...

• feature shall support upload of template through web browser
• feature shall support upload of volume through web browser
• uploading same volume or template shall be treated as new upload by management server
• failure to upload of volume or template is irrecoverable
• management server shall ensure cleanup of partially uploaded volume or template in case of failure
• management server shall be able to give status (percentage, bytes etc) of the upload
• there shall be no restriction on size of the uploaded volume or templateadmin shall be able to see the on-going uploads
• It will use the current resource limits for templates/volumes and would error on reaching the limits. 
• Multiple files for the same template/volume will not be supported for now
• This is hypervisor agnostic and should work for all hypervisors
   

Design

This section will explain how the feature shall be implemented in CloudStack

...

1. Management Server generates a unique pre-shared key (PSK) and shares it with the SSVM agent. 
   1. key is saved in encrypted form in the configuration tables as hidden configuration with name upload.secret.key
   2. on start of management server, if the key doesnt exist, it generates one using sha1 and stores it in db
   3. when the management server sends StartCommand to SSVM agent, it shares this key with it. 
   4. SSVM agent stores this key in a file at /etc/cloudstack/agent/ms-psk.
2. New API request "getUploadParams" encoded the usual CloudStack API way using api keys. Request parameters include format, hypervisor, md5 sum etc.
3. Management Server response to (b) returns post url to upload the file, params to send to the url while uploading the file and a SHA1 signature generated using PSK and params json.  
4. User should upload the file over https POST request to the url obtained in (c). The signature and params returned in (c) should be passed as is.
5. The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the params using the key PSK and SHA1. Once the params are verified, it writes to the NFS storage to the location encoded in the URL. 
6. Once the upload completes, the MD5 checksum is compared (if available from step c). 
   

...

1. .

...

To increase the number of parallel uploads, multiple SSVMs needs to be created. This will be handled automatically by the management server using the system.vm.auto.reserve.capacity, secstorage.capacity.standby and secstorage.session.max configuration variables.

...