Provision Config/Secrets to XenStore from XO

smrqdt

Is there a way to insert data into xenstore through XO when creating a VM?

I’m interested in inserting configuration (like Fedora CoreOS Ignition) or secrets (e.g. a vault token) into a VM.

Would xenstore be a “safe” place for secrets? It seems it is only accessible by the root user of the guest, so a good start. I assume it’s also properly isolated from other guests?

olivierlambert

Hi,

Indeed, only root user in the guest can read it
Any user that can see the XAPI object will be able to read it

So I would say it's "reasonably safe", but it all depends on your global usage context and level of confidentiality you need.