API, users & automation

# pvesh walks the same tree as /api2/json, without HTTP
pvesh ls /nodes/pve1/qemu                          # list children
pvesh get /cluster/resources --type vm --output-format json-pretty
pvesh get /nodes/pve1/qemu/100/status/current
pvesh create /nodes/pve1/qemu/100/status/start     # POST
pvesh set /nodes/pve1/qemu/100/config --memory 4096  # PUT
pvesh delete /nodes/pve1/qemu/100/snapshot/pre-upgrade

# The same call over HTTPS with a token
curl -s -H 'Authorization: PVEAPIToken=terraform@pve!ci=2b4e1c8a-7f0d-4e7b-9a51-0c3f6d2e9b17' \
  https://pve1.example.com:8006/api2/json/nodes/pve1/qemu/100/status/current | jq .data.status

# A least-privilege identity for Terraform
pveum user add terraform@pve --comment "IaC pipeline"
pveum role add TerraformProv --privs "VM.Allocate VM.Audit VM.Clone \
  VM.Config.CDROM VM.Config.CPU VM.Config.Cloudinit VM.Config.Disk \
  VM.Config.HWType VM.Config.Memory VM.Config.Network VM.Config.Options \
  VM.PowerMgmt Datastore.AllocateSpace Datastore.Audit SDN.Use"

pveum pool add dev
pveum acl modify /pool/dev                --users terraform@pve --roles TerraformProv
pveum acl modify /storage/local-lvm       --users terraform@pve --roles TerraformProv
pveum acl modify /sdn/zones/localnetwork  --users terraform@pve --roles TerraformProv

# The token: privsep=1, so it also needs its own ACLs (a subset)
pveum user token add terraform@pve ci --privsep 1
pveum acl modify /pool/dev --tokens 'terraform@pve!ci' --roles TerraformProv

pveum user permissions terraform@pve --path /pool/dev   # debug: what does it end up with?

terraform {
  required_providers {
    proxmox = {
      source = "bpg/proxmox"
    }
  }
}

provider "proxmox" {
  endpoint  = "https://pve1.example.com:8006/"
  api_token = var.pve_api_token # "terraform@pve!ci=2b4e1c8a-…"
}

resource "proxmox_virtual_environment_vm" "web" {
  name      = "web-01"
  node_name = "pve1"
  pool_id   = "dev"

  clone {
    vm_id = 9000
    full  = false # linked clone of the template
  }

  cpu {
    cores = 2
    type  = "x86-64-v2-AES"
  }

  memory {
    dedicated = 2048
  }

  agent {
    enabled = true
  }

  network_device {
    bridge = "vmbr0"
  }

  initialization {
    ip_config {
      ipv4 {
        address = "10.0.10.31/24"
        gateway = "10.0.10.1"
      }
    }
    user_account {
      username = "ops"
      keys     = [trimspace(file("~/.ssh/id_ed25519.pub"))]
    }
  }
}