canonical / canonical/cloud-init
meta_data.json files can not be selectively enabled/disabled/whitelisted/blacklisted
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
When a cloud provider configures ConfigDrive meta_data.json with a **files** array, the specified files are written to the guest without the guest administrator having the ability to enable/disable/whitelist/blacklist the files.
Hacks to work-around this lack of granularity:
* In some cases, the guest administrator may be able to configure a different data source without a **files** array. This remains dependent on the cloud provider providing such a data source, and does not provide the guest administrator the granularity to whitelist some set of files, or to blacklist some set of files.
* Identify the files in the **files** array, confirm that each of the files is configured as desired, then make them immuatable using `chattr +i`. As long as the file exists and is immutable, that blocks the file from being clobbered (and logs a warning). However, if the same file would later be rendered, writing the rendered file would also be blocked.
* Custom python module to modify DataSourceConfigDrive to remove/modify the **files** array.
* Disable cloud-init and configure the machine manually.
Contributor guide
Research direction
Start by reading the DataSourceConfigDrive handling for meta_data.json and its files array. Trace how the listed files are written to the guest and determine the intended configuration mechanism for selectively enabling, disabling, whitelisting, or blacklisting them. Done should provide documented, granular guest-administrator control without requiring a custom module or disabling cloud-init.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100