Datastore list shows remote instead of datastores

[dragofer]

I recently made a new installation of PVE (v9.1.6), PBS (v4.1.5) and PDM (v1.0.3) all on the same node, where PVE is baremetal on a zfs root filesystem and the rest are apt installs on top of PVE with no enterprise repos. I would like to use PDM to see the status of my 3 datastores in PBS. The remotes are reachable, but the datastore list shows the remote instead of the datastores:



As far as access controls go, I created the following users and tokens, and gave the tokens to PDM:
PVE) user: r_pve@pam, API token name: r_pdm, both have permission role PVEAuditor on /
PBS) user: r_pve@pbs, API token name: r_pdm, both have permission role Audit on /

PDM's connection is via localhost:8006 and localhost:8007.
The path of the datastores is datastore/<name of datastore>, with a few nested namespaces and some backups already in there.

I can see all other info about the nodes and their guests. I figured PDM might need the PBS user to be in the pam realm, but the PBS webGUI doesn't offer an option to use a different realm than pbs. Perhaps I came across a bug?

 

[Onslow]

Welcome, @dragofer
I haven't got hard evidence at the moment, but I'd try one of two things:
a) changing the role from Audit to DatastoreAudit
or if this doesn't help
b) increasing the role into DatastoreReader.

If those don't help, replace the previous roles, of course, to not keep excessive permissions.

 

[dragofer]

Welcome, @dragofer
I haven't got hard evidence at the moment, but I'd try one of two things:
a) changing the role from Audit to DatastoreAudit
or if this doesn't help
b) increasing the role into DatastoreReader.

If those don't help, replace the previous roles, of course, to not keep excessive permissions.

Thank you, it turns out I needed to declare the permissions on /datastore specifically. Then any of Audit, DatastoreAudit or DatastoreReader will work to make the datastores show up. I thought I had already given maximal audit permissions by using / with "propagate" enabled.

I've reported this in the bugtracker https://bugzilla.proxmox.com/show_bug.cgi?id=7461, because the documentation says that permissions should propagate downwards and I didn't find any special instructions regarding permissions for configuring a PBS remote.