From c5868dd4f6ffc240a986ea3efcadced2a77ead2e Mon Sep 17 00:00:00 2001 From: Kevin Adams Date: Sat, 23 May 2026 21:34:36 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20remove=20sensitive-properties=20?= =?UTF-8?q?=E2=80=94=20store=20API=20key=20in=20storage.cfg?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PVE's sensitive-properties mechanism extracts listed keys from $param before check_config and passes them only to on_add_hook/on_update_hook. activate_storage reads from $cfg which never receives those values, so the API key was always missing at runtime. The API key now lives in storage.cfg (root-readable, mode 0640, same as the v2.x truenas_secret field). Proper on_add_hook private-file storage is tracked in issue #247. Restore truenas_api_key => {} (required on create). PVE's update flow passes $create=0 to check_config which skips absent keys, so edit-without-changing-key still works. Co-Authored-By: Claude Sonnet 4.6 --- perl5/PVE/Storage/Custom/TrueNAS.pm | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/perl5/PVE/Storage/Custom/TrueNAS.pm b/perl5/PVE/Storage/Custom/TrueNAS.pm index 24399ce..b47bc61 100644 --- a/perl5/PVE/Storage/Custom/TrueNAS.pm +++ b/perl5/PVE/Storage/Custom/TrueNAS.pm @@ -37,7 +37,11 @@ sub plugindata { return { content => [ { images => 1, rootdir => 1 }, { images => 1 } ], format => [ { raw => 1 }, 'raw' ], - 'sensitive-properties' => { truenas_api_key => 1 }, + # sensitive-properties intentionally omitted: PVE strips those keys from + # $param before check_config and passes them only to on_add_hook/on_update_hook, + # which means activate_storage never sees them. The API key lives in + # storage.cfg (root-readable only, same as the v2.x truenas_secret). + # Proper private-key storage via on_add_hook is tracked in issue #247. }; } @@ -88,7 +92,7 @@ sub options { bwlimit => { optional => 1 }, shared => { optional => 1 }, truenas_host => { fixed => 1 }, - truenas_api_key => { optional => 1 }, + truenas_api_key => {}, truenas_ssl => { optional => 1 }, truenas_ssl_verify => { optional => 1 }, truenas_pool => { fixed => 1 },