...

1. On start of management server, if the key doesn't exist, it auto-generates one using SHA1 and stores it in db
2. Key is saved in encrypted form (if db encryption is enabled) in the configuration table as hidden configuration with name upload.post.secret.key
   
3. During SSVM start-up, the key is passed on to it by management server 
4. SSVM stores this key in a file at /etc/cloudstack/agent/ms-psk
5. If the key sharing fails SSVM agent would shut itself down
6. Updating the PSK would involve the following:
   1. Delete the upload.secret.key config from configuration table in db (manual step)
   2. Restart the MS, so that it gets regenerated again (manual step)
   3. Destroy all the existing SSVMs (manual step)
   4. When the new SSVMs starts up the key is copied to it
   5. There will be a window when the key is not in sync between management server and SSVMs

...

1. User navigates to the Templates page then switches to ISO using the "Select view" selector, then the user clicks on "Register ISO" (existing screen)
2. Register ISO form pops up (existing screen)
3. User has now the choice to provide URL of the volume/ISO (existing functionality) or Upload File from Browser (new functionality)
4. Selects File Upload from Browser then specifies the volume/ISO file (Browse...) to be uploaded
5. User fills in other existing form fields
6. User clicks OK to submit the form
7. Browser UI requests an unique upload URL using the getUploadParamsForVolume api call
8. Management server returns an upload url, encrypted metadata string which should be passed on to the upload url while doing the upload
9. Browser starts uploading using POST request to the upload URL
10. The post request completes once the template is uploaded or there was an error uploading.
11. The user can close the dialog (POST request should still be active) and use listvolumes API result to check the status of it

Open Issues

...

1. PSK length - for now it can be a fixed length, later on it can be made configurable.

2. Upload url should be active only for one call - Its partially handled now. The limitation needs to be addressed.

3. Recommended configuration of SSVM and apache web server
   

...