canonical / canonical/cloud-init
[enhancement]: support for GRUB ds= to support more variables
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
Hi there, I'm wanting to use the grub.cfg "ds=nocloud-net\;s=" option to be able to tell the provisioning URL more hardware details: namely TPM and SecureBoot state. Currently it seems restricted to __dmi.XXXXX_.
Enterprises will have a range of hardware: from laptops with SecureBoot/TPM2 support, through desktops with SecureBoot only - and obviously virtuals as well. So passing those extra hardware details would allow the provisioning script/URL to return better storage options (I'm thinking of Ubuntu's autoinstall.yaml). eg "name: hybrid" for laptops, "name: lvm\npassword: $LUKSPASSWORD" for laptops without TPM, and plain "name: lvm" for virtuals/etc. Without this extra hardware detail, a provisioning script can only guess what *should* be in place - and my experience in multi-nationals (full of random computers) is that doesn't work well :-)
To point things in the right direction, maybe something like the following?
- __platform.secureboot__ (a file matching "/sys/firmware/efi/efivars/SecureBoot-*" is evidence of SecureBoot)
- __platform.tpm2__ ("/dev/tpm0" implies TPM)
- __platform.virtualized__ (looks hard - /proc/cpuinfo references to "hypervisor" might work? Currently I use dmi.system-manufacturer and dmi.system-product-name in the provisioning URL to infer this - maybe that's as good as it gets)
These are simple file checks - and I appreciate they do not perfectly define what I'm implying - but to do better would probably need a range of extra tools installed into initrd - which probably isn't worth it? This would probably do the right thing 99.9% of the time?
Contributor guide
Research direction
Start by tracing cloud-init's handling of the GRUB ds=nocloud-net\;s= option and the existing __dmi.XXXXX_ variables. Review how the proposed SecureBoot, TPM2, and virtualization checks could be represented, using the cited /sys/firmware/efi/efivars/SecureBoot-*, /dev/tpm0, and /proc/cpuinfo paths. Done means the supported hardware details can reach the provisioning URL without relying only on DMI values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- cloud, devops, operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100