public_git
/
freenas-proxmox
mirror of https://github.com/TheGrandWazoo/freenas-proxmox.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: remove sensitive-properties — store API key in storage.cfg 

PVE's sensitive-properties mechanism extracts listed keys from $param
before check_config and passes them only to on_add_hook/on_update_hook.
activate_storage reads from $cfg which never receives those values, so
the API key was always missing at runtime.

The API key now lives in storage.cfg (root-readable, mode 0640, same as
the v2.x truenas_secret field). Proper on_add_hook private-file storage
is tracked in issue #247.

Restore truenas_api_key => {} (required on create). PVE's update flow
passes $create=0 to check_config which skips absent keys, so
edit-without-changing-key still works.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Kevin Adams 2026-05-23 21:34:36 -04:00
parent efcad405e5
commit c5868dd4f6
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
perl5/PVE/Storage/Custom/TrueNAS.pm
View File

@ -37,7 +37,11 @@ sub plugindata {
return {
content => [ { images => 1, rootdir => 1 }, { images => 1 } ],
format => [ { raw => 1 }, 'raw' ],
'sensitive-properties' => { truenas_api_key => 1 },
# sensitive-properties intentionally omitted: PVE strips those keys from
# $param before check_config and passes them only to on_add_hook/on_update_hook,
# which means activate_storage never sees them. The API key lives in
# storage.cfg (root-readable only, same as the v2.x truenas_secret).
# Proper private-key storage via on_add_hook is tracked in issue #247.
};
}
@ -88,7 +92,7 @@ sub options {
bwlimit => { optional => 1 },
shared => { optional => 1 },
truenas_host => { fixed => 1 },
truenas_api_key => { optional => 1 },
truenas_api_key => {},
truenas_ssl => { optional => 1 },
truenas_ssl_verify => { optional => 1 },
truenas_pool => { fixed => 1 },