On Sun, Mar 29, 2026 at 03:12:25PM -0500, Andrea Bolognani via Devel wrote:
> On Tue, Feb 10, 2026 at 11:26:39PM +0530, Arun Menon via Devel wrote:
> > This commit sets the foundation for encrypting the libvirt secrets by 
> > providing a
> > secure way to pass a secret encryption key to the virtsecretd service.
> >
> > A random secret key is generated using the new virt-secret-init-encryption
> > service. This key can be consumed by the virtsecretd service.
> >
> > By using the "Before=" directive in the new virt-secret-init-encryption
> > service and using "Requires=" directive in the virtsecretd service,
> > we make sure that the daemon is run only after we have an encrypted
> > secret key file generated and placed in /var/lib/libvirt/secrets.
> > The virtsecretd service can then read the key from CREDENTIALS_DIRECTORY. 
> > [1]
> 
> [...]
> 
> > +++ b/src/remote/libvirtd.service.in
> > @@ -12,6 +12,8 @@ After=libvirtd.socket
> >  After=libvirtd-ro.socket
> >  After=libvirtd-admin.socket
> >  Requires=virtlogd.socket
> > +Requires=virt-secret-init-encryption.service
> > +After=virt-secret-init-encryption.service
> >  Wants=virtlockd.socket
> >  After=virtlogd.socket
> >  After=virtlockd.socket
> > @@ -29,6 +31,8 @@ Conflicts=xendomains.service
> >  Type=notify-reload
> >  Environment=LIBVIRTD_ARGS="--timeout 120"
> >  EnvironmentFile=-@initconfdir@/libvirtd
> > +Environment=SECRETS_ENCRYPTION_KEY=%d/secrets-encryption-key
> > +LoadCredentialEncrypted=secrets-encryption-key:@localstatedir@/lib/libvirt/secrets/secrets-encryption-key
> 
> A bit late to the party, sorry.
> 
> This change breaks the scenario in which the monolithic daemon is in
> use and the secret driver is not installed. The error messages is
> quite clear about what's wrong:
> 
>   $ sudo systemctl start libvirtd.service
>   Failed to start libvirtd.service: Unit
> virt-secret-init-encryption.service not found.
> 
> I thought I could fix things by weakening the Requires= into a Want=,
> which would feel appropriate for an optional component, however that
> doesn't work either:

Every systemd dep has a reverse which you can put in the "other" unit
file.

IOW, in virt-secret-init-encryption.service we  need

  RequiredBy: libvirtd.service

which I think would give us the semantics we need, and (hopefully)
is ignored when libvirtd.service is not present.


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Reply via email to