On Mon, Mar 27, 2017 at 07:58:51AM +0200, Markus Armbruster wrote:
> = What to do for 2.9 =
>
> I propose to
>
> * drop both "auth_supported" and "password-secret" from the QAPI schema
>
> * drop "password-secret" from QemuOpts
>
> * hide "keyvalue-pairs" in QemuOpts
>
> No existing usage is affected, since all these things are new in 2.9.
Maybe I'm mis-understanding what you're suggesting wrt QemuOpts, but
'password-secret' with RBD is not new in 2.9.0
It was added in 2.6.0 in this commit:
commit 60390a2192e7b38aee18db6ce7fb740498709737
Author: Daniel P. Berrange <berra...@redhat.com>
Date: Thu Jan 21 14:19:19 2016 +0000
rbd: add support for getting password from QCryptoSecret object
Currently RBD passwords must be provided on the command line
via
$QEMU -drive file=rbd:pool/image:id=myname:\
key=QVFDVm41aE82SHpGQWhBQXEwTkN2OGp0SmNJY0UrSE9CbE1RMUE=:\
auth_supported=cephx
This is insecure because the key is visible in the OS process
listing.
This adds support for an 'password-secret' parameter in the RBD
parameters that can be used with the QCryptoSecret object to
provide the password via a file:
echo "QVFDVm41aE82SHpGQWhBQXEwTkN2OGp0SmNJY0UrSE9CbE1RMUE=" > poolkey.b64
$QEMU -object secret,id=secret0,file=poolkey.b64,format=base64 \
-drive driver=rbd,filename=rbd:pool/image:id=myname:\
auth_supported=cephx,password-secret=secret0
Reviewed-by: Josh Durgin <jdur...@redhat.com>
Signed-off-by: Daniel P. Berrange <berra...@redhat.com>
Message-id: 1453385961-10718-2-git-send-email-berra...@redhat.com
Signed-off-by: Jeff Cody <jc...@redhat.com>
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
