Re: [pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel <pve-devel@lists.proxmox.com>]

[-- Attachment #1: Type: message/rfc822, Size: 14819 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: Fiona Ebner <f.ebner@proxmox.com>, Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: RE: [pve-devel] Bug 2582 roadmap
Date: Fri, 20 Sep 2024 12:32:13 +0000
Message-ID: <IA0PR14MB676740F40B90FBABA72410E3936C2@IA0PR14MB6767.namprd14.prod.outlook.com>

Hi Fiona,

Thank you for helping me out and sorry for my late response.

The issue is that right now to work with PVE we have to do the following:

1) Connect via SSH to the PVE node and deploy a helper virtual machine (so that users don't have to do it manually)
2) Access the Proxmox VE API to perform other backup-related tasks (those that cannot be done via SSH)

In item #1 - the new VM deployment involved usage of root/sudo.

In item #2 - certain tasks that are performed via API also require root/sudo. We have managed to move those to the SSH part of the workflow, so now users can use one non-root account to perform all necessary operations (instead of using root or having to use two separate accounts).

We think that in future there might be a situation where we might need a superuser level of privileges while accessing the API, and there will be no workaround to move the operation to the SSH part of the workflow. This will result in forcing our joint users to use 'root' account again, which they hate to do and also deem as an not secure practice.

I hope that helps. If there is anything else what we could do from out side please let me know.

Thanks!

-----Original Message-----
From: Fiona Ebner <f.ebner@proxmox.com>
Sent: Friday, September 13, 2024 09:59
To: Proxmox VE development discussion
Cc: Pavel Tide
Subject: Re: [pve-devel] Bug 2582 roadmap

Hi Pavel,

Am 10.09.24 um 12:18 schrieb Pavel Tide via pve-devel:
> Hi Proxmox team,
>
> Would you provide any delivery estimates on this item?
> https://bugz/
> illa.proxmox.com%2Fshow_bug.cgi%3Fid%3D2582&data=05%7C02%7CPavel.TIde%
> 40veeam.com%7C9fbe3a27cdb746e4522e08dcd3c9f802%7Cba07baab431b49edadd7c
> bc3542f5140%7C1%7C0%7C638618111644860239%7CUnknown%7CTWFpbGZsb3d8eyJWI
> joiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7
> C%7C&sdata=rnV7UTTM7GUpysGbgpLRfGDOA7xtwoACZXoq7N9anNg%3D&reserved=0
>
> As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.
>

a patch series had been proposed, but the implementation was not finished AFAIK, see Fabian's review[0]. Since Oguz left the company, nobody else has picked up work on the series yet. Maybe you can describe what exactly your use case is, which privileges you'd need in particular. Of course, proposing patches for what you need (or a rebased version of Oguz's full series) is welcome too :)

[0]:
https://lore.proxmox.com/pve-devel/1658908014.zeyifvlr1o.astroid@nora.none/

Best Regards,
Fiona



[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel