Each tenant has its own guests and its own users.
Portal
Multi-tenant management portal for Proxmox VE environments, designed for managed service providers (MSP) and IT teams. Create, assign and isolate virtual environments for clients, departments or groups while keeping centralised control over the cluster.
Features
Section titled “Features”Centralized Control
Assign guests and users to the tenants from a single point.
Easy Scalability
Add new tenants without impacting the existing infrastructure.
Intuitive Interface
Clear and well-organised frontend for administrators and tenants.
Tenant users get their own cv4pve-admin accounts with per-VM permissions.
Native Proxmox Integration
Fully compatible with existing infrastructure: no invasive changes required.
Why a portal layer when PVE has its own users and roles?
Customers see only their VMs
Tenant users log into cv4pve-admin and are granted permissions only on the VMs assigned to their tenant.
Each tenant is bound to a single cluster. Its VMs/CTs are picked from that cluster's resources.
Access is granted through cv4pve-admin's own per-VM permissions: no users or ACLs to create on the Proxmox VE cluster.
Each customer can have its own Tenant Admin, who sees only its tenant and manages the users of that tenant without asking you.
Sections
Section titled “Sections”- Overview: short description of the module
- Tenants: create and manage tenants with their assigned VMs/CTs and users
The module is available whatever cluster is selected in the cluster picker: each tenant stores the cluster it belongs to.
Tenants
Section titled “Tenants”A tenant groups VMs and containers of one cluster with the users who work on them.
The grid lists the tenants with Name and Description. The toolbar has New, Delete, Refresh and Export (Excel file with the list). Click the name of a tenant to edit it.
Delete, after confirmation, deletes the tenant. Its users are no longer in the tenant and lose the permissions on its VMs, except on a VM that is also in another tenant of the same user. They lose the Portal roles they no longer need. The accounts are not deleted.
| Field | Description |
|---|---|
| Name | Name of the tenant (required) |
| Description | Free text |
| Cluster Name | The cluster the tenant belongs to (required), picked among the enabled clusters |
Expand a tenant row to manage its content in two tabs: Vms and Users. The Users tab is shown only to users with the read permission on tenant users.
List of the VMs and containers assigned to the tenant, with their live status.
- New opens the Select VM/CT picker. It lists the guests of the tenant’s cluster that are not yet in the tenant. You can select more than one.
- A guest belongs to one tenant only: each tenant has its own admin, and a guest in two tenants would let one change what the other gave. When a guest you select is already in another tenant, nothing is added and a message names that tenant.
- Guests that were already in more than one tenant before this rule stay where they are. The Vms tab lists them in a warning, with the other tenants, to administrators who see all tenants: remove each one from all but one tenant.
- Delete removes the selected guest from the tenant, and removes from the tenant users the permissions they were given on it. The guest itself is not touched on Proxmox VE.
- Expand a guest row to open its detail panel: summary, configuration, performance, backups, replication, snapshots. What the panel shows depends on the permissions of the signed-in user.
The permissions are of the user and of the guest, not of the tenant:
- a user who also belongs to another tenant that has the same guest keeps the permissions on it;
- a permission on that guest given to a tenant user outside the Portal, in the user’s own permissions, is removed with the others.
Tenant users are regular cv4pve-admin accounts linked to the tenant. The grid shows User Name, Is Active, Lockout End and VMs (for each VM of the tenant, the permissions granted to the user). The toolbar has New, Delete, Refresh and Export. Click the user name to edit.
| Field | Description |
|---|---|
| User Name | Email address of the user (required). It cannot be changed after the user is added |
| Display Name | Name shown in the application. When empty, a new account takes the user name and an existing account keeps the name it has |
| Permission table | One row for each VM/CT of the tenant and one checkbox for each permission: Read, Audit, Console, Power Management, Replication manager, Replication Schedule Now, Snapshot manager, Snapshot Rollback, Backup manager, Backup Restore, Backup Restore File |
How accounts are handled:
- If no account with that user name exists, cv4pve-admin creates a new active account with a random password and the same address as email. It sends a confirmation email to that address.
- If the account already exists, a confirmation shows the roles it has. When you confirm, the account is linked to the tenant and keeps its password, its roles and its permissions: adding an administrator to a tenant does not limit what that administrator can do. Only an administrator who sees all tenants can link an existing account, for example a supplier who works for two customers.
- The checked permissions are granted to the user only on that VM of the tenant’s cluster. Unchecked ones are removed, except on a VM that is also in another tenant of the same user.
- Delete removes the user from the tenant together with the permissions on the tenant’s VMs, except on a VM that is also in another tenant of the same user. The account is not deleted.
- When the tenant has no VMs the dialog shows No VMs assigned to this tenant. Assign the VMs first, then set the permissions of the users.
No user or ACL is created on the Proxmox VE cluster.
Tenant Admin
Section titled “Tenant Admin”Is Tenant Admin in the user dialog makes the user the admin of that tenant. A Tenant Admin:
- sees in the Tenants page only its tenants, and cannot create, edit or delete a tenant or add and remove its VMs;
- sees the Users tab of its tenant and adds, edits and removes the users of that tenant, choosing their permissions on the tenant’s VMs among those of the permission table;
- can make another user of the tenant a Tenant Admin;
- creates new accounts only: an address that already has an account is refused with This address cannot be added. Ask your provider., and the account is not linked;
- sets the Display Name only when it creates the account;
- cannot remove its own Is Tenant Admin nor remove itself from the tenant: another admin of the tenant, or an administrator, does it.
A tenant user who is not a Tenant Admin sees only its tenants and, inside, the Vms tab; the guests show what its permissions allow. The tenant is read from the account of the signed-in user, never from the page.
The module defines three roles.
| Role | Description |
|---|---|
| Admin for module Portal | All the permissions of the module, All tenants included |
| Portal Tenant Admin | The pages of the module, read and export of tenants and of their VMs, and all the permissions on tenant users. No permission on the VMs themselves: those are given per user and per VM in the Users tab |
| Portal Tenant User | The pages of the module and read of tenants and of their VMs |
The Portal assigns the two tenant roles by itself: a user added to a tenant gets Portal Tenant User, a user marked Is Tenant Admin gets Portal Tenant Admin. It takes them away when the user is no longer in any tenant, or no longer admin of any tenant. A role given by hand from Admin Area: Security stays.
Tenant Admins of earlier versions: at start, a user who has the Portal Tenant Admin role given by hand, not by the Portal, becomes Tenant Admin (Is Tenant Admin) of every tenant it belongs to. This is done once for each user: an Is Tenant Admin removed later is not given back at the next start.
Permissions
Section titled “Permissions”| Permission | Description |
|---|---|
| Portal | Open the module and its Overview page |
| Tenants | Open the page with that name (one permission per page) |
| All tenants | See and manage every tenant. Without it a user sees only the tenants it belongs to, and creating, editing and deleting tenants and adding and removing their VMs are refused |
| Tenants: Read, Create, Edit, Delete, Export | Tenants list and tenant dialog |
| Vms: Read, Create, Edit, Delete, Export | VMs/CTs assigned to a tenant. Create and Delete enable the New and Delete buttons of the Vms tab |
| Users: Read, Create, Edit, Delete, Export | Tenant users. Read shows the Users tab |
Proxmox VE privileges: the base (PVEAuditor) plus the following, each one only for its action.
| Privilege | Used for |
|---|---|
VM.PowerMgmt | Start, stop, shutdown, reboot, reset, suspend, resume a guest |
VM.Console | Guest console |
VM.Snapshot | Create, edit, delete a snapshot |
VM.Snapshot.Rollback | Roll back a snapshot |
VM.Replicate | Replication: Schedule Now |
VM.Backup, Datastore.AllocateSpace | Backups tab: list, configuration and deletion of backups |
Sys.Console | Node console |
Sys.PowerMgmt | Shut down, reboot a node |
The base and the rules common to all modules are in Proxmox VE Permissions.
Use Cases
Section titled “Use Cases”- MSP / Service Providers: separate environments per customer with isolated access
- Enterprise IT: department-level resource isolation on a shared cluster
- Education: assign lab environments to student groups
