canonical / canonical/cloud-init

[enhancement]: support for GRUB ds= to support more variables

Open
#7,073 2 comments 0 reactions 0 assignees View on GitHub
enhancement new
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

Hi there, I'm wanting to use the grub.cfg "ds=nocloud-net\;s=" option to be able to tell the provisioning URL more hardware details: namely TPM and SecureBoot state. Currently it seems restricted to __dmi.XXXXX_.

Enterprises will have a range of hardware: from laptops with SecureBoot/TPM2 support, through desktops with SecureBoot only - and obviously virtuals as well. So passing those extra hardware details would allow the provisioning script/URL to return better storage options (I'm thinking of Ubuntu's autoinstall.yaml). eg "name: hybrid" for laptops, "name: lvm\npassword: $LUKSPASSWORD" for laptops without TPM, and plain "name: lvm" for virtuals/etc. Without this extra hardware detail, a provisioning script can only guess what *should* be in place - and my experience in multi-nationals (full of random computers) is that doesn't work well :-)

To point things in the right direction, maybe something like the following?

- __platform.secureboot__ (a file matching "/sys/firmware/efi/efivars/SecureBoot-*" is evidence of SecureBoot)
- __platform.tpm2__ ("/dev/tpm0" implies TPM)
- __platform.virtualized__ (looks hard - /proc/cpuinfo references to "hypervisor" might work? Currently I use dmi.system-manufacturer and dmi.system-product-name in the provisioning URL to infer this - maybe that's as good as it gets)

These are simple file checks - and I appreciate they do not perfectly define what I'm implying - but to do better would probably need a range of extra tools installed into initrd - which probably isn't worth it? This would probably do the right thing 99.9% of the time?

Contributor guide

Open the contributing guide

Research direction

Start by tracing cloud-init's handling of the GRUB ds=nocloud-net\;s= option and the existing __dmi.XXXXX_ variables. Review how the proposed SecureBoot, TPM2, and virtualization checks could be represented, using the cited /sys/firmware/efi/efivars/SecureBoot-*, /dev/tpm0, and /proc/cpuinfo paths. Done means the supported hardware details can reach the provisioning URL without relying only on DMI values.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
cloud, devops, operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.