Skip to content

Commit 9114bba

Browse files
committed
feat: Add microvm.credentialFiles for passing credentials to guests
This commit implements `microvm.credentialFiles` a mechanism for passing credentials into guest vms from the host. Currently only support for qemu is implemented as I want to test the waters to see if you're interested in this feature, Astro. In addition to qmeu cloud-hypervisor can be supported via smbios. But it depends on [this feature being added](cloud-hypervisor/cloud-hypervisor#6951 (comment)), and also microvm-nix#336 being merged to microvm.nix cloud-hypervisor could be supported immediately, but then the secrets would be visible in the ps output. A cursory code search shows that the following additional hypervisors could be supported: - crosvm: via fw_cfg, or smbios - alioth: via fw_cfg - stratovirt: via fw_cfg (maybe smbios) kvmtool and firecracker both seem like they cannot be supported. Related: - microvm-nix#259 - microvm-nix#52
1 parent 5e193f2 commit 9114bba

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

lib/runners/qemu.nix

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ let
4949

5050
qemu = overrideQemu qemuPkg;
5151

52-
inherit (microvmConfig) hostName vcpu mem balloon initialBalloonMem deflateOnOOM hotplugMem hotpluggedMem user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk;
52+
inherit (microvmConfig) hostName vcpu mem balloon initialBalloonMem deflateOnOOM hotplugMem hotpluggedMem user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk credentialFiles;
5353
inherit (microvmConfig.qemu) machine extraArgs serialConsole;
5454

5555

@@ -155,6 +155,8 @@ let
155155
then "console=ttyAMA0"
156156
else "";
157157

158+
systemdCredentialStrings = lib.mapAttrsToList (name: path: "name=opt/io.systemd.credentials/${name},file=${path}" ) credentialFiles;
159+
fwCfgOptions = systemdCredentialStrings;
158160

159161
in
160162
lib.warnIf (mem == 2048) ''
@@ -188,6 +190,9 @@ lib.warnIf (mem == 2048) ''
188190
"-chardev" "stdio,id=stdio,signal=off"
189191
"-device" "virtio-rng-${devType}"
190192
] ++
193+
lib.optionals (fwCfgOptions != []) [
194+
"-fw_cfg" (lib.concatStringsSep "," fwCfgOptions)
195+
] ++
191196
lib.optionals serialConsole [
192197
"-serial" "chardev:stdio"
193198
] ++

nixos-modules/microvm/options.nix

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -658,6 +658,18 @@ in
658658
This is required for commands like `microvm -l` to function but removes reference to the uncompressed store content when using a disk image for the nix store.
659659
'';
660660
};
661+
662+
credentialFiles = mkOption {
663+
type = with types; attrsOf path;
664+
description = ''
665+
Key-value pairs of credential files that will be loaded into the vm using systemd's io.systemd.credential feature.
666+
'';
667+
example = literalExpression /* nix */ ''
668+
{
669+
SOPS_AGE_KEY = "/run/secrets/guest_microvm_age_key";
670+
}
671+
'';
672+
};
661673
};
662674

663675
imports = [

0 commit comments

Comments
 (0)