Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add microvm.credentialFiles for passing credentials to guests #337

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: Add microvm.credentialFiles for passing credentials to guests #337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e815d4b
feat: Add `microvm.credentialFiles` for passing credentials to guests
Ramblurr Feb 18, 2025
6cccd91
feat: Add testing for `microvm.credentialFiles`
Ramblurr Mar 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions checks/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,37 @@ let
imports = [ "${modulesPath}/profiles/hardened.nix" ];
}) ];
} ]

[ {
# no
id = null;
} {
id = "credentials";
modules = [ ({ config, pkgs, ... }: {
# This is the guest vm config
microvm.credentialFiles.SECRET_BOOTSRAP_KEY = "/etc/microvm-bootstrap.secret";
microvm.testing.enableTest = builtins.elem config.microvm.hypervisor [
# Hypervisors that support systemd credentials
"qemu"
];
# TODO: need to somehow have the test harness check for the success or failure of this service.
systemd.services.test-secret-availability = {
serviceConfig = {
ImportCredential = "SECRET_BOOTSRAP_KEY";
Restart = "no";
};
path = [ pkgs.gnugrep pkgs.coreutils ];
script = ''
cat $CREDENTIALS_DIRECTORY/SECRET_BOOTSRAP_KEY | grep -q "i am super secret"
if [ $? -ne 0 ]; then
echo "Secret not found at $CREDENTIALS_DIRECTORY/SECRET_BOOTSRAP_KEY"
exit 1
fi
'';
};
}) ];
} ]

];

allVariants =
Expand Down
2 changes: 2 additions & 0 deletions checks/vm.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
# Must be big enough for the store overlay volume
virtualisation.diskSize = 4096;

environment.etc."microvm-bootstrap.secret".text = "i am super secret";

microvm.vms."${system}-${hypervisor}-example".flake = self;
};
testScript = ''
Expand Down
7 changes: 6 additions & 1 deletion lib/runners/qemu.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ let
qemu = overrideQemu (if microvmConfig.cpu == null then
pkgs.qemu_kvm else pkgs.buildPackages.qemu_full);

inherit (microvmConfig) hostName cpu vcpu mem balloonMem deflateOnOOM user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk;
inherit (microvmConfig) hostName cpu vcpu mem balloonMem deflateOnOOM user interfaces shares socket forwardPorts devices vsock graphics storeOnDisk kernel initrdPath storeDisk credentialFiles;
inherit (microvmConfig.qemu) machine extraArgs serialConsole;

inherit (import ../. { inherit (pkgs) lib; }) withDriveLetters;
Expand Down Expand Up @@ -146,6 +146,8 @@ let
then "console=ttyAMA0"
else "";

systemdCredentialStrings = lib.mapAttrsToList (name: path: "name=opt/io.systemd.credentials/${name},file=${path}" ) credentialFiles;
fwCfgOptions = systemdCredentialStrings;

in
lib.warnIf (mem == 2048) ''
Expand Down Expand Up @@ -173,6 +175,9 @@ lib.warnIf (mem == 2048) ''
"-chardev" "stdio,id=stdio,signal=off"
"-device" "virtio-rng-${devType}"
] ++
lib.optionals (fwCfgOptions != []) [
"-fw_cfg" (lib.concatStringsSep "," fwCfgOptions)
] ++
lib.optionals serialConsole [
"-serial" "chardev:stdio"
] ++
Expand Down
12 changes: 12 additions & 0 deletions nixos-modules/microvm/options.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -602,6 +602,18 @@ in
description = "Flags to pass to gensquashfs";
default = [ "-c" "zstd" "-j" "$NIX_BUILD_CORES" ];
};

credentialFiles = mkOption {
type = with types; attrsOf path;
description = ''
Key-value pairs of credential files that will be loaded into the vm using systemd's io.systemd.credential feature.
'';
example = literalExpression /* nix */ ''
{
SOPS_AGE_KEY = "/run/secrets/guest_microvm_age_key";
}
'';
};
};

config = lib.mkMerge [ {
Expand Down