Re: [PATCH pve-network 5/9] fix #7294: sdn: register api formats for zones and vnets

[Gabriel Goller <g.goller@proxmox.com>]

On 2026-06-12 14:51 +0200, David Riley wrote:
> Thanks for the feedback.
> 
> The intention behind adding this segment to the ACL path is to allow
> for fine-grained, hierarchical permission scoping, not to couple the
> ACL system to specific VNet properties.
> 
> I used vlan as a placeholder for 'tag', but in retrospect, the naming
> is a bit confusing, and I'm happy to adapt this in a v2.
> 
>  From a permission perspective, including the tag in the path makes
> sense, as it allows us to restrict pool users to a specific VNet and
> tag combination.

Maybe I'm a bit dim, but you mean the VNet tag right -- so the tag I configure
on each VNet?

> So if you have a pool with a VM, storage and VNet + Tag and assign the
> pool permissions: PVEVMAdmin, PVESDNUser
> 
> The user can fully manage this VM, including adding a new NIC, but
> they can only add it using the exact VNet + Tag combination. Just
> adding the VNet would not work.

How is this different than just adding the VNet? Will this restrict the user
from adding another vlan tag on the VM (when using vlanaware vnets)? Is this
just to prevent the user from editing the VNet tag?

> Let me know if this makes sense.
> 
> [snip]