Thanks for these patches! Gave this a quick spin by creating a new user and assigning the now more specific permissions.
- Checked that assigning the CertManager Role to the new user for path /nodes/<node>/certificates was possible through both the UI and pveum - Checked that the user then was able to view, upload, and remove certificates for the nodes for which the path was added (and that it was not possible for other nodes) - Checked that assigning the CertManager role for path /nodes/<node> still allowed the user to manipulate certificates - Also checked that the user could not access any other functionality even if assigned a role with more privileges The patches seemed to work as expected for me. I also had a look at the code and the changes look simple enough and good to me. I quickly checked if any other parts of PVE might be affected by these changes, but I don't think that's the case. Consider this: Reviewed-by: Michael Köppl <[email protected]> Tested-by: Michael Köppl <[email protected]> On Thu May 28, 2026 at 1:35 PM CEST, Jakob Klocker wrote: > Managing node certificates currently requires broad /nodes/{node} > permissions, which violates the least-privilege principle. This > series adds /nodes/{node}/certificates as a dedicated ACL path and > moves the relevant permission checks onto it, so certificate > management can be done without granting node-wide rights. [snip]
