Restore from PBS with Token restricted on namespace

[steff123]

Hey,
I have connect a PVE to my PBS using an API-Token with the following roles

$ pbm acl list | grep "ugid\|test"

│ ugid                    │ path                                   │ propagate │ roleid             │
│ steffen@pbs!pve-test-01 │ /datastore/backup01                    │         1 │ Audit              │
│ steffen@pbs!pve-test-01 │ /datastore/backup01/nodes/pve-test-01  │         1 │ DatastorePowerUser │
│ steffen@pbs!pve-test-01 │ /datastore/backup01/nodes/pve-test-01  │         1 │ DatastoreReader    │

I was able to backup to the namespace pve-test-01, but not able to restore. There was an error message, that there are no permissions for /datastore/backup01. After granting the following permission it works

│ steffen@pbs!pve-test-01 │ /datastore/backup01                    │         1 │ DatastorePowerUser │

Why is a permission on this level necessary? Seems to be too much for me.

Moreover I needed this permission to show the configuration of the backuped container from PVE-side.

Regards

 

[steff123]

Used the buster repo and not the bullseye repo. Hence I was on PBS 2.2.1. All fine with PBS 2.2.5