engine, pve : sélection d'objets, empreinte de plan, journal d'apply, CA en ligne

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015a8P6WMRPeqdpd5VCh6jAy

internal/pve/client.go

@@ -29,6 +29,7 @@ type Options struct {
 	TokenID     string // user@realm!tokenname
 	TokenSecret string // never logged
 	CAFile      string // PEM bundle to trust (optional)
+	CAPEM       []byte // PEM bundle given inline (web UI); CAFile wins when both are set
 	Fingerprint string // SHA-256 of the leaf certificate, "AA:BB:..." (optional, pinning)
 	Insecure    bool   // skip TLS verification (lab only)
 	Timeout     time.Duration
@@ -93,14 +94,18 @@ func New(o Options) (*Client, error) {
 			}
 			return nil
 		}
-	case o.CAFile != "":
-		pem, err := os.ReadFile(o.CAFile)
-		if err != nil {
-			return nil, fmt.Errorf("cluster %s: %w", o.Name, err)
+	case o.CAFile != "" || len(o.CAPEM) > 0:
+		pem, src := o.CAPEM, "the CA certificate"
+		if o.CAFile != "" {
+			var err error
+			if pem, err = os.ReadFile(o.CAFile); err != nil {
+				return nil, fmt.Errorf("cluster %s: %w", o.Name, err)
+			}
+			src = o.CAFile
 		}
 		pool := x509.NewCertPool()
 		if !pool.AppendCertsFromPEM(pem) {
-			return nil, fmt.Errorf("cluster %s: no certificate in %s", o.Name, o.CAFile)
+			return nil, fmt.Errorf("cluster %s: no certificate in %s", o.Name, src)
 		}
 		tlsCfg.RootCAs = pool
 	case o.Insecure: