From: Hannes Laimer <h.laimer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH pve-manager v3 41/45] ui: sdn: microseg: add a guest tab with its groups and rules
Date: Tue, 27 Oct 2026 09:55:23 +0100 [thread overview]
Message-ID: <20261027085527.702738-42-h.laimer@proxmox.com> (raw)
In-Reply-To: <20261027085527.702738-1-h.laimer@proxmox.com>
The tab lists each assigned NIC with its assignment and groups, and
below that the rules that apply to the guest. They are grouped by
direction instead of by priority as in the SDN panel, since for a
single guest the direction matters more. Editing stays in the SDN
panel.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
www/manager6/Makefile | 1 +
www/manager6/lxc/Config.js | 10 ++
www/manager6/qemu/Config.js | 10 ++
www/manager6/sdn/microseg/Base.js | 41 +++++----
www/manager6/sdn/microseg/GuestPanel.js | 117 ++++++++++++++++++++++++
www/manager6/sdn/microseg/RuleView.js | 40 ++++++--
6 files changed, 195 insertions(+), 24 deletions(-)
create mode 100644 www/manager6/sdn/microseg/GuestPanel.js
diff --git a/www/manager6/Makefile b/www/manager6/Makefile
index 7c48b0622aa7..1f429fb20bdf 100644
--- a/www/manager6/Makefile
+++ b/www/manager6/Makefile
@@ -366,6 +366,7 @@ JSSRC= \
sdn/microseg/AssignmentEdit.js \
sdn/microseg/RuleView.js \
sdn/microseg/AssignmentView.js \
+ sdn/microseg/GuestPanel.js \
storage/ContentView.js \
storage/BackupView.js \
storage/Base.js \
diff --git a/www/manager6/lxc/Config.js b/www/manager6/lxc/Config.js
index 3a99d6a71dec..d14bfa244958 100644
--- a/www/manager6/lxc/Config.js
+++ b/www/manager6/lxc/Config.js
@@ -387,6 +387,16 @@ Ext.define('PVE.lxc.Config', {
});
}
+ if (caps.vms['VM.Audit'] && caps.sdn['SDN.Audit']) {
+ me.items.push({
+ xtype: 'pveSDNMicrosegGuest',
+ title: gettext('Microsegmentation'),
+ iconCls: 'fa fa-tags',
+ itemId: 'microseg',
+ vmid: vmid,
+ });
+ }
+
if (caps.vms['Permissions.Modify']) {
me.items.push({
xtype: 'pveACLView',
diff --git a/www/manager6/qemu/Config.js b/www/manager6/qemu/Config.js
index 842d35de1202..7d7b17bfa870 100644
--- a/www/manager6/qemu/Config.js
+++ b/www/manager6/qemu/Config.js
@@ -440,6 +440,16 @@ Ext.define('PVE.qemu.Config', {
});
}
+ if (caps.vms['VM.Audit'] && caps.sdn['SDN.Audit']) {
+ me.items.push({
+ xtype: 'pveSDNMicrosegGuest',
+ title: gettext('Microsegmentation'),
+ iconCls: 'fa fa-tags',
+ itemId: 'microseg',
+ vmid: vmid,
+ });
+ }
+
if (caps.vms['Permissions.Modify']) {
me.items.push({
xtype: 'pveACLView',
diff --git a/www/manager6/sdn/microseg/Base.js b/www/manager6/sdn/microseg/Base.js
index 02c176b04f5c..327a49b49aad 100644
--- a/www/manager6/sdn/microseg/Base.js
+++ b/www/manager6/sdn/microseg/Base.js
@@ -134,6 +134,7 @@ Ext.define('PVE.sdn.microseg.Membership', {
closedGroups: hierarchy.close(sortedGroups),
rules: rulesFor([sortedGroups]),
note: PVE.Utils.format_sdnmicroseg_matcher(a),
+ assignment: a,
};
(a.members || []).forEach((m) => {
m.nics.forEach((nic) => {
@@ -223,33 +224,37 @@ Ext.define('PVE.sdn.microseg.BaseGrid', {
me.openEdit(rec.data.type, rec.data.id, me.editPanelConfig?.(rec));
};
+ let editButtons = me.readOnly
+ ? []
+ : [
+ me.addButton,
+ new Proxmox.button.Button({
+ text: gettext('Edit'),
+ disabled: true,
+ selModel: sm,
+ enableFn: editable,
+ handler: runEditor,
+ }),
+ Ext.create('Proxmox.button.StdRemoveButton', {
+ selModel: sm,
+ enableFn: editable,
+ baseurl: me.baseurl,
+ getRecordName: me.getRecordName,
+ callback: () => me.reload(),
+ }),
+ ];
+
Ext.apply(me, {
selModel: sm,
tbar: [
- me.addButton,
- new Proxmox.button.Button({
- text: gettext('Edit'),
- disabled: true,
- selModel: sm,
- enableFn: editable,
- handler: runEditor,
- }),
- Ext.create('Proxmox.button.StdRemoveButton', {
- selModel: sm,
- enableFn: editable,
- baseurl: me.baseurl,
- getRecordName: me.getRecordName,
- callback: () => me.reload(),
- }),
+ ...editButtons,
{
text: gettext('Reload'),
handler: () => me.reload(),
},
...(me.tbar ?? []),
],
- listeners: {
- itemdblclick: runEditor,
- },
+ listeners: me.readOnly ? {} : { itemdblclick: runEditor },
});
me.callParent();
diff --git a/www/manager6/sdn/microseg/GuestPanel.js b/www/manager6/sdn/microseg/GuestPanel.js
new file mode 100644
index 000000000000..657fa4d1fbc7
--- /dev/null
+++ b/www/manager6/sdn/microseg/GuestPanel.js
@@ -0,0 +1,117 @@
+Ext.define('PVE.sdn.microseg.GuestPanel', {
+ extend: 'Ext.panel.Panel',
+ alias: 'widget.pveSDNMicrosegGuest',
+
+ onlineHelp: 'pvesdn_config_microseg',
+
+ layout: 'border',
+
+ controller: {
+ xclass: 'Ext.app.ViewController',
+
+ reload: function () {
+ let me = this;
+ let view = me.getView();
+ let membership = PVE.sdn.microseg.Membership;
+ membership.load(view, (parts) => {
+ let hierarchy = membership.hierarchy(parts.groups);
+ let rulesFor = membership.rulesFor(parts.groupSets);
+ let nicGroupSet = membership.nicGroupSets(parts.assignments, hierarchy, rulesFor);
+ let prefix = `${view.vmid}/`;
+ let nics = Object.entries(nicGroupSet)
+ .filter(([key]) => key.startsWith(prefix))
+ .map(([key, groupSet]) => ({
+ nic: Number(key.slice(prefix.length)),
+ groups: groupSet.groups,
+ matcher: groupSet.note,
+ comment: groupSet.assignment.comment,
+ state: groupSet.assignment.state,
+ }))
+ .sort((a, b) => a.nic - b.nic);
+ me.lookup('nics').getStore().loadData(nics);
+
+ let rulesView = me.lookup('rules');
+ rulesView.setData(parts.rules);
+ rulesView.setTreeSelection(
+ membership.guestSelection(view.vmid, nicGroupSet, hierarchy, rulesFor),
+ );
+ });
+ },
+ },
+
+ initComponent: function () {
+ let me = this;
+
+ if (!me.vmid) {
+ throw 'no vmid given';
+ }
+
+ me.items = [
+ {
+ xtype: 'grid',
+ reference: 'nics',
+ region: 'north',
+ height: 150,
+ split: true,
+ border: false,
+ store: {
+ fields: ['nic', 'groups', 'matcher', 'comment', 'state'],
+ sorters: [{ property: 'nic', direction: 'ASC' }],
+ },
+ viewConfig: {
+ getRowClass: PVE.Utils.sdnmicroseg_row_cls,
+ },
+ emptyText: gettext('No assignment covers this guest'),
+ tbar: [
+ {
+ text: gettext('Reload'),
+ handler: 'reload',
+ },
+ ],
+ columns: [
+ {
+ text: gettext('Interface'),
+ dataIndex: 'nic',
+ width: 100,
+ renderer: (v) => `net${v}`,
+ },
+ {
+ text: gettext('Groups'),
+ dataIndex: 'groups',
+ flex: 2,
+ renderer: (v) => (v || []).map(PVE.Utils.render_sdnmicroseg_group).join(''),
+ },
+ {
+ text: gettext('Assignment'),
+ dataIndex: 'matcher',
+ flex: 1,
+ renderer: Ext.String.htmlEncode,
+ },
+ { xtype: 'pveSDNMicrosegStateColumn' },
+ {
+ text: gettext('Comment'),
+ dataIndex: 'comment',
+ flex: 1,
+ renderer: Ext.String.htmlEncode,
+ },
+ ],
+ },
+ {
+ xtype: 'pveSDNMicrosegRules',
+ reference: 'rules',
+ region: 'center',
+ readOnly: true,
+ groupByDirection: true,
+ listeners: {
+ microsegreload: 'reload',
+ },
+ },
+ ];
+
+ me.callParent();
+ },
+
+ listeners: {
+ activate: 'reload',
+ },
+});
diff --git a/www/manager6/sdn/microseg/RuleView.js b/www/manager6/sdn/microseg/RuleView.js
index 95c08343e725..8c982a7bc5aa 100644
--- a/www/manager6/sdn/microseg/RuleView.js
+++ b/www/manager6/sdn/microseg/RuleView.js
@@ -38,13 +38,15 @@ Ext.define(
let matched = sel
? [...new Set([...src, ...dst])].filter((g) => sel.groups.has(g))
: [];
+ let direction = out && inbound ? 'both' : out ? 'out' : inbound ? 'in' : '';
return {
rank: me.rankOf(data),
specificity: data.specificity ?? 0,
matched: matched
.sort()
.map((g) => (sel.ownGroups.has(g) ? g : `${g} (${gettext('inherited')})`)),
- direction: out && inbound ? 'both' : out ? 'out' : inbound ? 'in' : '',
+ direction: direction,
+ directionRank: { in: 0, out: 1, both: 2 }[direction] ?? 3,
};
},
@@ -95,13 +97,32 @@ Ext.define(
initComponent: function () {
let me = this;
+ if (me.groupByDirection) {
+ let directionNames = {
+ in: gettext('Inbound'),
+ out: gettext('Outbound'),
+ both: gettext('Both'),
+ };
+ me.features = [
+ {
+ ftype: 'grouping',
+ groupHeaderTpl: [
+ '{groupValue:this.directionName}',
+ {
+ directionName: (name) =>
+ Ext.String.htmlEncode(directionNames[name] ?? name),
+ },
+ ],
+ enableGroupingMenu: false,
+ },
+ ];
+ }
+
let store = Ext.create('Ext.data.Store', {
model: 'pve-sdn-microseg-rule',
- grouper: {
- property: 'prio',
- sortProperty: 'prio',
- direction: 'DESC',
- },
+ grouper: me.groupByDirection
+ ? { property: 'direction', sortProperty: 'directionRank', direction: 'ASC' }
+ : { property: 'prio', sortProperty: 'prio', direction: 'DESC' },
sorters: [
{ property: 'rank', direction: 'ASC' },
{ property: 'id', direction: 'ASC' },
@@ -234,6 +255,12 @@ Ext.define(
flex: 1,
renderer: (v, m, rec) => Ext.String.htmlEncode(matchText(rec)),
},
+ {
+ text: gettext('Priority'),
+ dataIndex: 'prio',
+ width: 80,
+ hidden: !me.groupByDirection,
+ },
{
text: gettext('Specificity'),
dataIndex: 'specificity',
@@ -301,6 +328,7 @@ Ext.define(
'macro',
'fragments',
'direction',
+ 'directionRank',
'rank',
'specificity',
'matched',
--
2.47.3
next prev parent reply other threads:[~2026-10-27 9:02 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 8:54 [PATCH access-control/cluster/container/docs/manager/network/proxmox{-ebpf,-ve-rs,-perl-rs}/qemu-server v3 00/45] sdn: add microsegmentation support Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 01/45] build: keep the build directory out of the BPF objects Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 02/45] policy: add the enforcement subsystem for guest interfaces Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 03/45] policy: add a check for non-first fragments Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 04/45] ve-config: firewall: add a constructor for sctp matches Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 05/45] ve-config: sdn: microseg: add identity allocation for group sets Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 06/45] ve-config: sdn: microseg: add config types Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 07/45] ve-config: sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 08/45] ve-config: sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 09/45] ve-config: sdn: microseg: narrow rules by protocol and ports Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 10/45] ve-config: sdn: microseg: add group hierarchy Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 11/45] ve-config: firewall: expose protocol, icmp type and code numbers Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 12/45] ve-config: sdn: microseg: add the desired state Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 13/45] microseg: add a crate that applies the policy to a node's guest NICs Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 14/45] microseg: add a rule option that matches non-first fragments Hannes Laimer
2026-10-27 8:54 ` [PATCH pve-cluster v3 15/45] cfs: add 'sdn/microseg.cfg' to observed files Hannes Laimer
2026-10-27 8:54 ` [PATCH pve-access-control v3 16/45] permissions: add ACL path for SDN microsegmentation Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-perl-rs v3 17/45] pve-rs: sdn: add microseg config binding Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 18/45] pve-rs: sdn: microseg: bind the data plane Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 19/45] pve-rs: sdn: microseg: check the data plane limits on render Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 20/45] pve-rs: debian: fire the pve-microseg-update trigger on upgrade Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 21/45] sdn: zones: add vxlan-gbp option to vxlan and evpn zones Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 22/45] sdn: microseg: add config, API and guest inventory Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 23/45] sdn: dry-run: show pending microseg changes Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 24/45] sdn: microseg: enforce the policy on guest NICs Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 25/45] sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 26/45] sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 27/45] sdn: microseg: add an update for a running NIC Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 28/45] sdn: microseg: expose protocol, port and macro rule options Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 29/45] sdn: microseg: allow nesting groups under a parent Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 30/45] sdn: microseg: expose the fragments rule option Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 31/45] network: apply the microseg policy on reload Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 32/45] pve-sdn-commit: apply the microseg policy at boot Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 33/45] ui: sdn: zones: add vxlan-gbp checkbox to vxlan and evpn Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 34/45] ui: sdn: add microsegmentation panel Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 35/45] ui: sdn: dry-run: show pending microseg diff Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 36/45] ui: sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 37/45] ui: sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 38/45] ui: sdn: microseg: add narrowing to the rule form Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 39/45] ui: sdn: microseg: show and edit the group hierarchy Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 40/45] ui: sdn: microseg: add fragments option to the rule form Hannes Laimer
2026-10-27 8:55 ` Hannes Laimer [this message]
2026-10-27 8:55 ` [PATCH qemu-server v3 42/45] network: update the microseg enforcement on a tag or name change Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-container v3 43/45] lxc: update the microseg enforcement on a tag or hostname change Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-docs v3 44/45] sdn: zones: document the VXLAN-GBP option Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-docs v3 45/45] sdn: add microsegmentation section Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027085527.702738-42-h.laimer@proxmox.com \
--to=h.laimer@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox