ACL for Bulk Migrate

[Matthieu Le Corre]

Hello,

I'd like to authorize some of our users to bulk migrate theirs VMs,
but I can't find the appropriate ACLs !

Regarding to the code (/usr/share/perl5/PVE/API2/Nodes.pm) it seems that migrateall is tided to check VM.migrate on /
but even with this authorization, it seems not to be sufficient ..

What am I missing ?

 

[t.lamprecht]

Yes, migrate-all is intended for (node) administrators and requires currently the VM.Migrate on the / ACL object path: https://pve.proxmox.com/pve-docs/api-viewer/index.html#/nodes/{node}/migrateall

but even with this authorization, it seems not to be sufficient ..

How so? what error do you get?

FWIW, if there are also local disks involved that need to be moved to the other nodes local storage on migration you'd also require the Datastore.AllocateSpace on the respective target storage.

 

[fiona]

Hi,
I guess it might be about the UI? The check there uses Sys.PowerMgmt, which doesn't fit the backend for the bulk actions.

 

[Matthieu Le Corre]

Hum you are right, the user reported us that the bulk option are not available.
I'll check with the sys.PowerMgmt, but it seems to be a dangerous option only for bulk migration.

I think UI should aligned to the backend and allow migration with the VM.migrate /

 

[t.lamprecht]

Yeah, it's def a bug to disable the whole menu, this should be done by menu item - the resource tree context menu had it also wrong.

Both fixed in git source now:
https://git.proxmox.com/?p=pve-manager.git;a=commitdiff;h=c258668fa47f25da225abafc8609057f51324f9f

So the next pve-manager tag has this fixed and you really only need to assign the VM.Migrate permissions.

FWIW, we talked off-list in allowing users that only have VM.Migrate on some VMs, not the whole cluster via / to use the bulk migrate API too in the future.