Page History

...

management server and SSVM will establish a pre-shared key between them, which shall be used for generating signature with SHA1
api call to get 'post url'
retrieve post url from the api response
post upload the volume/template to through http POST request to port url obtained the https POST url obtained from the 2nd step

Management Server generates a unique pre-shared key (PSK) and shares it with the SSVM agent.
New API request "getUploadParams" encoded the usual CloudStack API way using api keys. Request parameters include format, hypervisor, md5 sum etc.
Management Server response to (b) returns post url to upload the file, params to send to the url while uploading the file and a SHA1 signature generated using PSK and params json.
User should upload the file over https POST request to the url obtained in (c). The signature and params returned in (c) should be passed as is.
The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the params using the key PSK and SHA1. Once the params are verified, it writes to the NFS storage to the location encoded in the URL.
Once the upload completes, the MD5 checksum is compared (if available from step c).

...

This section shall cover when and how the pre-shared key is generated by management server, how is it stored, how is it passed to SSVM

...

on start of management server, if the key doesnt exist, it generates one using sha1 and stores it in db
key is saved in encrypted form(only when db encryption is enabled) in the configuration tables as hidden configuration with name upload.secret.key
when the management server sends StartCommand to SSVM agent, it shares this key with it.
SSVM agent stores this key in a file at /etc/cloudstack/agent/ms-psk.
if the key sharing fails SSVM agent wont start.

one time POST url and parallel uploads

...