Can't figure out permissions to access PVE storage content API

S

Skye0

New Member
Apr 24, 2024
6
0
1
Hello,

I have recently set up PBS and am quite excited by it.

Now I would like to create a script on my PVE that checks that each of my backup enrolled VMs has at least one recent verified backup on my PBS. It looks like I can do that by querying the PVE API at this location: /nodes/<NODE>/storage/<PBS-STORAGE>/content Based on running pvesh as root, it should inform me of data like:

JSON: 
[
   {
      "content" : "backup",
      "ctime" : 1773871060,
      "encrypted" : "...",
      "format" : "pbs-vm",
      "notes" : "...",
      "size" : 42949674144,
      "subtype" : "qemu",
      "verification" : {
         "state" : "ok",
         "upid" : "..."
      },
      "vmid" : 1002,
      "volid" : "<PBS-STORAGE>:backup/vm/1002/2026-03-18T21:57:40Z"
   },
    ...
]

I think my api token+user doesn't have enough permission though, since when running via API as a less privileged token it returns this:

JSON: 
{
    "data": []
}

I have granted the user+api audit permission (PVEAuditor) over the nodes and backup storage, but it seems that is not enough. (I also tried some various other configurations that did not work.) Here are my current permissions:

JSON: 
[
   {
      "path" : "/nodes",
      "propagate" : 1,
      "roleid" : "PVEAuditor",
      "type" : "user",
      "ugid" : "backup-status-checker@pve"
   },
   {
      "path" : "/nodes",
      "propagate" : 1,
      "roleid" : "PVEAuditor",
      "type" : "token",
      "ugid" : "backup-status-checker@pve!backup-status-checker"
   },
   {
      "path" : "/storage/<PBS-STORAGE>",
      "propagate" : 1,
      "roleid" : "PVEAuditor",
      "type" : "user",
      "ugid" : "backup-status-checker@pve"
   },
   {
      "path" : "/storage/<PBS-STORAGE>",
      "propagate" : 1,
      "roleid" : "PVEAuditor",
      "type" : "token",
      "ugid" : "backup-status-checker@pve!backup-status-checker"
   }
]

What are the minimum needed permissions to get this api to return data? The api call documentation states "You need read access for the volume" (which seems perhaps a bit much for just querying metadata like upload time & verified state), but even for full volume read permission, it's not clear to me how to grant this. (I did try various permissions over /storage/<PBS-STORAGE> and /vms and even / but nothing I tried resolved it)
 
Those are permissions for the PBS api, whereas I was trying to make calls to the PVE api. If there is a similar api to get the verification status on PBS I suppose I could query both systems, but it seems more straightforward to just query PVE since it has both sets of information I need.

Also I previously tried numerous permissions already for the PVE apis but wasn't able to find a combination that worked, so any more specificity on the specific recommended ones would be helpful.
 
If I understand your issue right, you want to verify things at PBS side.
So permissions at PBS matter.
 
You must log in or register to reply here.
Top Bottom
Back