[pve-devel] [PATCH pve-network 2/5] api: add lock-secret parameter to all api calls
Stefan Hanreich
s.hanreich at proxmox.com
Fri Feb 28 14:05:46 CET 2025
The parameter is optional, so all existing create/update/delete
invocations can work as before, only failing if the global lock is
currently set. This ensures backwards-compatibility with the existing
calls to the API in the frontend. If the lock is set, users will get
an error message when trying to modify the configuration from the web
UI.
Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
src/PVE/API2/Network/SDN/Controllers.pm | 18 +++++++++++++-----
src/PVE/API2/Network/SDN/Dns.pm | 18 +++++++++++++-----
src/PVE/API2/Network/SDN/Ipams.pm | 18 +++++++++++++-----
src/PVE/API2/Network/SDN/Subnets.pm | 19 ++++++++++++++-----
src/PVE/API2/Network/SDN/Vnets.pm | 18 +++++++++++++-----
src/PVE/API2/Network/SDN/Zones.pm | 18 +++++++++++++-----
src/PVE/Network/SDN.pm | 6 ++++++
7 files changed, 85 insertions(+), 30 deletions(-)
diff --git a/src/PVE/API2/Network/SDN/Controllers.pm b/src/PVE/API2/Network/SDN/Controllers.pm
index 38a685d..29f6ca4 100644
--- a/src/PVE/API2/Network/SDN/Controllers.pm
+++ b/src/PVE/API2/Network/SDN/Controllers.pm
@@ -164,13 +164,16 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/controllers', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Controllers::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Controllers::Plugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'controller');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $plugin = PVE::Network::SDN::Controllers::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -194,7 +197,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Controllers::write_config($controller_cfg);
- }, "create sdn controller object failed");
+ }, "create sdn controller object failed", $lock_secret);
return undef;
}});
@@ -208,7 +211,9 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/controllers', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Controllers::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Controllers::Plugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -216,6 +221,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'controller');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -244,7 +250,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Controllers::write_config($controller_cfg);
- }, "update sdn controller object failed");
+ }, "update sdn controller object failed", $lock_secret);
return undef;
}});
@@ -264,6 +270,7 @@ __PACKAGE__->register_method ({
controller => get_standard_option('pve-sdn-controller-id', {
completion => \&PVE::Network::SDN::Controllers::complete_sdn_controllers,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -271,6 +278,7 @@ __PACKAGE__->register_method ({
my ($param) = @_;
my $id = extract_param($param, 'controller');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -288,7 +296,7 @@ __PACKAGE__->register_method ({
delete $cfg->{ids}->{$id};
PVE::Network::SDN::Controllers::write_config($cfg);
- }, "delete sdn controller object failed");
+ }, "delete sdn controller object failed", $lock_secret);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Dns.pm b/src/PVE/API2/Network/SDN/Dns.pm
index 826d111..a60d0ca 100644
--- a/src/PVE/API2/Network/SDN/Dns.pm
+++ b/src/PVE/API2/Network/SDN/Dns.pm
@@ -120,13 +120,16 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/dns', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Dns::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Dns::Plugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'dns');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $plugin = PVE::Network::SDN::Dns::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -152,7 +155,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Dns::write_config($dns_cfg);
- }, "create sdn dns object failed");
+ }, "create sdn dns object failed", $lock_secret);
return undef;
}});
@@ -166,7 +169,9 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/dns', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Dns::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Dns::Plugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -174,6 +179,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'dns');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -201,7 +207,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Dns::write_config($dns_cfg);
- }, "update sdn dns object failed");
+ }, "update sdn dns object failed", $lock_secret);
return undef;
}});
@@ -221,6 +227,7 @@ __PACKAGE__->register_method ({
dns => get_standard_option('pve-sdn-dns-id', {
completion => \&PVE::Network::SDN::Dns::complete_sdn_dns,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -228,6 +235,7 @@ __PACKAGE__->register_method ({
my ($param) = @_;
my $id = extract_param($param, 'dns');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -241,7 +249,7 @@ __PACKAGE__->register_method ({
delete $cfg->{ids}->{$id};
PVE::Network::SDN::Dns::write_config($cfg);
- }, "delete sdn dns object failed");
+ }, "delete sdn dns object failed", $lock_secret);
return undef;
}});
diff --git a/src/PVE/API2/Network/SDN/Ipams.pm b/src/PVE/API2/Network/SDN/Ipams.pm
index 27ead02..33166c7 100644
--- a/src/PVE/API2/Network/SDN/Ipams.pm
+++ b/src/PVE/API2/Network/SDN/Ipams.pm
@@ -125,13 +125,16 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/ipams', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Ipams::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Ipams::Plugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'ipam');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $plugin = PVE::Network::SDN::Ipams::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -159,7 +162,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Ipams::write_config($ipam_cfg);
- }, "create sdn ipam object failed");
+ }, "create sdn ipam object failed", $lock_secret);
return undef;
}});
@@ -173,7 +176,9 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/ipams', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Ipams::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Ipams::Plugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -181,6 +186,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'ipam');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -208,7 +214,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Ipams::write_config($ipam_cfg);
- }, "update sdn ipam object failed");
+ }, "update sdn ipam object failed", $lock_secret);
return undef;
}});
@@ -228,6 +234,7 @@ __PACKAGE__->register_method ({
ipam => get_standard_option('pve-sdn-ipam-id', {
completion => \&PVE::Network::SDN::Ipams::complete_sdn_ipams,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -235,6 +242,7 @@ __PACKAGE__->register_method ({
my ($param) = @_;
my $id = extract_param($param, 'ipam');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -250,7 +258,7 @@ __PACKAGE__->register_method ({
delete $cfg->{ids}->{$id};
PVE::Network::SDN::Ipams::write_config($cfg);
- }, "delete sdn zone object failed");
+ }, "delete sdn zone object failed", $lock_secret);
return undef;
}});
diff --git a/src/PVE/API2/Network/SDN/Subnets.pm b/src/PVE/API2/Network/SDN/Subnets.pm
index 7a4c331..cd14f30 100644
--- a/src/PVE/API2/Network/SDN/Subnets.pm
+++ b/src/PVE/API2/Network/SDN/Subnets.pm
@@ -183,13 +183,16 @@ __PACKAGE__->register_method ({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::SubnetPlugin->createSchema(),
+ parameters => PVE::Network::SDN::SubnetPlugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $cidr = extract_param($param, 'subnet');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $vnet = $param->{vnet};
my $privs = [ 'SDN.Allocate' ];
@@ -225,7 +228,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Subnets::write_config($cfg);
- }, "create sdn subnet object failed");
+ }, "create sdn subnet object failed", $lock_secret);
return undef;
}});
@@ -240,7 +243,9 @@ __PACKAGE__->register_method ({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::SubnetPlugin->updateSchema(),
+ parameters => PVE::Network::SDN::SubnetPlugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -248,6 +253,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'subnet');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $vnet = $param->{vnet};
@@ -283,7 +289,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Subnets::write_config($cfg);
- }, "update sdn subnet object failed");
+ }, "update sdn subnet object failed", $lock_secret);
return undef;
}});
@@ -305,6 +311,7 @@ __PACKAGE__->register_method ({
subnet => get_standard_option('pve-sdn-subnet-id', {
completion => \&PVE::Network::SDN::Subnets::complete_sdn_subnets,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -313,6 +320,8 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'subnet');
my $vnet = extract_param($param, 'vnet');
+ my $lock_secret = extract_param($param, 'lock-secret');
+
my $privs = [ 'SDN.Allocate' ];
&$check_vnet_access($vnet, $privs);
@@ -336,7 +345,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Subnets::write_config($cfg);
- }, "delete sdn subnet object failed");
+ }, "delete sdn subnet object failed", $lock_secret);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Vnets.pm b/src/PVE/API2/Network/SDN/Vnets.pm
index e48b048..bd37dd3 100644
--- a/src/PVE/API2/Network/SDN/Vnets.pm
+++ b/src/PVE/API2/Network/SDN/Vnets.pm
@@ -198,13 +198,16 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/zones/{zone}', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::VnetPlugin->createSchema(),
+ parameters => PVE::Network::SDN::VnetPlugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'vnet');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Cluster::check_cfs_quorum();
mkdir("/etc/pve/sdn");
@@ -228,7 +231,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Vnets::write_config($cfg);
- }, "create sdn vnet object failed");
+ }, "create sdn vnet object failed", $lock_secret);
return undef;
}});
@@ -243,7 +246,9 @@ __PACKAGE__->register_method ({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::VnetPlugin->updateSchema(),
+ parameters => PVE::Network::SDN::VnetPlugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -251,6 +256,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'vnet');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $privs = [ 'SDN.Allocate' ];
&$check_vnet_access($id, $privs);
@@ -292,7 +298,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Vnets::write_config($cfg);
- }, "update sdn vnet object failed");
+ }, "update sdn vnet object failed", $lock_secret);
return undef;
}
@@ -314,6 +320,7 @@ __PACKAGE__->register_method ({
vnet => get_standard_option('pve-sdn-vnet-id', {
completion => \&PVE::Network::SDN::Vnets::complete_sdn_vnets,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -321,6 +328,7 @@ __PACKAGE__->register_method ({
my ($param) = @_;
my $id = extract_param($param, 'vnet');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $privs = [ 'SDN.Allocate' ];
&$check_vnet_access($id, $privs);
@@ -335,7 +343,7 @@ __PACKAGE__->register_method ({
delete $cfg->{ids}->{$id};
PVE::Network::SDN::Vnets::write_config($cfg);
- }, "delete sdn vnet object failed");
+ }, "delete sdn vnet object failed", $lock_secret);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Zones.pm b/src/PVE/API2/Network/SDN/Zones.pm
index 2c27983..6baee52 100644
--- a/src/PVE/API2/Network/SDN/Zones.pm
+++ b/src/PVE/API2/Network/SDN/Zones.pm
@@ -199,13 +199,16 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/zones', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Zones::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Zones::Plugin->createSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'zone');
+ my $lock_secret = extract_param($param, 'lock-secret');
my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -244,7 +247,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Zones::write_config($zone_cfg);
- }, "create sdn zone object failed");
+ }, "create sdn zone object failed", $lock_secret);
return;
}});
@@ -258,7 +261,9 @@ __PACKAGE__->register_method ({
permissions => {
check => ['perm', '/sdn/zones/{zone}', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Zones::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Zones::Plugin->updateSchema(undef, {
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
+ }),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -266,6 +271,7 @@ __PACKAGE__->register_method ({
my $id = extract_param($param, 'zone');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_secret = extract_param($param, 'lock-secret');
if ($delete) {
$delete = [ PVE::Tools::split_list($delete) ];
@@ -320,7 +326,7 @@ __PACKAGE__->register_method ({
PVE::Network::SDN::Zones::write_config($zone_cfg);
- }, "update sdn zone object failed");
+ }, "update sdn zone object failed", $lock_secret);
return;
}});
@@ -340,6 +346,7 @@ __PACKAGE__->register_method ({
zone => get_standard_option('pve-sdn-zone-id', {
completion => \&PVE::Network::SDN::Zones::complete_sdn_zones,
}),
+ 'lock-secret' => get_standard_option('pve-sdn-lock-secret'),
},
},
returns => { type => 'null' },
@@ -347,6 +354,7 @@ __PACKAGE__->register_method ({
my ($param) = @_;
my $id = extract_param($param, 'zone');
+ my $lock_secret = extract_param($param, 'lock-secret');
PVE::Network::SDN::lock_sdn_config(sub {
my $cfg = PVE::Network::SDN::Zones::config();
@@ -360,7 +368,7 @@ __PACKAGE__->register_method ({
delete $cfg->{ids}->{$id};
PVE::Network::SDN::Zones::write_config($cfg);
- }, "delete sdn zone object failed");
+ }, "delete sdn zone object failed", $lock_secret);
return;
}});
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index 3b3ea67..08c8700 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -52,6 +52,12 @@ PVE::Cluster::cfs_register_file(
sub { my ($filename, $data) = @_; return $data; }
);
+PVE::JSONSchema::register_standard_option('pve-sdn-lock-secret', {
+ type => 'string',
+ description => "the secret for unlocking the global SDN configuration",
+ optional => 1,
+});
+
# improve me : move status code inside plugins ?
sub ifquery_check {
--
2.39.5
More information about the pve-devel
mailing list