From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 8765A1FF0E6 for ; Fri, 24 Jul 2026 16:26:40 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id BC448214CD; Fri, 24 Jul 2026 16:26:39 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH access-control/cluster/common/manager/network/proxmox-widget-toolkit/qemu-server v3 00/12] fix #7294: pool: add SDN VNets as pool members Date: Fri, 24 Jul 2026 16:25:16 +0200 Message-ID: <20260724142528.109453-1-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784903132187 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.104 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: XQUILPJV2PXTAHWJFQ745ELDJ45447KV X-Message-ID-Hash: XQUILPJV2PXTAHWJFQ745ELDJ45447KV X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Thanks @Daniel K. for the thorough review. This series depends on the v6 'fix #7520: sdn: prune orphaned ACLs and handle VNet migrations' [1]. Maintainer Note: This patch requires version bumps: * qemu-server: move functions to pve-common * pve-cluster: introduce cluster wide version check that relies on functions that are moved from qemu-server to pve-common * pve-manager: use cluster wide version check * pve-access-control: extend pool configuration, which needs to be gatekept Please ensure these dependency versions are bumped accordingly. --- Differences from v2: - Add/Improve: Instead of allowing full vnet access (tagged and untagged using the base path 'sdn/zones//' there is now an explicit path for this 'sdn/zones///*' this allows access to untagged and tagged traffic of this specific vnet. In the WebUI this is reflected by a 'propagate' flag. Using just 'sdn/zones//' only allows for untagged use of this vnet, so trying to add a NIC with tag 1 will fail. Thanks @Daniel K. for the great suggestion! - Refactor: migrate vnet zone in pool. Passing in a array of path strings instead of each single path. This avoids locking the user.cfg for each path. Passing in strings because the underlying patch series was adapted. [1] - Refactor: remove vnet from pool. Similar to migrations this now also gets passed an array of path strings and only locks the configuration once. - Reorder: patches to improve the review flow - Remove: #7294 from unrelated commits - Fix: various nits - Add: maintainer note about bumping the version to ensure the gatekeeper for this feature works properly Differences from v1: - Access: Fix permissions propagation. Pool ACL paths are setup without propagation, therefore checking /sdn/zones/// fails even if the user has the permission for the base path /sdn/zones//. To allow this, the roles of the base VNet path are looked up if the exact tagged path is not found in the pool (see patch 5/9). - API: Add a unified property string format for VNets (zone=,vnet=,tag=]), ensuring that zone and vnet are strictly required and coupled. - API CLI: Add typetext to the vnet format for better error messages in the CLI - API: The registered format validation for VNets and Zones now also check the length. - API: Add membership checks for network resources during add/delete operations (matching storage/VM behavior). - Relocated version helpers from PVE::Cluster to PVE::Tools - UI: Fix light mode. The icons are now light grey to match the storage and vm icons. - Series is now based on v4 instead of v3 of [1] - Minor refactors === Original Cover Letter === This series implements support for adding SDN VNets to resource pools, resolving #7294 [0]. This series depends on the v4 'fix #7520: sdn: prune orphaned ACLs and handle VNet migrations' [1]. It does not, however, add zones as pool members as requested in #7294. Zones currently share ACL paths for managing the zone itself and allocating VNets within it. This makes self-service VNet management without also granting zone management (and its associated side-effects) difficult. This patch series extends the pool section in the user.cfg and introduces a new network property to the pool configuration which will hold VNet entries: * vnet// * vnet/// The type prefix allows future extension to other network resource types. To prevent potential data loss from overwriting newly added VNets, a cluster-version check is added which ensures all nodes are running a version that supports this feature. Note: The hardcoded version guard should be updated to match the final target release when being applied. The existing version check helpers were moved from `qemu-server` to a new module within `pve-cluster` to make them available for this implementation, and any future developments that require gatekeeping. Appropriate attribution has been included for the relocated code. Please let me know if this organizational move aligns with current design preferences or additional adjustments are needed. [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7294 [1] https://lore.proxmox.com/pve-devel/20260716104247.29047-1-d.riley@proxmox.com/ pve-common: David Riley (1): tools: add helpers for version comparison src/PVE/Tools.pm | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) qemu-server: David Riley (1): helpers: drop local version helpers in favor of pve-common src/PVE/QemuMigrate.pm | 3 ++- src/PVE/QemuServer/Helpers.pm | 42 ++--------------------------------- 2 files changed, 4 insertions(+), 41 deletions(-) pve-cluster: David Riley (1): cluster: helpers: add cluster-wide version assertion src/PVE/Cluster.pm | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) pve-access-control: David Riley (3): fix #7294: acl: pool: add SDN VNets as pool members fix #7294: acl: pool: add helpers to remove and migrate pool VNets readme: document SDN VNets as pool members README | 1 + src/PVE/AccessControl.pm | 131 ++++++++++++++++++++++++++++++++++++-- src/PVE/RPCEnvironment.pm | 75 +++++++++++++++++++++- src/test/parser_writer.pl | 53 ++++++++++++--- 4 files changed, 244 insertions(+), 16 deletions(-) pve-network: David Riley (2): sdn: register api formats for zones and vnets fix #7294: sdn: vnet: update pool members on vnet migration and deletion src/PVE/Network/SDN.pm | 6 ++++++ src/PVE/Network/SDN/VnetPlugin.pm | 26 +++++++++++++++++++++++--- src/PVE/Network/SDN/Zones/Plugin.pm | 26 +++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 6 deletions(-) pve-manager: David Riley (3): ui: replace var with let to match style guide for variable declaration fix #7294: api: pool: add SDN VNets as pool members fix #7294: ui: pool: add SDN VNets as pool members PVE/API2/Pool.pm | 152 ++++++++++++++++++++++++++- www/css/ext6-pve.css | 15 +++ www/manager6/Utils.js | 1 + www/manager6/grid/PoolMembers.js | 173 ++++++++++++++++++++++++++++--- 4 files changed, 322 insertions(+), 19 deletions(-) proxmox-widget-toolkit: David Riley (1): fix #7294: css: theme: add opacity override for pool VNet icon src/proxmox-dark/scss/other/_icons.scss | 12 ++++++++++++ 1 file changed, 12 insertions(+) Summary over all repositories: 16 files changed, 713 insertions(+), 83 deletions(-) -- Generated by murpp 0.11.0