Add Proxmox Virtual Environment support by cdalar · Pull Request #790 · cdalar/onctl

cdalar · 2026-02-20T00:11:09Z

Summary

This PR adds Proxmox Virtual Environment as a new cloud provider to onctl, enabling users to manage VMs on self-hosted Proxmox infrastructure.

Changes

Added new Proxmox cloud provider implementation
Added VM lifecycle management (create, list, destroy, SSH)
Added configuration template for Proxmox VMs
Added comprehensive documentation
Updated to merge with latest main branch
Made TLS verification configurable (via proxmox.insecure setting)
Default to secure TLS (verify certificates)
Improved error handling in provider initialization

Key Features

Clone VMs from templates with custom configurations
Tag VMs with "onctl" for easy identification
Support for cloud-init and SSH key injection
Configurable network bridge and storage
Proper error handling with context-based API calls

Configuration

proxmox:
  node: pve
  insecure: false  # Set to true to skip TLS verification (for self-signed certs)
  vm:
    id: 100
    template: ubuntu-22.04-template
    username: root
    cores: 2
    memory: 2048
    storage: local-lvm
    network_bridge: vmbr0

Environment Variables

PROXMOX_API_URL - Proxmox API endpoint
PROXMOX_TOKEN_ID - API token ID
PROXMOX_SECRET - API token secret
ONCTL_CLOUD=proxmox

Testing

Build passes successfully
Follows existing cloud provider patterns
Code structure consistent with other providers

Related Issues

Closes #715 (supersedes original PR)

- Add comprehensive multi-session workspace management section to AGENTS.md - Document automatic worktree creation workflow for concurrent sessions - Include session initialization with unique timestamp-based naming - Add automatic cleanup workflow after PR merge - Document worktree management commands and troubleshooting - Support up to 10 concurrent isolated OpenCode sessions - Update session workflow to integrate worktree creation - Migrate main repository to ~/workspace/onctl for consistency

- Merged latest changes from main branch - Made TLS verification configurable via proxmox.insecure setting - Default to secure TLS (verify certificates) - Added error handling in provider initialization - Added insecure option to proxmox.yaml config template

socket-security · 2026-02-20T00:11:58Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/Telmate/proxmox-api-go@v0.0.0-20251006192222-4174b8ef68b4

View full report

internal/cloud/proxmox.go

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a8bc9fcc50

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-20T00:15:15Z

internal/cloud/proxmox.go

+	_, err := p.Client.GetVmInfo(ctx, vmRef)
+	if err == nil {
+		log.Println("VM already exists with ID:", vmID)
+		return p.getVMInfo(vmRef, server.Name)


Return error when target VM ID is already occupied

When proxmox.vm.id already exists, Deploy treats it as a successful create and returns that VM (getVMInfo) instead of failing. In the create workflow this means onctl can skip cloning and then continue SSH/apply steps against an unrelated existing VM that happens to have that ID, which is a high-impact mis-targeting scenario whenever IDs collide.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-20T00:15:15Z

internal/cloud/proxmox.go

+	vmRef := pxapi.NewVmRef(pxapi.GuestID(vmID))
+	vmRef.SetNode(viper.GetString("proxmox.node"))


Use VM's actual node when issuing destroy calls

Destroy always sets vmRef to proxmox.node from config, even when the VM was discovered elsewhere (for example after migration or config drift). In those common cluster cases, stop/delete calls are sent to the wrong node and destruction fails for a valid VM name/ID.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-20T00:15:15Z

internal/cloud/proxmox.go

+	if server.CloudInitFile != "" {
+		config["ciuser"] = viper.GetString("proxmox.vm.username")


Apply provided cloud-init content during Proxmox deploy

The Proxmox deploy path checks server.CloudInitFile but only sets ciuser; it never reads or attaches the provided cloud-init file, so onctl create --cloud-init ... is effectively ignored for this provider. This silently drops user bootstrap configuration that callers expect Deploy to apply (as done by other providers).

Useful? React with 👍 / 👎.

codecov · 2026-02-20T01:42:38Z

Codecov Report

❌ Patch coverage is 11.70732% with 181 lines in your changes missing coverage. Please review.
✅ Project coverage is 11.49%. Comparing base (bfbfeb5) to head (fab02bf).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/cloud/proxmox.go	6.48%	173 Missing ⚠️
cmd/root.go	0.00%	6 Missing ⚠️
internal/providerpxmx/common.go	85.71%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #790      +/-   ##
==========================================
- Coverage   11.54%   11.49%   -0.06%     
==========================================
  Files          36       38       +2     
  Lines        3093     3298     +205     
==========================================
+ Hits          357      379      +22     
- Misses       2693     2874     +181     
- Partials       43       45       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

- Replace p.Client.CloneQemuVm with sourceVmr.CloneQemu (new VmRef API) - Replace p.Client.StopVm with vmRef.Stop (new VmRef API) - Replace p.Client.DeleteVm with vmRef.Delete (new VmRef API) - Replace MD5 with SHA-256 for SSH key fingerprinting - Add bounds check on VM ID integer conversion (ParseUint instead of Atoi) - Make InsecureSkipVerify configurable via PROXMOX_INSECURE_SKIP_VERIFY env var

…ove codecov patch coverage

cdalar and others added 7 commits October 3, 2025 13:52

proxmox test

1c99c9a

package fix

b82e29d

fix setAPI

24a5157

fix tests

add12d3

chore

295170b

github-advanced-security bot found potential problems Feb 20, 2026

View reviewed changes

internal/cloud/proxmox.go Fixed Show fixed Hide fixed

chatgpt-codex-connector bot reviewed Feb 20, 2026

View reviewed changes

cdalar enabled auto-merge (squash) February 20, 2026 00:16

cdalar added 3 commits February 20, 2026 07:05

fix(proxmox): avoid incorrect integer conversion for VM ID (CodeQL)

bc6b5b7

test(proxmox): add unit tests for proxmox provider and client to impr…

fab02bf

…ove codecov patch coverage

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Proxmox Virtual Environment support#790

Add Proxmox Virtual Environment support#790
cdalar wants to merge 10 commits intomainfrom
ai/update-proxmox-715

cdalar commented Feb 20, 2026

Uh oh!

socket-security bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

codecov bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		vmRef := pxapi.NewVmRef(pxapi.GuestID(vmID))
		vmRef.SetNode(viper.GetString("proxmox.node"))

		if server.CloudInitFile != "" {
		config["ciuser"] = viper.GetString("proxmox.vm.username")

Conversation

cdalar commented Feb 20, 2026

Summary

Changes

Key Features

Configuration

Environment Variables

Testing

Related Issues

Uh oh!

socket-security bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security bot commented Feb 20, 2026 •

edited

Loading

codecov bot commented Feb 20, 2026 •

edited

Loading