[PDM 1.1.x] New to PDM: How to Add Remote (Set Up User/Permissions)?

[SInisterPisces]

I apologize. I just read through the entire documentation for PDM and feel like I must have missed something. Is there a guide to adding a Remote (cluster) to PDM using the web GUI?

The web GUI's interface for adding a Remote is pretty straightforward.

Right now, I only have a root user with PAM authentication on my test PVE single node cluster. The root user is protected via OTP 2FA, but even still, giving PBS direct access to the Remote via a root user does not feel like the most secure possible way to do this.

• If I give it my root username and password, will it just log in and create a new user with the necessary token? (from the way window looks, I suspect it'll just give the root user a token, which isn't what I want).
• So, I think I need to create a user to act as the PDM user (using the PVE realm), but I have no idea what Role to give it to set the correct permissions. I want to grant the minimum necessary permissions, and I'm completely lost on how to do that.

Just to keep things simple and avoid creating a user that doesn't have enough permissions to create a token for itself, I'll manually create the token after I've made the user.

Any suggestions would be appreciated. Thanks!

 

[n.frey]

Hi,

If I give it my root username and password, will it just log in and create a new user with the necessary token? (from the way window looks, I suspect it'll just give the root user a token, which isn't what I want).

It will create a token on the user you've specified; so when using the root user, the token is created on that. If you don't want this, you can create a separate user.

So, I think I need to create a user to act as the PDM user (using the PVE realm), but I have no idea what Role to give it to set the correct permissions. I want to grant the minimum necessary permissions, and I'm completely lost on how to do that.

That fully depends on what you want PDM to do (both the user and token permissions, that is). If you want to use PDM solely as a dashboard, you'll need to give the user/token audit permissions. If you want it to start/stop VMs, you'll need it to give it those permissions, etc.