Pulumi Proxmox VE Provider

If your signing key is nearing expiration, you can extend the validity of the primary key and all its subkeys. Because expiration changes must be redistributed, you must re-publish the key to the keyserver after extending it.

Workflow:

1. Set up a temporary GNUPGHOME.
2. Re-import the existing secret key using your SIGNING_KEY file and SIGNING_PASSWORD.
3. Use --quick-set-expire to extend the validity (e.g., by 10 years).
4. Re-publish the key to the keyserver.
5. Re-export the secret key to update the self-signature with the new expiry.

export GNUPGHOME=$(mktemp -d)

# 1. Re-import the secret key
gpg --batch --pinentry-mode loopback --passphrase "$SIGNING_PASSWORD" \
  --import signing_key.asc

FPR=$(gpg -k --with-colons | awk -F: '/^fpr:/{print $10; exit}')

# 2. Extend primary key + all subkeys by 10 years
gpg --quick-set-expire "$FPR" 10y "*"

# 3. Re-publish (expiration changes must be redistributed)
gpg --keyserver keyserver.ubuntu.com --send-keys "$FPR"

# 4. Re-export the updated secret key
gpg --armor --export-secret-keys "$FPR" > signing_key.asc

Before using a generated or extended key for a release, perform these four validation steps in a fresh, temporary GNUPGHOME to ensure the export is complete and functional:

1. Structural Integrity: Verify the exported file contains both the :secret key packet: (primary) and the :secret sub key packet: (encryption subkey).
2. Expiration Check: Import the key and verify it shows [expires: <future date>] rather than [expired: ...].
3. Signing Capability: Test that the key can successfully create a detached signature and that the signature verifies.
4. Public Availability: Confirm the public key is retrievable from the keyserver (keyserver.ubuntu.com) using the fingerprint.

export GNUPGHOME=$(mktemp -d)
printf '%s\n' "$SIGNING_KEY" > "$GNUPGHOME/key.asc"

# 1) Check structural completeness
gpg --dearmor < "$GNUPGHOME/key.asc" > "$GNUPGHOME/key.gpg"
gpg --list-packets "$GNUPGHOME/key.gpg" | grep -E "packet:|expires"

# 2) Check expiration
gpg --batch --import "$GNUPGHOME/key.asc"
gpg --list-secret-keys --keyid-format=long --with-fingerprint

# 3) Test signing and verification
echo "validation" > "$GNUPGHOME/test.txt"
gpg --batch --pinentry-mode loopback --passphrase "$SIGNING_PASSWORD" \
  --local-user "$SIGNING_KEY_ID" --detach-sign "$GNUPGHOME/test.txt"
gpg --verify "$GNUPGHOME/test.txt.sig" "$GNUPGHOME/test.txt"

# 4) Check public key retrieval
gpg --keyserver keyserver.ubuntu.com --recv-keys "$SIGNING_KEY_ID"

rm -rf "$GNUPGHOME"

Version 8 introduces breaking changes to align with the upstream Terraform provider's modern framework.

Standardized Resource Names

• Legacy Namespacing: Resources that previously started with proxmox_virtual_environment_ have moved to a Legacy naming format. For example, proxmoxve:VM/virtualMachine:VirtualMachine is now proxmoxve:index/vmLegacy:VmLegacy.
• Standardized Resource IDs: For resources that have an id input exposed by the Terraform provider, this has been renamed to resourceId.

State Migration

To migrate an existing stack, export the state, update the resource tokens using a tool like sed, and re-import the state:

pulumi stack export > stack.json
# Example: updating the VirtualMachine resource token
sed -i 's/proxmoxve:VM\/virtualMachine:VirtualMachine/proxmoxve:index\/vmLegacy:VmLegacy/g' stack.json
pulumi stack import < stack.json

ID Migration

Update your code to use resourceId instead of id for applicable resources.