[GH-ISSUE #66] What privileges necessary? #36

New issue

Closed

opened 2026-02-27 15:46:07 +03:00 by kerem · 2 comments

kerem commented

2026-02-27 15:46:07 +03:00

Owner

Originally created by @FuzzyMistborn on GitHub (Sep 21, 2021).
Original GitHub issue: https://github.com/proxmoxer/proxmoxer/issues/66

I'm looking to lock down access to my Proxmox server and am using Ansible to create VMs/LXCs. Currently I'm using an API token and with the PVEAdmin role but I'm wondering if I can reduce that still further. From playing around a bit it looks like I need a cross between the PVEDatastoreAdmin and PVEVMAdmin roles (https://pve.proxmox.com/wiki/User_Management#pveum_permission_management). Just trying to get a sense of what privileges are specifically required. This may not be the right place to ask (may need to go to ansible) so you can tell me to go there and I won't be offended :-)

Originally created by @FuzzyMistborn on GitHub (Sep 21, 2021). Original GitHub issue: https://github.com/proxmoxer/proxmoxer/issues/66 I'm looking to lock down access to my Proxmox server and am using Ansible to create VMs/LXCs. Currently I'm using an API token and with the PVEAdmin role but I'm wondering if I can reduce that still further. From playing around a bit it looks like I need a cross between the PVEDatastoreAdmin and PVEVMAdmin roles (https://pve.proxmox.com/wiki/User_Management#pveum_permission_management). Just trying to get a sense of what privileges are specifically required. This may not be the right place to ask (may need to go to ansible) so you can tell me to go there and I won't be offended :-)

kerem

2026-02-27 15:46:07 +03:00

closed this issue
added the
type:question ❓

status:ansible-issue
labels

kerem commented

2026-02-27 15:46:07 +03:00

Author

Owner

@jhollowe commented on GitHub (Sep 21, 2021):

Unless someone else can give an exact answer, the best I can say is to look at the Ansible code, what API calls it is making, and see in the PVE API documentation what permissions are needed for each. Each endpoint in the API docs should tell you the permission needed and the path it is needed on. I would start with no permissions and add the needed ones until Ansible does what you want. Being able to create LXC containers will obviously be greater permissions than just reading state from PVE, but the Home Assistant PVE integration only needs Auditor role.

I would also suggest creating a role for ansible in PVE rather than setting all the permissions on the API Token itself so you can easily revoke it or create additional tokens without having to reinvent the wheel with your permissions.

@jhollowe commented on GitHub (Sep 21, 2021): Unless someone else can give an exact answer, the best I can say is to look at the Ansible code, what API calls it is making, and see in [the PVE API documentation](https://pve.proxmox.com/pve-docs/api-viewer/index.html) what permissions are needed for each. Each endpoint in the API docs should tell you the permission needed and the path it is needed on. I would start with no permissions and add the needed ones until Ansible does what you want. Being able to create LXC containers will obviously be greater permissions than just reading state from PVE, but the [Home Assistant PVE integration](https://www.home-assistant.io/integrations/proxmoxve/) only needs Auditor role. I would also suggest creating a role for ansible in PVE rather than setting all the permissions on the API Token itself so you can easily revoke it or create additional tokens without having to reinvent the wheel with your permissions.

kerem commented

2026-02-27 15:46:07 +03:00

Author

Owner

@FuzzyMistborn commented on GitHub (Sep 22, 2021):

Thanks, I'll take a look. Appreciate it!

@FuzzyMistborn commented on GitHub (Sep 22, 2021): Thanks, I'll take a look. Appreciate it!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/proxmoxer#36

No description provided.

Rows
Columns