From: Jonathon Jongsma <jjongsma@redhat.com>
Date: Thu, 19 Jan 2023 21:52:20 +0000 (-0600)
Subject: schema: add keyfile configuration for ssh disks
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=1e2fa6d524f0e2c65c0ce703dbde22b1e8c78285;p=libvirt.git

schema: add keyfile configuration for ssh disks

Authenticating via key file to an ssh server is often preferable to
logging in via password. In order to support this functionality add a
new <identity> xml element for ssh disks that allows the user to specify
a keyfile and username. Example configuration:

    <disk type='network'>
      <source protocol='ssh' ...>
        <identity keyfile='/path/to/id_rsa' username='myusername'/>
        ...
      </source>
    ...
    </disk>

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
---

diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index 3469908959..74c714fef0 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -3020,6 +3020,13 @@ paravirtualized driver is specified via the ``disk`` element.
       of these attributes is omitted, then that field is assumed to be the
       default value for the current system. If both ``user`` and ``group``
       are intended to be default, then the entire element may be omitted.
+
+      When using an ``ssh`` protocol, this element is used to enable
+      authentication via ssh keys. In this configuration, the element has two
+      attributes. The ``username`` attribute specifies the name of the user on
+      the remote server and the ``keyfile`` attribute specifies the path to the
+      keyfile. Note that this only works for ssh keys that are not
+      password-protected.
    ``reconnect``
       For disk type ``vhostuser`` configures reconnect timeout if the connection
       is lost. This is set with the two mandatory attributes ``enabled`` and
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index 29d2f5db92..1a99a0c4e3 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -2181,6 +2181,19 @@
     </element>
   </define>
 
+  <define name="diskSourceNetworkProtocolSSHKeyDef">
+    <element name="identity">
+      <interleave>
+        <attribute name="username">
+          <ref name="genericName"/>
+        </attribute>
+        <attribute name="keyfile">
+          <ref name="absFilePath"/>
+        </attribute>
+      </interleave>
+    </element>
+  </define>
+
   <define name="diskSourceNetworkProtocolSSH">
     <element name="source">
       <interleave>
@@ -2200,11 +2213,15 @@
           <ref name="diskSourceNetworkProtocolSSHHostVerify"/>
         </optional>
         <optional>
-          <ref name="diskAuth"/>
+          <choice>
+            <ref name="diskSourceNetworkProtocolSSHKeyDef"/>
+            <ref name="diskAuth"/>
+          </choice>
         </optional>
       </interleave>
     </element>
   </define>
+
   <define name="diskSourceNetworkProtocolSimple">
     <element name="source">
       <interleave>