saltstack/salt — pull request #12291 by skrobul (2014-04-25 16:42:13+00:00)
Title: Support storing provider passwords in a keyring instead of plain-text

Hi!
I am currently working on setting up salt-cloud to manage my openstack cluster which for some reason does not support API keys. Every single request has to be authenticated with username and password, yet at the same time our security policy prohibits storing passwords in plain text (it's a bad practice anyway).

I wasn't able to find any open issues that would indicate that there is a plan to implement feature which would allow to somehow improve security on this front. Unfortunately I didn't find anything, so I took a stab at implementing [keyring](https://pypi.python.org/pypi/keyring) support. I trust this is a good choice since it supports most of the common platforms (Linux, OSX, Windows).

While I tested this to be working, there are certainly couple places where it can be improved:
* I wasn't sure what's the best way to verify if the provider (or provider:driver) is configured from within `salt.cloud.cli` without importing whole config parsing machinery, so I left it alone. In worst case, user will just create entry in a system keyring that will not match anything.

Please let me know what you think about this proposal, thanks!