[pdm-devel] [RFC proxmox-datacenter-manager 0/9] Granular permissions for SDN resources

[Gabriel Goller]

This series relies on the following patch series from Stefan:
 - Add support for network resource type
   https://lore.proxmox.com/pdm-devel/20251107144018.700695-1-s.hanreich@proxmox.com/
 - IP-VRF and MAC-VRF status in EVPN panel
   https://lore.proxmox.com/pdm-devel/20251107085934.118815-1-s.hanreich@proxmox.com/

This RFC patch series introduces granular permission controls for SDN resources
(Zones, VNets, and Controllers).

The series is structured as follows:
[0-2] Initial cleanup and refactoring (mostly rename) that can be applied
      independently
[3-7] Adds permission filtering for zones/vnets based on acl paths
[8]   Adds permission filtering for resources

The list_zones and list_vnets endpoints are only used for EVPN stuff in the
EVPN view (currently). The final patch adds permission filtering to the SDN
view, checking only 'network' resource types while ignoring other resource
types. This could potentially be slow, and it's also awkward as we only check
the sdn resource and ignore the others (OTOH without this patch we'd have to
think about the rest of the series as hidden zones can be viewable and
searchable in the resources).

Open questions for discussion:
1. Should we implement granular permissions at this level, or rely on the
   existing PVE token/permissions system?
2. Is the proposed permission granularity appropriate, or too fine-grained?
3. Should the final patch (resource filtering) be included in this series?

proxmox-datacenter-manager:

Gabriel Goller (9):
  api: sdn: rename vnets to zones in list_zones
  api: sdn: rename "vnet" to "controller" in list_controller
  ui: improve error message when controller cannot be found
  api: allow acl paths longer than 4 segments in sdn
  api: sdn: add granular permissions for zones
  api: sdn: add granular permissions for vnets
  api: sdn: add granular permissions for controllers
  api: add permissions for ip-vrf and mac-vrf endpoints
  api: add permissions for sdn resources

 server/src/acl.rs                 |  9 +++++-
 server/src/api/nodes/sdn.rs       | 52 +++++++++++++++++++++++++++++--
 server/src/api/resources.rs       | 21 ++++++++++++-
 server/src/api/sdn/controllers.rs | 33 +++++++++++++-------
 server/src/api/sdn/vnets.rs       | 22 ++++++++-----
 server/src/api/sdn/zones.rs       | 30 +++++++++++-------
 ui/src/sdn/evpn/remote_tree.rs    |  6 ++--
 ui/src/sdn/evpn/vrf_tree.rs       |  6 ++--
 8 files changed, 142 insertions(+), 37 deletions(-)


Summary over all repositories:
  8 files changed, 142 insertions(+), 37 deletions(-)

-- 
Generated by git-murpp 0.8.0