SDN VNet permissions. Invalid ACL path

[Malte513]

Hello everyone.

I'm trying to restrict permissions to certain VNets. In the Proxmox API Viewer the ACL paths are listed as /sdn/vnets and /sdn/vnets/{vnet}, but if I try to set these permissions I always get the error 400 Parameter verification failed. path: invalid ACL path '/sdn/vnets'.
I'm using proxmox 8.0.4.

Is this a bug or am I doing something wrong. If this is a bug, is there some workaround?

 

[fabian]

thanks, and no, this is a bug that's already fixed in git but still needs to be released in package form it seems.

 

[Malte513]

Thank you.

 

[fabian]

will be fixed in libpve-network-perl 0.8.2, which should hit the public repos in a few days!

edit: already on pvetest

 

[Malte513]

I updated and restarted all nodes . They now all run libpve-network-perl 0.8.2, but unfortunately I still get the same error message.

Do I need to do something else?

 

[fabian]

yes, the ACL paths are different now:

https://git.proxmox.com/?p=pve-network.git;a=commitdiff;h=d7c1620043a8ed3492bb085c33974a5e3466e0cc
https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_8.0

• SDN.Use is required on a bridge/vnet (or its zone) in order to configure it in a guest vNIC.
  • use /sdn/zones/localnetwork or /sdn/zones/localnetwork/<bridge> to allow usage of all or specific local bridges.
  • use /sdn/zones/<zone> or /sdn/zones/<zone>/<bridge> to allow usage of all or specific vnets in a given SDN zone.

 

[Malte513]

Thank you it works now.
But another Bug I found is in the ipam permission. It's the same as above for /sdn/ipams.
I now use a workaround via propagating it via the /sdn path and just blocking the access for everything else explicitly.

 

[fabian]

thanks for the report! I'll fix those up as well (there's a few more missing)..

 

[fabian]

https://lists.proxmox.com/pipermail/pve-devel/2023-November/059861.html

 

[biglolka]

Hello,
We are assessing the Proxmox, and installed the latest version 9.1.1
We are trying to restrict access to certain VNET(s) but the ACL path to the existing VNET(s) is(are) not existing:

# pveum acl modify /sdn/vnets/testVNET --roles RestrictedAdmin --group RestrictedAdmin
400 Parameter verification failed.
path: invalid ACL path '/sdn/vnets/testVNET'

even though there are SDN Zones and SDN VNets ccreated.

# pvesh get /cluster/sdn/zones
┌──────┬──────────┬───────────────────┬──────────┬─────────────────────────────┬────────────┬──────┬──────────────────────────────────────────┬────────────────────────────┬─────┬─────────┬───────────┬─────────────────────────┬───────────────────┬──────┬─────┬─────┬───────┬───────┬─────────┬────────────┬───────────┬───────┬─────┬───────────────┬───────────┬────────────┐
│ type │ zone     │ advertise-subnets │ bridge   │ bridge-disable-mac-learning │ controller │ dhcp │ digest                                   │ disable-arp-nd-suppression │ dns │ dnszone │ exitnodes │ exitnodes-local-routing │ exitnodes-primary │ ipam │ mac │ mtu │ nodes │ peers │ pending │ reversedns │ rt-import │ state │ tag │ vlan-protocol │ vrf-vxlan │ vxlan-port │
╞══════╪══════════╪═══════════════════╪══════════╪═════════════════════════════╪════════════╪══════╪══════════════════════════════════════════╪════════════════════════════╪═════╪═════════╪═══════════╪═════════════════════════╪═══════════════════╪══════╪═════╪═════╪═══════╪═══════╪═════════╪════════════╪═══════════╪═══════╪═════╪═══════════════╪═══════════╪════════════╡
│ vlan │ TestZone │                   │ vmbrtest │                             │            │      │ 103410e7327b10483e106c25afec902d57824ed2 │                            │     │         │           │                         │                   │ pve  │     │     │       │       │         │            │           │       │     │               │           │            │
├──────┼──────────┼───────────────────┼──────────┼─────────────────────────────┼────────────┼──────┼──────────────────────────────────────────┼────────────────────────────┼─────┼─────────┼───────────┼─────────────────────────┼───────────────────┼──────┼─────┼─────┼───────┼───────┼─────────┼────────────┼───────────┼───────┼─────┼───────────────┼───────────┼────────────┤
│ vlan │ VL150    │                   │ vmbr0    │                             │            │      │ 103410e7327b10483e106c25afec902d57824ed2 │                            │     │         │           │                         │                   │ pve  │     │     │       │       │         │            │           │       │     │               │           │            │
├──────┼──────────┼───────────────────┼──────────┼─────────────────────────────┼────────────┼──────┼──────────────────────────────────────────┼────────────────────────────┼─────┼─────────┼───────────┼─────────────────────────┼───────────────────┼──────┼─────┼─────┼───────┼───────┼─────────┼────────────┼───────────┼───────┼─────┼───────────────┼───────────┼────────────┤
│ vlan │ VLAN110  │                   │ vmbr0    │                             │            │      │ 103410e7327b10483e106c25afec902d57824ed2 │                            │     │         │           │                         │                   │ pve  │     │     │       │       │         │            │           │       │     │               │           │            │
└──────┴──────────┴───────────────────┴──────────┴─────────────────────────────┴────────────┴──────┴──────────────────────────────────────────┴────────────────────────────┴─────┴─────────┴───────────┴─────────────────────────┴───────────────────┴──────┴─────┴─────┴───────┴───────┴─────────┴────────────┴───────────┴───────┴─────┴───────────────┴───────────┴────────────┘

and

# pvesh get /cluster/sdn/vnets
┌──────┬──────────┬───────────┬──────────────────────────────────────────┬───────────────┬─────────┬───────┬─────┬───────────┬──────────┐
│ type │ vnet     │ alias     │ digest                                   │ isolate-ports │ pending │ state │ tag │ vlanaware │ zone     │
╞══════╪══════════╪═══════════╪══════════════════════════════════════════╪═══════════════╪═════════╪═══════╪═════╪═══════════╪══════════╡
│ vnet │ WL       │ Workloads │ b264fce2570820552adcfb7a349037dff7677fa4 │               │         │       │ 110 │           │ VLAN110  │
├──────┼──────────┼───────────┼──────────────────────────────────────────┼───────────────┼─────────┼───────┼─────┼───────────┼──────────┤
│ vnet │ WL150    │ VL150     │ b264fce2570820552adcfb7a349037dff7677fa4 │               │         │       │ 150 │           │ VL150    │
├──────┼──────────┼───────────┼──────────────────────────────────────────┼───────────────┼─────────┼───────┼─────┼───────────┼──────────┤
│ vnet │ testVNET │           │ b264fce2570820552adcfb7a349037dff7677fa4 │               │         │       │ 123 │ 1         │ TestZone │
└──────┴──────────┴───────────┴──────────────────────────────────────────┴───────────────┴─────────┴───────┴─────┴───────────┴──────────┘

is there something we are doing wrong?
Thanks in advance!

 

[fabian]

the path is /sdn/zones/<zone>/<vnet>/<vlan>