napalm-proxmox/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.8.0] - 2026-10-23

The first release on PyPI. It collects everything since 0.1.0.

Changed

• The driver follows the NAPALM driver standard (https://git.netork.io/NAPALM/driver-standard): CI on Gitea runs ruff, mypy, the tests on Python 3.10–3.13 and at the lowest declared versions, bandit, pip-audit and a build check, and a release tag publishes to PyPI. The package now ships py.typed. Python 3.9 is no longer supported; napalm-device-types never ran on it.
• Exceptions the driver deliberately ignores (closing the node's SSH session, the is_alive() probe) are now logged at debug level.
• The project links point at git.netork.io.

Added

• apt's proxy (napalm-device-types' AptProxyMixin, NetOrk/netork#1397): get_package_proxy(), get_package_proxy_report(), check_package_proxy(url, expect) and the fix configure_package_proxy(url), as on any Debian host. The node is logged in as root, so the file is written and other proxy lines are commented out over the exec path. Requires napalm-device-types 4.22.0; version 0.7.0.
• get_service_packages() (napalm-device-types' ServicePackagesMixin, NetOrk/netork#1236): which installed packages each systemd unit of the node is made of — the one shipping its unit file and the one shipping its ExecStart binary. Read-only, over the exec path. Requires napalm-device-types 4.20.0; version 0.6.0.

Security

• The node's SSH session (the fallback for node commands and the provisioning steps) verifies its host key (NetOrk/netork#1167): the key the caller expects for port 22 in optional_args["ssh_host_keys"], else the first one; every key seen goes to optional_args["ssh_host_key_observer"]. A changed key is refused before any login: a provisioning step fails, a best-effort read returns nothing. Both paths now share one session (_node_ssh). Replaces paramiko's AutoAddPolicy. Requires napalm-device-types 4.19.0; version 0.5.0.

Changed

• Breaking: get_device_warnings is gone; the node reports facts and the caller names the warnings (netOrk #1111). lldpd and the pending updates were already facts (get_packages, get_available_updates). The subscription is now get_licenses() (napalm-device-types 4.14 LicenseMixin): one pve-subscription entry with the API's status as a LicenseStatus (notfound → none, new and suspended → unknown), its message as detail, product name and due date when subscribed. The old check compared against NotFound while the API answers notfound, so it never fired. Requires napalm-device-types 4.14.0; version 0.4.0.
• Breaking: run_device_action (fix_snmp, install_lldpd) is gone. The driver implements napalm-device-types 4.13's fix templates: configure_snmp_agent(settings) with the caller's community and allowed sources (one rocommunity line each, ufw only for those sources, no fixed temp file), get_management_peer(), and install_package(name) as the contract says, so ensure_package comes from the base package. Every step reads its exit status. Requires napalm-device-types 4.13.0; version 0.3.0.

Added

• get_system_identity() (napalm-device-types 4.9 SystemIdentityMixin): the node's SMBIOS system UUID, product serial and board serial over the exec path, vendor placeholders empty. netOrk matches a server to its BMC on these. Requires napalm-device-types 4.9.0; version 0.2.0.
• FreeBSD and OpenBSD guests: create_vm_from_cloud_init(guest_os=...) with GUEST_AGENTS from napalm-device-types 3.0. A BSD guest gets OS type other and a network-config v2 snippet of its own (cicustom network=), because FreeBSD's nuageinit skips runcmd on the v1 Proxmox generates. OpenBSD's agent runs over ISA serial behind serial0, as the image keeps its console on com0. An unknown guest_os is refused before anything is created.
• Packed cloud images (FreeBSD's .qcow2.xz) are unpacked on the node after the packed file's checksum is verified; only the unpacked file is cached. Proxmox's download-url unpacks ISOs only, so they always go over SSH.

Fixed

• get_vm_status no longer reports a loopback address as the VM's IP when the agent lists loopback under another name than lo (lo0 on the BSDs, listed first by OpenBSD).
• destroy_vm reads the VM's cloud-init snippets before deleting the VM, and removes all of them; it read them afterwards, when the config was gone (#15).
• Cloud images for create_vm_from_cloud_init are downloaded by Proxmox itself when the node has an active storage with content type import (Proxmox 8.2+): download-url with checksum verification, then import-from as the root disk. The image no longer passes through the node's root filesystem. Files are named netork-<url hash>-<name>.<qcow2|raw|vmdk> and reused; Ubuntu's .img is stored as .qcow2. Without such a storage, or for an image type Proxmox cannot import, the SSH download into /var/lib/vz/template/netork-images is used as before.
• HypervisorDriver contract methods start_vm, stop_vm, reboot_vm, suspend_vm and get_vm_config. They accept a VM's name or vmid, raise ValueError/RuntimeError instead of returning a result dict, and wait for the Proxmox task to finish. power_vm is unchanged.
• Snapshot methods get_vm_snapshots, create_vm_snapshot, delete_vm_snapshot, rollback_vm_snapshot for VMs and containers (containers never save RAM state).
• reboot_host() restarts the node through the API instead of SSH.

Changed

• get_vms() reports vmid as a string ("100"), following napalm-device-types 2.0. Ordering stays numeric.

[0.1.0] - 2024-01-01

Added

• Initial release of the Proxmox VE NAPALM driver
• Support for classic Linux networking (/etc/network/interfaces, Linux bridges)
• Support for Proxmox SDN (zones: VLAN, QinQ, VXLAN, EVPN; VNets and subnets)
• Support for Open vSwitch (OVS) bridges, bonds, and internal ports
• Password and API token authentication via proxmoxer
• Implemented NAPALM methods:
  • open, close, is_alive
  • get_facts
  • get_interfaces, get_interfaces_ip, get_interfaces_counters
  • get_environment (CPU, memory, temperature sensors)
  • get_arp_table (via /proc/net/arp)
  • get_mac_address_table (Linux bridge fdb + OVS appctl)
  • get_vlans (SDN VNet tags + bridge vlan show)
  • get_network_instances (SDN zones as NAPALM network instances)
  • get_ntp_servers, get_ntp_stats
  • get_snmp_information
  • get_users
  • get_config, load_merge_candidate, load_replace_candidate
  • compare_config, commit_config, discard_config, rollback
  • get_lldp_neighbors, get_lldp_neighbors_detail
  • get_ipv6_neighbors_table
  • ping, traceroute, cli
  • get_route_to
• 149 unit tests with ~79% code coverage
• Full type annotations