From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 3BB001FF13F for ; Thu, 07 May 2026 10:30:41 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 962DEEABF; Thu, 7 May 2026 10:30:37 +0200 (CEST) From: Thomas Lamprecht To: pdm-devel@lists.proxmox.com Subject: [PATCH datacenter-manager v2 7/8] docs: add subscription registry chapter Date: Thu, 7 May 2026 10:26:48 +0200 Message-ID: <20260507082943.2749725-8-t.lamprecht@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260507082943.2749725-1-t.lamprecht@proxmox.com> References: <20260507082943.2749725-1-t.lamprecht@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1778142489901 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.003 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: I2EDOYYI6WNT2AV5SVSPCKTTQ7Y5USKV X-Message-ID-Hash: I2EDOYYI6WNT2AV5SVSPCKTTQ7Y5USKV X-MailFrom: t.lamprecht@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Cover the new top-level feature: key pool, node status view, manual assignment versus auto-assign, the pending/apply/clear lifecycle, and the privilege model that gates mutation on per-remote resource privileges in addition to system-scope MODIFY. Signed-off-by: Thomas Lamprecht --- docs/index.rst | 1 + docs/subscription-registry.rst | 50 ++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 docs/subscription-registry.rst diff --git a/docs/index.rst b/docs/index.rst index 2fc8a5d..2aaf86e 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -27,6 +27,7 @@ in the section entitled "GNU Free Documentation License". remotes.rst automated-installations.rst views.rst + subscription-registry.rst access-control.rst sysadmin.rst faq.rst diff --git a/docs/subscription-registry.rst b/docs/subscription-registry.rst new file mode 100644 index 0000000..95c2cd4 --- /dev/null +++ b/docs/subscription-registry.rst @@ -0,0 +1,50 @@ +Subscription Registry +===================== + +The subscription registry maintains a central pool of Proxmox VE and Proxmox Backup Server +subscription keys and lets an administrator assign them to remote nodes from a single place, without +having to select and configure a key for all remote nodes individually. + +Key Pool +-------- + +The pool accepts Proxmox VE and Proxmox Backup Server keys; other key prefixes are rejected so that +a new product type is noticed instead of silently parking unusable entries. Each entry records its +origin and the optional remote node it has been assigned to. + +Keys can be added in bulk from the web interface or with the ``proxmox-datacenter-client +subscriptions add-keys`` command. The Add dialog takes multiple keys, separated by newlines or +commas, and validates the whole batch atomically. + +Node Status +----------- + +The Node Status panel shows the live subscription state of every node behind a configured remote +alongside any pending plan from the pool. Nodes that already hold a key the registry assigned appear +with the live level; nodes with a pending pool assignment show a clock icon until the change is +pushed to the remote. + +From this view an operator can clear a pending assignment or remove the key from the pool entirely, +which is convenient when a node is known to be wrong without first having to find the matching entry +on the key list. + +Assignment +---------- + +A key can be pinned to a single node manually. + +The Auto-Assign action proposes a plan that fills unsubscribed nodes from free pool keys. For +Proxmox VE, the smallest covering key by socket count is chosen, so a 4-socket key is not used on a +2-socket host while a larger host stays unsubscribed. + +The proposed plan can be inspected before it is applied. Apply Pending pushes the queued keys to +their target nodes; if a push fails the remaining queue is kept intact for retry. Clear Pending +drops the plan without touching any remote. + +Permissions +----------- + +Listing the pool and the node status view follows the regular audit privileges on each affected +remote. Mutating an assignment requires the matching resource privilege on the target remote in +addition to the system-scope MODIFY privilege, so an operator with global system access alone +cannot push keys to remotes they have no other authority on. -- 2.47.3