Open RussellAult opened 1 month ago
Files identified in the description:
plugins/modules/proxmox
If these files are incorrect, please update the component name
section of the description or use the !component
bot command.
cc @Ajpantuso @Thulium-Drake @UnderGreen @joshainglis @karmab @krauthosting click here for bot help
I think this is a very good topic you're raising. It's quite common for teams to set up either self-signed certs or internal PKI in private environments, and then distribute those CA chains to the internal clients. This way TLS can be configured without bypassing warnings.
I propose that we implement the ca_path
module argument similar to the ansible.builtin.uri
module to avoid overloading the validate_certs
module argument. The request's module allows either a boolean, or a path to a CA cert file to manage how the HTTPS trust is handled. I think this could be why the request's module's verify
keyword got misinterpreted or not fully implemented in proxmoxer. It gives the allure of a boolean, where in fact we can also supply a path to a CA cert file.
Unfortunately, the proxmoxer documentation doesn't provide much guidance in terms of customized TLS configuration.
https://docs.ansible.com/ansible/latest/collections/ansible/builtin/uri_module.html#parameter-ca_path https://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification https://proxmoxer.github.io/docs/latest/authentication/#https-backend
Summary
Currently the various
community.general.proxmox*
plugins have two documented options for dealing with TLS certs: using the PVE-generated certs and ignoring that they aren't trusted (the default), or installing trusted certs on the nodes and settingvalidate_certs
totrue
. Proxmox itself supports a third option: importing PVE's root CA certificate into the local trusted certs inventory and using it to verify the PVE-generated certs. Taking this approach with thecommunity.general.proxmox*
plugins is made complicated by the fact that the Pythonrequests
module (which is whatproxmoxer
uses to handle the actual API calls) doesn't rely on the system'sca-certificates
bundle (i.e. simply importing PVE's root CA cert into the system bundle won't makerequests
trust it).My current work-around is to set
environment: REQUESTS_CA_BUNDLE: "/path/to/pve-root-ca.pem"
(in addition toverify_certs: true
) for allcommunity.general.proxmox*
tasks, but there might be a cleaner way using thevalidate_certs
option itself. Currently, the value for this option is simply passed verbatim toproxmoxer
'sverify_ssl
parameter, andproxmoxer
in turn simply passesverify_ssl
torequests
'sverify
parameter, which accepts a path to a CA cert in addition to the usual boolean values. In theory this means it should be possible to providecommunity.general.proxmox*
'sverify_certs
with the path to a CA cert and haverequests
verify any HTTPS connections against the specified cert (and with minimal code changes to boot).Issue Type
Feature Idea
Component Name
proxmox
Additional Information
Code of Conduct