canonical / canonical/cloud-init

meta_data.json files can not be selectively enabled/disabled/whitelisted/blacklisted

Open
#7,033 0 comments 0 reactions 0 assignees View on GitHub
bug new
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

When a cloud provider configures ConfigDrive meta_data.json with a **files** array, the specified files are written to the guest without the guest administrator having the ability to enable/disable/whitelist/blacklist the files.

Hacks to work-around this lack of granularity:

* In some cases, the guest administrator may be able to configure a different data source without a **files** array. This remains dependent on the cloud provider providing such a data source, and does not provide the guest administrator the granularity to whitelist some set of files, or to blacklist some set of files.
* Identify the files in the **files** array, confirm that each of the files is configured as desired, then make them immuatable using `chattr +i`. As long as the file exists and is immutable, that blocks the file from being clobbered (and logs a warning). However, if the same file would later be rendered, writing the rendered file would also be blocked.
* Custom python module to modify DataSourceConfigDrive to remove/modify the **files** array.
* Disable cloud-init and configure the machine manually.

Contributor guide

Open the contributing guide

Research direction

Start by reading the DataSourceConfigDrive handling for meta_data.json and its files array. Trace how the listed files are written to the guest and determine the intended configuration mechanism for selectively enabling, disabling, whitelisting, or blacklisting them. Done should provide documented, granular guest-administrator control without requiring a custom module or disabling cloud-init.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.