knife-proxmox-ve 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bfa352b40db68621f19322cdb1dfc060c37ac3faafa423d37b76c9ccd7d544f
-  data.tar.gz: 1f819e5625acbb197012847d54d15e6bace8b71108d3ad867b9fbb2ee0b8944e
+  metadata.gz: 5d5214d06c2b3094351f1e2824fc0d3e9cceba436f2053bb32001b41fe18ea5c
+  data.tar.gz: fad9ae85bb184f7dd8fdb6e54cac5a15a8f9036f1f5f4a07b939cd0a4a0e3f3a
 SHA512:
-  metadata.gz: e185dc631d2d81abdfa6a0e5e1a3772bc66b8db9096f1fc4a358aa910b52c549f8a3c3b1bde159509b7b7dcc8decbc1433fbc10e56731428b69ce764d1162ea1
-  data.tar.gz: 26bf397b78eb7e03f832e506ff34ca026e370c416fb5ec2f1a7c2e4428c915229f851a68e404cec34ceb801f1fd8ee9790bdaec0673480e15f53405d45661453
+  metadata.gz: c4d3a3bdff34585a82c46888572244512f06a7a17b94475b135f2d5f520c2b47d983e07f69cb40baa2ebc2fca8526db2cd5c6c7928ab1f778d2db28061167a05
+  data.tar.gz: 9008cdcd204db73879b3f2a4602e202d821dd70b9df217ebc8ff90e59342e7ff805c516497cd7c62970c531fd6f04df7e69f2fac84305836ba1f9faf821f7630

data/README.md

@@ -45,12 +45,16 @@ knife[:proxmox_clusters] = {
     verify_ssl:   true,                  # optional (default true); false warns every run
 
     # Optional per-cluster provisioning defaults (any CLI flag overrides these):
-    storage:      "local-lvm",
-    bridge:       "vmbr0",
-    ciuser:       "ubuntu",
-    nameserver:   "10.0.0.1",
-    searchdomain: "example.com",
-    target_node:  nil,
+    storage:        "local-lvm",
+    bridge:         "vmbr0",
+    ciuser:         "ubuntu",
+    ssh_public_key: "~/.ssh/id_ed25519.pub", # default authorized key; satisfies the auth
+                                             # requirement without --ssh-public-key. For
+                                             # `vm bootstrap`, :ciuser also becomes the
+                                             # default --connection-user.
+    nameserver:     "10.0.0.1",
+    searchdomain:   "example.com",
+    target_node:    nil,
   },
 }
 
@@ -150,13 +154,14 @@ Both commands share the provisioning flags below.
 | `--bridge vmbrN` / `--vlan TAG` | net0 bridge and VLAN tag (needs a VLAN-aware bridge). |
 | `--ip CIDR\|dhcp` / `--gateway IP` / `--prefix N` | Static IPv4 (`10.0.10.5/24`, or a bare IP with `--prefix`) or `dhcp`. |
 | `--nameserver IP` / `--searchdomain DOMAIN` | cloud-init DNS. |
-| `--ciuser USER` | cloud-init user. |
-| `--ssh-public-key PATH` | Public key injected via cloud-init (preferred auth). |
+| `--ciuser USER` | cloud-init user. For `vm bootstrap`, also the default `--connection-user`. |
+| `--ssh-public-key PATH` | Public key injected via cloud-init (preferred auth). Falls back to the cluster's `:ssh_public_key`. |
 | `--cipassword` | Prompt (no echo) for a cloud-init password; or set `KNIFE_PROXMOX_CIPASSWORD`. |
 | `--clone-timeout SEC` / `--boot-timeout SEC` | Clone and boot/SSH wait limits (default 600 / 300). |
 
 For `vm bootstrap`, the standard `knife bootstrap` options are inherited: `-N/--node-name`,
-`-r/--run-list`, `-E/--environment`, `--connection-user`, `--ssh-identity-file`,
+`-r/--run-list`, `-E/--environment`, `--connection-user` (defaults to the resolved `:ciuser`,
+since cloud-init creates the guest account under that name), `--ssh-identity-file`,
 `--bootstrap-version`, `--ssh-verify-host-key` (defaults to `:accept_new` for the
 freshly-created host), `--yes`, etc. They do not apply to `vm create`, which never bootstraps.
 

data/lib/chef/knife/helpers/proxmox_vm_provision.rb

@@ -13,9 +13,11 @@ class Chef
     # cloud-init auth and plants it on the guest, but never touches the bootstrap connection.
     # The bootstrap command layers that on by overriding #apply_provision_auth!.
     module ProxmoxVmProvision
-      # Proxmox bridge interface names: "vmbr" followed by digits (vmbr0, vmbr1, ...).
-      # IP/gateway validation is handled separately by IPAddr in #validate_ip!/#validate_gateway!.
-      VMBR_PATTERN = /\Avmbr\d+\z/
+      # A bridge is any Linux network interface: a classic bridge (vmbr0), an SDN VNet
+      # (arbitrary name, e.g. "mail"), an OVS bridge, a bond, etc. We only enforce what the
+      # kernel itself does on an interface name — 1..15 chars, no whitespace, no "/", and not
+      # "." or "..". IP/gateway validation is handled separately by IPAddr below.
+      BRIDGE_PATTERN = %r{\A(?!\.{1,2}\z)[^\s/]{1,15}\z}
 
       # A pasted PRIVATE key must never travel as an authorized public key.
       PRIVATE_KEY_MARKER = /-----BEGIN [A-Z ]*PRIVATE KEY-----/
@@ -73,8 +75,8 @@ class Chef
           # --- Networking -------------------------------------------------------
 
           option :bridge,
-            long:        "--bridge vmbrN",
-            description: "Network bridge for net0 (e.g. vmbr0)."
+            long:        "--bridge NAME",
+            description: "Network bridge for net0 (e.g. vmbr0 or an SDN VNet name)."
 
           option :vlan,
             long:        "--vlan TAG",
@@ -108,7 +110,8 @@ class Chef
 
           option :ssh_public_key,
             long:        "--ssh-public-key PATH",
-            description: "Path to an SSH PUBLIC key authorized for the cloud-init user."
+            description: "Path to an SSH PUBLIC key authorized for the cloud-init user. " \
+                         "Defaults to the cluster's :ssh_public_key when set."
 
           option :cipassword,
             long:        "--cipassword",
@@ -193,9 +196,10 @@ class Chef
       def validate_bridge!
         bridge = config[:bridge]
         return if bridge.nil?
-        return if VMBR_PATTERN.match?(bridge)
+        return if BRIDGE_PATTERN.match?(bridge)
 
-        ui.fatal!("--bridge #{bridge.inspect} is not a valid bridge name (expected vmbrN, e.g. vmbr0)")
+        ui.fatal!("--bridge #{bridge.inspect} is not a valid interface name " \
+                  "(1-15 chars, no whitespace or '/'; e.g. vmbr0 or an SDN VNet name)")
       end
 
       def validate_ip!
@@ -243,8 +247,8 @@ class Chef
         return if @ssh_public_key || @cipassword
 
         ui.fatal!(
-          "no SSH credential for the new VM: pass --ssh-public-key PATH, or provide a " \
-          "cloud-init password via #{ENV_CIPASSWORD} or --cipassword"
+          "no SSH credential for the new VM: pass --ssh-public-key PATH (or set the cluster's " \
+          ":ssh_public_key), or provide a cloud-init password via #{ENV_CIPASSWORD} or --cipassword"
         )
       end
 
@@ -261,7 +265,7 @@ class Chef
       # looks like a private key (a common copy-paste mistake that must never be
       # uploaded as an authorized key).
       def resolve_ssh_public_key
-        path = config[:ssh_public_key]
+        path = from_cli_or_cluster(:ssh_public_key)
         return nil if blank?(path)
 
         @ssh_public_key_path = File.expand_path(path)

data/lib/chef/knife/proxmox_vm_bootstrap.rb

@@ -95,6 +95,11 @@ class Chef
       def apply_provision_auth!(spec)
         super
 
+        # cloud-init creates the guest account as :ciuser, so the bootstrap must connect as that
+        # same user. Fall back to it when the operator did not pass an explicit --connection-user.
+        ciuser = from_cli_or_cluster(:ciuser)
+        config[:connection_user] ||= ciuser if ciuser
+
         config[:connection_password] = @cipassword if @cipassword
 
         return unless @ssh_public_key

data/lib/knife-proxmox-ve/version.rb

@@ -2,6 +2,6 @@
 
 module Knife
   module Proxmox
-    VERSION = "0.1.1"
+    VERSION = "0.1.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: knife-proxmox-ve
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Piotr Wojcieszonek