With rare exception we give some third party partners a login to our PVE cluster. Of course we restrict their permissions to which resource pools they can see and give them only the bare minimum permissions on their VMs.
However, when these restricted users login to the PVE GUI, the default tree view in the left sidebar is "Server View" where they can see all of our nodes and other globals such as storage and VXLAN etc. And that is still the default view for all users.
It offers too much information to a restricted user. (edit: now i can see only nodes are listed, nothing else!)
On PVE 6.x I had modified the pvemanager.lib on all of the nodes thusly:
And it served our needs. So that outsiders can only use the Pool View. Now, we've upgraded to 7.2-7 and Ceph Quincy and overall very happy with the outcome.
However, the structure of this section of the 7.x pvemanagerlib.js is a little different, Proxmox.UserName is not defined at this stage of the script, so I can't do conditional stuff on the user name. I am not super proficient in JS, and I'm reluctant to keep modifying it out of stream or have this ongoing.
I would like to at least have the ability to restrict certain users or groups to the Pool View only.
I wanted to come first to you fine folks about the possibility of defining the permitted and default views on the user and/or role permission object, or if a better solution is available I'd love to hear it. Thanks all.
However, when these restricted users login to the PVE GUI, the default tree view in the left sidebar is "Server View" where they can see all of our nodes and other globals such as storage and VXLAN etc. And that is still the default view for all users.
It offers too much information to a restricted user. (edit: now i can see only nodes are listed, nothing else!)
On PVE 6.x I had modified the pvemanager.lib on all of the nodes thusly:
JavaScript:
if (Proxmox.UserName.match(/^(root@pam|ay@pve|james@pve|joey@pve|mw@pve|rob@pve|tim@pve|zack@pve)$/)) { //ONLY @PAM USERS AND EMPLOYEES CAN SEE ALL VIEWS
var default_views = {
server: {
text: gettext('Server View'),
groups: ['node']
},
folder: {
text: gettext('Folder View'),
groups: ['type']
},
storage: {
text: gettext('Storage View'),
groups: ['node'],
filterfn: function(node) {
return node.data.type === 'storage' || node.data.type === 'node';
}
},
pool: {
text: gettext('Pool View'),
groups: ['pool'],
// Pool View only lists VMs and Containers
filterfn: function(node) {
return node.data.type === 'qemu' || node.data.type === 'lxc' || node.data.type === 'openvz' || node.data.type === 'pool';
}
}
};
} else {// EVERYONE ELSE CAN ONLY SEE POOL VIEW
var default_views = {
pool: {
text: gettext('Pool View'),
groups: ['pool'],
// Pool View only lists VMs and Containers
filterfn: function(node) {
return node.data.type === 'qemu' || node.data.type === 'lxc' || node.data.type === 'openvz' || node.data.type === 'pool';
}
}
};And it served our needs. So that outsiders can only use the Pool View. Now, we've upgraded to 7.2-7 and Ceph Quincy and overall very happy with the outcome.
However, the structure of this section of the 7.x pvemanagerlib.js is a little different, Proxmox.UserName is not defined at this stage of the script, so I can't do conditional stuff on the user name. I am not super proficient in JS, and I'm reluctant to keep modifying it out of stream or have this ongoing.
I would like to at least have the ability to restrict certain users or groups to the Pool View only.
I wanted to come first to you fine folks about the possibility of defining the permitted and default views on the user and/or role permission object, or if a better solution is available I'd love to hear it. Thanks all.
Last edited:
