Managing group membership as a separate resource

[giganteous]

Hello,

I'm currently using this provider to create a single or more VMs in a network, and assign rights for (existing) users to be allowed to see the VM by using a proxmox_acl resource. Each network has a separate repository. The user management is done via another tofu run.

In my opion it'd be nicer if I create a new group, then manage only the membership of a (set of) user(s) in that group, and manage a single ACL that grants the group access to the VM.

But since my users are managed outside the "jurisdiction" of this repository.

My question is, would such a resource / feature be possible at all? Would it be hard?

thanks for your thoughts on this.

[666Goofy666]

hi,

the Proxmox API doesn't allow managing group members through the group itself, so the provider follows that limitation (at least for now).

couldn't you manage the users' group membership in the other repo and reference the group in proxmox_acl?

unless I'm missing something.

[bpg-dev]

Hey @giganteous 👋🏼

My question is, would such a resource / feature be possible at all? Would it be hard?

I think it is possible, and not that hard. @666Goofy666 is right that the group endpoint has no way to manage members, but membership is written through the user endpoint instead: PUT /access/users/{userid} takes groups and also has an append flag, so adding a user to a group doesn't need to touch the user's other groups. Removing a membership has no such flag, so that would be a read-modify-write of the user's group list, same as what other providers do for this kind of resource.

Checked this on PVE 9.2:

# pvesh set /access/users/tf-chk@pve --groups tf-chk-a
# pvesh get /access/users/tf-chk@pve --output-format json | jq .groups
["tf-chk-a"]
# pvesh set /access/users/tf-chk@pve --groups tf-chk-b --append 1
# pvesh get /access/users/tf-chk@pve --output-format json | jq .groups
["tf-chk-a","tf-chk-b"]
# pvesh set /access/users/tf-chk@pve --groups tf-chk-a
# pvesh get /access/users/tf-chk@pve --output-format json | jq .groups
["tf-chk-a"]
# pvesh set /access/users/tf-chk@pve --comment x
# pvesh get /access/users/tf-chk@pve --output-format json | jq .groups
["tf-chk-a"]

Append is idempotent too, calling it twice with the same group is fine.

So something like proxmox_user_group_membership with user_id + groups, managed separately from the user itself, should work for your setup: the user repo owns proxmox_user, each network repo owns its group, the membership, and the proxmox_acl pointing at the group.

There is a wrinkle tho: proxmox_user currently sends the full groups list on every update, so the user repo would see the memberships added by the network repos as drift and strip them on the next apply. You'd need lifecycle { ignore_changes = [groups] } on proxmox_user in the user repo. That's the standard trade-off with this pattern (AWS IAM has the same one), just something to be aware of.

Would you mind opening a feature request for this? Happy to take a PR too if you're up for it 🙂

[bpg-dev]

I went ahead and opened #3106 to track this.