Skip to content

Commit ceaa227

Browse files
committed
feat: Add microvm.credentialFiles for passing credentials to guests
This commit implements `microvm.credentialFiles` a mechanism for passing credentials into guest vms from the host. Currently only support for qemu is implemented as I want to test the waters to see if you're interested in this feature, Astro. In addition to qmeu cloud-hypervisor can be supported via smbios. But it depends on [this feature being added](cloud-hypervisor/cloud-hypervisor#6951 (comment)), and also microvm-nix#336 being merged to microvm.nix cloud-hypervisor could be supported immediately, but then the secrets would be visible in the ps output. A cursory code search shows that the following additional hypervisors could be supported: - crosvm: via fw_cfg, or smbios - alioth: via fw_cfg - stratovirt: via fw_cfg (maybe smbios) kvmtool and firecracker both seem like they cannot be supported. Related: - microvm-nix#259 - microvm-nix#52
1 parent 5beafeb commit ceaa227

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

lib/runners/qemu.nix

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ let
3838

3939
qemu = overrideQemu pkgs.qemu_kvm;
4040

41-
inherit (microvmConfig) hostName vcpu mem balloon initialBalloonMem deflateOnOOM hotplugMem hotpluggedMem user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk;
41+
inherit (microvmConfig) hostName vcpu mem balloon initialBalloonMem deflateOnOOM hotplugMem hotpluggedMem user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk credentialFiles;
4242
inherit (microvmConfig.qemu) machine extraArgs serialConsole;
4343

4444
inherit (import ../. { inherit (pkgs) lib; }) withDriveLetters;
@@ -145,6 +145,8 @@ let
145145
then "console=ttyAMA0"
146146
else "";
147147

148+
systemdCredentialStrings = lib.mapAttrsToList (name: path: "name=opt/io.systemd.credentials/${name},file=${path}" ) credentialFiles;
149+
fwCfgOptions = systemdCredentialStrings;
148150

149151
in
150152
lib.warnIf (mem == 2048) ''
@@ -178,6 +180,9 @@ lib.warnIf (mem == 2048) ''
178180
"-chardev" "stdio,id=stdio,signal=off"
179181
"-device" "virtio-rng-${devType}"
180182
] ++
183+
lib.optionals (fwCfgOptions != []) [
184+
"-fw_cfg" (lib.concatStringsSep "," fwCfgOptions)
185+
] ++
181186
lib.optionals serialConsole [
182187
"-serial" "chardev:stdio"
183188
] ++

nixos-modules/microvm/options.nix

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,18 @@ in
643643
This is required for commands like `microvm -l` to function but removes reference to the uncompressed store content when using a disk image for the nix store.
644644
'';
645645
};
646+
647+
credentialFiles = mkOption {
648+
type = with types; attrsOf path;
649+
description = ''
650+
Key-value pairs of credential files that will be loaded into the vm using systemd's io.systemd.credential feature.
651+
'';
652+
example = literalExpression /* nix */ ''
653+
{
654+
SOPS_AGE_KEY = "/run/secrets/guest_microvm_age_key";
655+
}
656+
'';
657+
};
646658
};
647659

648660
imports = [

0 commit comments

Comments
 (0)