Power password is returned to UI

[Huw Wilkins]

In the configuration tab for machine/kvm we display the power parameters which include the power password.

At the moment we mask the password in a password field, but really this is just a plain text password that can be easily seen.

Does the API need to return the password? If not maybe we should consider removing that from the response. In that case it would be good to return a flag for whether there is a password set so we can indicate that in the UI.

[Bill Wear (billwear)]

Previously, with libvirt, we actually showed the power password if you edited the configuration. Now it seems to be masked. What I'm not clear on is whether we intended the password to be shown when editing a machine configuration, or whether it's just an oversight. Not sure this is a bug, it might be a feature change. Moving to incomplete, suggesting that Huw send an e-mail to Adam Collard to determine our original intent.

[Huw Wilkins (huwshimi)]

Thanks Bill, I spoke to Adam and he said "I agree that we don't need to send the current password to the UI. It's important to be able to set a new password of course, but no need to see the old one"

[Björn Tillenius (bjornt)]

Agreed that we shouldn't return the password by default, but add another endpoint to get it. This way, the UI can display the password if the user explicitly asks for it.

One problem is that we don't know which parts of the power parameters are secret, though. When we add support for storing secrets in Vault, we'll have the same problem.

Marking this as Invalid since we'll do this when adding support for Vault.

[Heather Lemon (hypothetical-lemon)]

Is there a workaround for this? or something that can be added in the meantime while we wait for Vault integration?