual machine > Edit Inventory > Create new
+  - Virtual machine > Edit Inventory > Remove
+  - Virtual machine > Provisioning > Clone virtual machine
+  - Virtual machine > Provisioning > Customize guest
+```
+
+For download-based conversions (custom/fallback/hybrid):
+
+```
+Role Name: OneSwap-Download
+Description: Permissions for custom conversion modes
+
+Includes all permissions from OneSwap-Standard, plus:
+  - Datastore > Low level file operations
+```
+
+**Important Notes**:
+- Assign roles at vCenter root level with **"Propagate to children"** enabled
+- For `--clone` mode, the VM **must NOT have any snapshots** (remove all snapshots before cloning)
+- For `--delta` and `--esxi` modes, vCenter permissions are minimal as operations run via direct ESXi SSH
+
 ## Installation
 
 The package `opennebula-swap`, provided on the official repositories, provides the command `oneswap`.