vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-07-09 16:00:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Prefer PVE 9 guest-agent privileges in setup

Browse source 
Refs #1466
This commit is contained in:
rcourtman 2026-07-03 11:15:51 +01:00
parent 806fd7409c
commit 28cee7c467
11 changed files with 125 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/installtests/root_install_sh_test.go
View file

@ -345,6 +345,10 @@ func TestRootInstallScriptAutoRegisterUsesSecureContractShape(t *testing.T) {
`pveum aclmod /storage -token "$token_id" -role PVEDatastoreAdmin`,
`priv_string="$(IFS=,; echo "${extra_privs[*]}")"`,
`pveum role modify PulseMonitor -privs "$priv_string"`,
`pveum role add PulseGuestFileReadProbe -privs VM.GuestAgent.FileRead`,
`extra_privs+=("VM.GuestAgent.Audit")`,
`extra_privs+=("VM.GuestAgent.FileRead")`,
`extra_privs+=("VM.Monitor")`,
`slug = re.sub(r"[^a-z0-9]+", "-", host)`,
`print(f"pulse-{slug}")`,
}
@ -356,6 +360,11 @@ func TestRootInstallScriptAutoRegisterUsesSecureContractShape(t *testing.T) {
if strings.Contains(script, `local token_name="pulse-${pulse_host_slug}-$(date +%s)"`) {
t.Fatalf("root install.sh preserved stale timestamp-suffixed Proxmox token naming")
}
guestBranch := strings.Index(script, `if [[ "$has_guest_audit" == true ]]; then`)
monitorBranch := strings.Index(script, `if [[ "$has_vm_monitor" == true ]]; then`)
if guestBranch < 0 || monitorBranch < 0 || guestBranch > monitorBranch {
t.Fatalf("root install.sh must prefer VM.GuestAgent.* privileges before legacy VM.Monitor")
}
forbidden := []string{
`local bootstrap_token=""`,
`X-Setup-Token: $bootstrap_token`,