# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Changed
- The driver follows the NAPALM driver standard
  (https://git.netork.io/NAPALM/driver-standard): CI on Gitea runs ruff, mypy, the
  tests on Python 3.10–3.13 and at the lowest declared versions, bandit, pip-audit and
  a build check, and a release tag publishes to PyPI. The package now ships `py.typed`.
  **Python 3.9 is no longer supported**; napalm-device-types never ran on it.
- Exceptions the driver deliberately ignores (closing the node's SSH session, the
  `is_alive()` probe) are now logged at debug level.
- The project links point at git.netork.io.

### Added
- apt's proxy (napalm-device-types' `AptProxyMixin`, NetOrk/netork#1397): `get_package_proxy()`, `get_package_proxy_report()`, `check_package_proxy(url, expect)` and the fix `configure_package_proxy(url)`, as on any Debian host. The node is logged in as root, so the file is written and other proxy lines are commented out over the exec path. Requires napalm-device-types 4.22.0; version 0.7.0.
- `get_service_packages()` (napalm-device-types' `ServicePackagesMixin`, NetOrk/netork#1236): which installed packages each systemd unit of the node is made of — the one shipping its unit file and the one shipping its `ExecStart` binary. Read-only, over the exec path. Requires napalm-device-types 4.20.0; version 0.6.0.

### Security
- The node's SSH session (the fallback for node commands and the provisioning steps) verifies its host key (NetOrk/netork#1167): the key the caller expects for port 22 in `optional_args["ssh_host_keys"]`, else the first one; every key seen goes to `optional_args["ssh_host_key_observer"]`. A changed key is refused before any login: a provisioning step fails, a best-effort read returns nothing. Both paths now share one session (`_node_ssh`). Replaces paramiko's `AutoAddPolicy`. Requires napalm-device-types 4.19.0; version 0.5.0.

### Changed
- **Breaking:** `get_device_warnings` is gone; the node reports facts and the caller
  names the warnings (netOrk #1111). lldpd and the pending updates were already facts
  (`get_packages`, `get_available_updates`). The subscription is now
  `get_licenses()` (napalm-device-types 4.14 `LicenseMixin`): one `pve-subscription`
  entry with the API's status as a `LicenseStatus` (`notfound` → `none`, `new` and
  `suspended` → `unknown`), its message as `detail`, product name and due date when
  subscribed. The old check compared against `NotFound` while the API answers
  `notfound`, so it never fired. Requires napalm-device-types 4.14.0; version 0.4.0.
- **Breaking:** `run_device_action` (`fix_snmp`, `install_lldpd`) is gone. The driver
  implements napalm-device-types 4.13's fix templates: `configure_snmp_agent(settings)`
  with the caller's community and allowed sources (one `rocommunity` line each, ufw only
  for those sources, no fixed temp file), `get_management_peer()`, and
  `install_package(name)` as the contract says, so `ensure_package` comes from the base
  package. Every step reads its exit status. Requires napalm-device-types 4.13.0;
  version 0.3.0.

### Added
- `get_system_identity()` (napalm-device-types 4.9 `SystemIdentityMixin`): the node's SMBIOS
  system UUID, product serial and board serial over the exec path, vendor placeholders
  empty. netOrk matches a server to its BMC on these. Requires napalm-device-types 4.9.0;
  version 0.2.0.
- FreeBSD and OpenBSD guests: `create_vm_from_cloud_init(guest_os=...)` with
  `GUEST_AGENTS` from napalm-device-types 3.0. A BSD guest gets OS type
  `other` and a network-config v2 snippet of its own (`cicustom network=`),
  because FreeBSD's nuageinit skips runcmd on the v1 Proxmox generates.
  OpenBSD's agent runs over ISA serial behind `serial0`, as the image keeps
  its console on com0. An unknown `guest_os` is refused before anything is
  created.
- Packed cloud images (FreeBSD's `.qcow2.xz`) are unpacked on the node after
  the packed file's checksum is verified; only the unpacked file is cached.
  Proxmox's `download-url` unpacks ISOs only, so they always go over SSH.

### Fixed
- `get_vm_status` no longer reports a loopback address as the VM's IP when
  the agent lists loopback under another name than `lo` (`lo0` on the BSDs,
  listed first by OpenBSD).
- `destroy_vm` reads the VM's cloud-init snippets before deleting the VM, and
  removes all of them; it read them afterwards, when the config was gone (#15).
- Cloud images for `create_vm_from_cloud_init` are downloaded by Proxmox itself
  when the node has an active storage with content type `import` (Proxmox
  8.2+): `download-url` with checksum verification, then `import-from` as the
  root disk. The image no longer passes through the node's root filesystem.
  Files are named `netork-<url hash>-<name>.<qcow2|raw|vmdk>` and reused;
  Ubuntu's `.img` is stored as `.qcow2`. Without such a storage, or for an
  image type Proxmox cannot import, the SSH download into
  `/var/lib/vz/template/netork-images` is used as before.
- `HypervisorDriver` contract methods `start_vm`, `stop_vm`, `reboot_vm`,
  `suspend_vm` and `get_vm_config`. They accept a VM's name or vmid, raise
  `ValueError`/`RuntimeError` instead of returning a result dict, and wait
  for the Proxmox task to finish. `power_vm` is unchanged.
- Snapshot methods `get_vm_snapshots`, `create_vm_snapshot`,
  `delete_vm_snapshot`, `rollback_vm_snapshot` for VMs and containers
  (containers never save RAM state).
- `reboot_host()` restarts the node through the API instead of SSH.

### Changed
- `get_vms()` reports `vmid` as a string (`"100"`), following
  napalm-device-types 2.0. Ordering stays numeric.

## [0.1.0] - 2024-01-01

### Added
- Initial release of the Proxmox VE NAPALM driver
- Support for classic Linux networking (`/etc/network/interfaces`, Linux bridges)
- Support for Proxmox SDN (zones: VLAN, QinQ, VXLAN, EVPN; VNets and subnets)
- Support for Open vSwitch (OVS) bridges, bonds, and internal ports
- Password and API token authentication via `proxmoxer`
- Implemented NAPALM methods:
  - `open`, `close`, `is_alive`
  - `get_facts`
  - `get_interfaces`, `get_interfaces_ip`, `get_interfaces_counters`
  - `get_environment` (CPU, memory, temperature sensors)
  - `get_arp_table` (via `/proc/net/arp`)
  - `get_mac_address_table` (Linux bridge fdb + OVS appctl)
  - `get_vlans` (SDN VNet tags + `bridge vlan show`)
  - `get_network_instances` (SDN zones as NAPALM network instances)
  - `get_ntp_servers`, `get_ntp_stats`
  - `get_snmp_information`
  - `get_users`
  - `get_config`, `load_merge_candidate`, `load_replace_candidate`
  - `compare_config`, `commit_config`, `discard_config`, `rollback`
  - `get_lldp_neighbors`, `get_lldp_neighbors_detail`
  - `get_ipv6_neighbors_table`
  - `ping`, `traceroute`, `cli`
  - `get_route_to`
- 149 unit tests with ~79% code coverage
- Full type annotations