[pve-devel] Bug 2582 roadmap

[pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel]

[-- Attachment #1: Type: message/rfc822, Size: 11672 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: "pve-devel@lists.proxmox.com" <pve-devel@lists.proxmox.com>
Subject: Bug 2582 roadmap
Date: Tue, 10 Sep 2024 10:18:07 +0000
Message-ID: <IA0PR14MB6767A0575DBA79C4F53006E7939A2@IA0PR14MB6767.namprd14.prod.outlook.com>

Hi Proxmox team,

Would you provide any delivery estimates on this item?
https://bugzilla.proxmox.com/show_bug.cgi?id=2582

As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.

Please advise,

Thank you!


[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] Bug 2582 roadmap

[Fiona Ebner]

Hi Pavel,

Am 10.09.24 um 12:18 schrieb Pavel Tide via pve-devel:
> Hi Proxmox team,
> 
> Would you provide any delivery estimates on this item?
> https://bugzilla.proxmox.com/show_bug.cgi?id=2582
> 
> As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.
> 

a patch series had been proposed, but the implementation was not
finished AFAIK, see Fabian's review[0]. Since Oguz left the company,
nobody else has picked up work on the series yet. Maybe you can describe
what exactly your use case is, which privileges you'd need in
particular. Of course, proposing patches for what you need (or a rebased
version of Oguz's full series) is welcome too :)

[0]:
https://lore.proxmox.com/pve-devel/1658908014.zeyifvlr1o.astroid@nora.none/

Best Regards,
Fiona


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel]

[-- Attachment #1: Type: message/rfc822, Size: 14819 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: Fiona Ebner <f.ebner@proxmox.com>, Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: RE: [pve-devel] Bug 2582 roadmap
Date: Fri, 20 Sep 2024 12:32:13 +0000
Message-ID: <IA0PR14MB676740F40B90FBABA72410E3936C2@IA0PR14MB6767.namprd14.prod.outlook.com>

Hi Fiona,

Thank you for helping me out and sorry for my late response.

The issue is that right now to work with PVE we have to do the following:

1) Connect via SSH to the PVE node and deploy a helper virtual machine (so that users don't have to do it manually)
2) Access the Proxmox VE API to perform other backup-related tasks (those that cannot be done via SSH)

In item #1 - the new VM deployment involved usage of root/sudo.

In item #2 - certain tasks that are performed via API also require root/sudo. We have managed to move those to the SSH part of the workflow, so now users can use one non-root account to perform all necessary operations (instead of using root or having to use two separate accounts).

We think that in future there might be a situation where we might need a superuser level of privileges while accessing the API, and there will be no workaround to move the operation to the SSH part of the workflow. This will result in forcing our joint users to use 'root' account again, which they hate to do and also deem as an not secure practice.

I hope that helps. If there is anything else what we could do from out side please let me know.

Thanks!

-----Original Message-----
From: Fiona Ebner <f.ebner@proxmox.com>
Sent: Friday, September 13, 2024 09:59
To: Proxmox VE development discussion
Cc: Pavel Tide
Subject: Re: [pve-devel] Bug 2582 roadmap

Hi Pavel,

Am 10.09.24 um 12:18 schrieb Pavel Tide via pve-devel:
> Hi Proxmox team,
>
> Would you provide any delivery estimates on this item?
> https://bugz/
> illa.proxmox.com%2Fshow_bug.cgi%3Fid%3D2582&data=05%7C02%7CPavel.TIde%
> 40veeam.com%7C9fbe3a27cdb746e4522e08dcd3c9f802%7Cba07baab431b49edadd7c
> bc3542f5140%7C1%7C0%7C638618111644860239%7CUnknown%7CTWFpbGZsb3d8eyJWI
> joiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7
> C%7C&sdata=rnV7UTTM7GUpysGbgpLRfGDOA7xtwoACZXoq7N9anNg%3D&reserved=0
>
> As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.
>

a patch series had been proposed, but the implementation was not finished AFAIK, see Fabian's review[0]. Since Oguz left the company, nobody else has picked up work on the series yet. Maybe you can describe what exactly your use case is, which privileges you'd need in particular. Of course, proposing patches for what you need (or a rebased version of Oguz's full series) is welcome too :)

[0]:
https://lore.proxmox.com/pve-devel/1658908014.zeyifvlr1o.astroid@nora.none/

Best Regards,
Fiona



[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel]

[-- Attachment #1: Type: message/rfc822, Size: 15811 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: Fiona Ebner <f.ebner@proxmox.com>, Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: RE: [pve-devel] Bug 2582 roadmap
Date: Thu, 24 Oct 2024 14:27:43 +0000
Message-ID: <IA0PR14MB6767381D629BAF3327BFD123934E2@IA0PR14MB6767.namprd14.prod.outlook.com>

Hi Fiona et al,

Just wanted to follow up on the subject.

I think I need some guidance from you and your team members on how we at Veeam could facilitate development of this and some other features in Proxmox VE.
Is there any standard protocol for that established, or we should simply submit a request/proposal in the mailing list and wait for someone to see it and respond?

Thanks!

-----Original Message-----
From: Pavel Tide <Pavel.TIde@veeam.com>
Sent: Friday, September 20, 2024 14:32
To: Fiona Ebner; Proxmox VE development discussion
Subject: RE: [pve-devel] Bug 2582 roadmap

Hi Fiona,

Thank you for helping me out and sorry for my late response.

The issue is that right now to work with PVE we have to do the following:

1) Connect via SSH to the PVE node and deploy a helper virtual machine (so that users don't have to do it manually)
2) Access the Proxmox VE API to perform other backup-related tasks (those that cannot be done via SSH)

In item #1 - the new VM deployment involved usage of root/sudo.

In item #2 - certain tasks that are performed via API also require root/sudo. We have managed to move those to the SSH part of the workflow, so now users can use one non-root account to perform all necessary operations (instead of using root or having to use two separate accounts).

We think that in future there might be a situation where we might need a superuser level of privileges while accessing the API, and there will be no workaround to move the operation to the SSH part of the workflow. This will result in forcing our joint users to use 'root' account again, which they hate to do and also deem as an not secure practice.

I hope that helps. If there is anything else what we could do from out side please let me know.

Thanks!

-----Original Message-----
From: Fiona Ebner <mailto:f.ebner@proxmox.com>
Sent: Friday, September 13, 2024 09:59
To: Proxmox VE development discussion
Cc: Pavel Tide
Subject: Re: [pve-devel] Bug 2582 roadmap

Hi Pavel,

Am 10.09.24 um 12:18 schrieb Pavel Tide via pve-devel:
> Hi Proxmox team,
>
> Would you provide any delivery estimates on this item?
> https://bugz/
> illa.proxmox.com%2Fshow_bug.cgi%3Fid%3D2582&data=05%7C02%7CPavel.TIde%
> 40veeam.com%7C9fbe3a27cdb746e4522e08dcd3c9f802%7Cba07baab431b49edadd7c
> bc3542f5140%7C1%7C0%7C638618111644860239%7CUnknown%7CTWFpbGZsb3d8eyJWI
> joiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7
> C%7C&sdata=rnV7UTTM7GUpysGbgpLRfGDOA7xtwoACZXoq7N9anNg%3D&reserved=0
>
> As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.
>

a patch series had been proposed, but the implementation was not finished AFAIK, see Fabian's review[0]. Since Oguz left the company, nobody else has picked up work on the series yet. Maybe you can describe what exactly your use case is, which privileges you'd need in particular. Of course, proposing patches for what you need (or a rebased version of Oguz's full series) is welcome too :)

[0]:
https://lore.proxmox.com/pve-devel/1658908014.zeyifvlr1o.astroid@nora.none/

Best Regards,
Fiona



[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] Bug 2582 roadmap

[Thomas Lamprecht]

Hello,

Am 20/09/2024 um 14:32 schrieb Pavel Tide:
> 1) Connect via SSH to the PVE node and deploy a helper virtual machine (so that users don't have to do it manually)
> 2) Access the Proxmox VE API to perform other backup-related tasks (those that cannot be done via SSH)
> 
> In item #1 - the new VM deployment involved usage of root/sudo.
> 
> In item #2 - certain tasks that are performed via API also require root/sudo. We have managed to move those to the SSH part of the workflow, so now users can use one non-root account to perform all necessary operations (instead of using root or having to use two separate accounts).
> 
> We think that in future there might be a situation where we might need a superuser level of privileges while accessing the API, and there will be no workaround to move the operation to the SSH part of the workflow. This will result in forcing our joint users to use 'root' account again, which they hate to do and also deem as an not secure practice.

Which situations/API calls would that be? It would be definitively
helpful to get specifics here, as otherwise it's hard to help and also a
bit hard to tell for sure if the Sys.Root privilege feature request
would even help here.
As that privilege would only allow current root-only API calls to be
used by non-root admin accounts, but it would not allow the account to
gain root access on the system just by having that privilege.

In general, I think it would be better to do less, not more, stuff
manually in the long term and rather check out the in-development
external backup provider API [0], as that would allow easier and safer
access to VM and CT data while integrating better with the existing PVE
stack, ideally reducing the potential for fallout on either site.

[0]: https://lore.proxmox.com/pve-devel/20240813132829.117460-1-f.ebner@proxmox.com/

- Thomas


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel]

[-- Attachment #1: Type: message/rfc822, Size: 12656 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: "pve-devel@lists.proxmox.com" <pve-devel@lists.proxmox.com>
Subject: RE: Bug 2582 roadmap
Date: Thu, 12 Sep 2024 09:59:58 +0000
Message-ID: <IA0PR14MB676762136E2CA57D1BFFBE2E93642@IA0PR14MB6767.namprd14.prod.outlook.com>

Hi Proxmox team,

Any updates on the subject? When those changes can be expected in the production version of PVE?

Thanks!


From: Pavel Tide 
Sent: Tuesday, September 10, 2024 12:18
To: pve-devel@lists.proxmox.com
Subject: Bug 2582 roadmap

Hi Proxmox team,

Would you provide any delivery estimates on this item?
https://bugzilla.proxmox.com/show_bug.cgi?id=2582

As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account to work with PVE cluster.

Please advise,

Thank you!



[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] Bug 2582 roadmap

[Pavel Tide via pve-devel]

[-- Attachment #1: Type: message/rfc822, Size: 12491 bytes --]

From: Pavel Tide <Pavel.TIde@veeam.com>
To: "pve-devel@lists.proxmox.com" <pve-devel@lists.proxmox.com>
Subject: Bug 2582 roadmap
Date: Fri, 6 Sep 2024 11:17:46 +0000
Message-ID: <CY8PR14MB67563BC6DB4735BF2CC35DBE939E2@CY8PR14MB6756.namprd14.prod.outlook.com>

Hi Proxmox team,

Would you provide any delivery estimates on this item?

https://bugzilla.proxmox.com/show_bug.cgi?id=2582

As far as I understand it's been implemented already, but currently stays in the development branch - our lab is up to date and yet we don't see how we can create a separate non-root account.

Please advise,

Thank you!

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel