cloud-init no longer processes user data on GCE in artful
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| cloud-init |
Fix Released
|
High
|
Scott Moser | ||
| cloud-init (Ubuntu) |
Fix Released
|
High
|
Scott Moser | ||
| Xenial |
Fix Released
|
Critical
|
Chad Smith | ||
| Artful |
Fix Released
|
Critical
|
Chad Smith | ||
| Bionic |
Fix Released
|
High
|
Scott Moser | ||
Bug Description
=== Begin SRU Template ===
[Impact]
Any user-data provided when creating google cloud instances is ignored so no instance customization is observed. This is a silent failure and no tracebacks in cloud-init represent that failure to the user.
Providing a simple cloud-config to set a hostname will provide a quick validation of cloud-init observing user-data.
[Test Case]
# Create cloud-config which should change the hostname, and cli prompt
$ cat > sethostname.yaml <<EOF
#cloud-config
hostname: SRU-worked
EOF
# Deploy on GCE
$ gcloud compute instances create artful-sru-test --zone=
$ gcloud compute ssh artful-sru-test
# Expect default hostname "artful-sru-test" instead of "SRU-worked"
# Look for failure symptom: populated instance-data but user-data: null
artful-sru-test:~# sudo grep user-data /run/cloud/
"instance-data": "{\"user-
"user-data": null,
# Upgrade cloud-init
# add proposed
rel=$(lsb_release -sc);
line=$(awk '1ドル == "deb" && 2ドル ~ /ubuntu.com/ {
printf("%s %s %s-proposed main universe\n", 1,ドル 2,ドル rel); exit(0) };
' "rel=$rel" /etc/apt/
echo "$line" | sudo tee /etc/apt/
sudo apt-get update -q;
sudo apt-get install cloud-init;
# Reboot 'clean' allowing new cloud-init to run against a fresh system
sudo cloud-init clean --reboot --logs
$ gcloud compute ssh artful-sru-test
# Expect to see proper hostname
SRU-worked:~# sudo cloud-init status --long;
# Validate user-data: non-null
SRU-worked:~# sudo grep user-data /run/cloud-
artful-sru-test:~# sudo grep user-data /run/cloud-
"instance-data": "{\"user-
"user-data": "I2Nsb3VkLWNvbm
[Other Info]
Upstream commit at
https:/
=== End SRU Template ===
=== Begin Original Description ===
If I pass in user data like so:
$ cat cfg
#!/bin/sh
touch /tmp/foobar
$ gcloud compute instances create aa-$(date +%y%m%d-%H%M) --image-family ubuntu-1710 --image-project ubuntu-
...
Then in the instance:
$ ls /tmp/foobar
$ sudo cat /var/lib/
$ curl "http://
#/bin/sh
touch /tmp/foobar
Related branches
- Server Team CI bot: Approve (continuous-integration)
- Scott Moser: Pending requested
-
Diff: 118 lines (+96/-0) 3 files modifiedapidebian/changelog (+7/-0)
debian/patches/cpick-40e7738-GCE-fix-reading-of-user-data-that-is-not-base64-encoded (+88/-0)
debian/patches/series (+1/-0)
- Server Team CI bot: Approve (continuous-integration)
- Scott Moser: Pending requested
-
Diff: 116 lines (+96/-0) 3 files modifiedapidebian/changelog (+7/-0)
debian/patches/cpick-40e7738-GCE-fix-reading-of-user-data-that-is-not-base64-encoded (+88/-0)
debian/patches/series (+1/-0)
- Server Team CI bot: Approve (continuous-integration)
- Scott Moser: Pending requested
-
Diff: 371 lines (+141/-27) 10 files modifiedapicloudinit/config/cc_puppet.py (+40/-14)
cloudinit/config/cc_salt_minion.py (+9/-0)
cloudinit/sources/DataSourceGCE.py (+7/-8)
cloudinit/util.py (+7/-2)
debian/changelog (+13/-0)
doc/examples/cloud-config-chef.txt (+2/-2)
tests/cloud_tests/testcases/modules/salt_minion.py (+5/-0)
tests/cloud_tests/testcases/modules/salt_minion.yaml (+5/-0)
tests/unittests/test_datasource/test_gce.py (+19/-1)
tests/unittests/test_util.py (+34/-0)
- Chad Smith: Approve
- Server Team CI bot: Approve (continuous-integration)
-
Diff: 70 lines (+26/-9) 2 files modifiedapicloudinit/sources/DataSourceGCE.py (+7/-8)
tests/unittests/test_datasource/test_gce.py (+19/-1)
Note that /tmp and /var/tmp (and possibly others) are not safe during boot:
https:/
Can you reproduce with a touch to a non-tmp path ?
- cloud-init.tar.gz Edit (42.0 KiB, application/x-tar)
I have reproduced with a non-/tmp path.
Log tarball attached.
This bug was fixed in the package cloud-init - 18.1-5-
---------------
cloud-init (18.1-5-
* New upstream snapshot.
- GCE: fix reading of user-data that is not base64 encoded. (LP: #1752711)
- doc: fix chef install from apt packages example in RTD.
- Implement puppet 4 support [Romanos Skiadas] (LP: #1446804)
- subp: Fix subp usage with non-ascii characters when no system locale.
(LP: #1751051)
- salt: configure grains in grains file rather than in minion config.
[Daniel Wallace]
-- Chad Smith <email address hidden> 2018年3月01日 15:47:04 -0700
Hello Dan, or anyone else affected,
Accepted cloud-init into artful-proposed. The package will build now and be available at https:/
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-
Further information regarding the verification process can be found at https:/
Hello Dan, or anyone else affected,
Accepted cloud-init into xenial-proposed. The package will build now and be available at https:/
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-
Further information regarding the verification process can be found at https:/
=== Abridged manual verification
### Artful
root@publishing:~# gcloud compute ssh artful-sru-test
No zone specified. Using zone [us-central1-b] for instance: [artful-sru-test].
@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:
Please contact your system administrator.
Add correct host key in /root/.
Offending ECDSA key in /root/.
remove with:
ssh-keygen -f "/root/
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-
Enter passphrase for key '/root/
Enter passphrase for key '/root/
Welcome to Ubuntu 17.10 (GNU/Linux 4.13.0-36-generic x86_64)
* Documentation: https:/
* Management: https:/
* Support: https:/
* Meltdown, Spectre and Ubuntu: What are the attack vectors,
how the fixes work, and everything else you need to know
- https:/
Get cloud support with Ubuntu Advantage Cloud Guest:
http://
0 packages can be updated.
0 updates are security updates.
Last login: Fri Mar 2 15:51:05 2018 from 67.174.121.94
root@artful-
cloud-init 17.2-35-
root@artful-
root@artful-
root@artful-
> printf("%s %s %s-proposed main universe\n", 1,ドル 2,ドル rel); exit(0) };
> ' "rel=$rel" /etc/apt/
root@artful-
deb http://
root@artful-
Hit:1 http://
Get:2 http://
Get:3 http://
Get:4 http://
...
Reading package lists...
root@artful-
...
The following packages will be upgraded:
cloud-init
1 upgraded, 0 newly installed, 0 to remove and 14 not upgraded.
Need to get 342 kB of archives.
After this operation, 1024 B of additional disk space will be used.
Get:1 http://
...
removed: verification-needed-artful
=== Abridged SRU verification ===h
NOTE: Xenial didn't publish an SRU regression per cloud-init 17.2.35, it still is on 17.1.46 which properly processes user-data.
# Xenial
root@publishing:~# gcloud compute instances create xenial-sru-test --zone=
Created [https:/
NAME ZONE MACHINE_TYPE PREEMPTIBLE INTERNAL_IP EXTERNAL_IP STATUS
xenial-sru-test us-central1-b n1-standard-1 10.128.0.2 35.184.113.47 RUNNING
root@publishing:~# gcloud compute ssh xenial-sru-test
No zone specified. Using zone [us-central1-b] for instance: [xenial-sru-test].
Warning: Permanently added 'compute.
Enter passphrase for key '/root/
Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.13.0-1011-gcp x86_64)
* Documentation: https:/
* Management: https:/
* Support: https:/
Get cloud support with Ubuntu Advantage Cloud Guest:
http://
0 packages can be updated.
0 updates are security updates.
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
root@SRU-worked:~# dpkg-query --show cloud-init
cloud-init 17.1-46-
root@SRU-worked:~# hostname xenial-sru-test # set it back so we can validate upgrade
root@SRU-worked:~# exit
logout
Connection to 35.184.113.47 closed.
root@publishing:~# gcloud compute ssh xenial-sru-test
... # Validating hostname presented in PS1
Last login: Fri Mar 2 16:55:23 2018 from 67.174.121.94
root@xenial-
root@xenial-
> printf("%s %s %s-proposed main universe\n", 1,ドル 2,ドル rel); exit(0) };
> ' "rel=$rel" /etc/apt/
root@xenial-
deb http://
root@xenial-
Hit:1 http://
Get:2 http://
Get:3 http://
Get:4 http://
...
Reading package lists...
root@xenial-
...
The following packages will be upgraded:
cloud-init
...
Setting up cloud-init (17.2-35-
root@xenial-
root@xenial-
removed: verification-needed verification-needed-xenial
# Xenial automated integration tests nocloud-lxd from https:/
Started by timer
Building remotely on torkoal (metal-amd64) in workspace /var/lib/
[cloud-
+ release=xenial
+ export http_proxy=http://
+ export apt_proxy=http://
+ sudo rm -Rf cloud-init
+ git clone https:/
Cloning into 'cloud-init'...
+ cd cloud-init
+ ./packages/bddeb -S
Creating a temporary tarball using the 'make-tarball' helper
Extracting temporary tarball 'cloud-
Creating a debian/ folder in '/tmp/tmpprhxfd
Running 'debuild -S -us -uc' in '/tmp/tmpprhxfd
Wrote 'cloud-
Wrote 'cloud-
Wrote 'cloud-
Wrote 'cloud-
Linked 'cloud-
Wrote 'cloud-
+ sbuild --nolog --dist=xenial cloud-init_
sbuild (Debian sbuild) 0.71.0 (24 Aug 2016) on torkoal
+======
| cloud-init 18.1-5-
+======
Package: cloud-init
Version: 18.1-5-
Source Version: 18.1-5-
Distribution: xenial
Machine Architecture: amd64
Host Architecture: amd64
Build Architecture: amd64
I: NOTICE: Log filtering will replace 'var/lib/
+------
| Update chroot |
+------
Get:1 http://
Hit:2 http://
Get:3 http://
Get:4 http://
Get:5 http://
Get:6 http://
Get:7 http://
Get:8 http://
Get:9 http://
Get:10 http://
Get:11 http://
Get:12 http://
Get:13 http://
# Artful automated nocloud-kvm integration test logs from https:/
Started by upstream project "cloud-
originally caused by:
Started by timer
Building remotely on torkoal (metal-amd64) in workspace /var/lib/
[cloud-
+ release=artful
+ export http_proxy=http://
+ export apt_proxy=http://
+ sudo rm -Rf cloud-init
+ git clone https:/
Cloning into 'cloud-init'...
+ cd cloud-init
+ ./packages/bddeb -S
Creating a temporary tarball using the 'make-tarball' helper
Extracting temporary tarball 'cloud-
Creating a debian/ folder in '/tmp/tmpgiu1us
Running 'debuild -S -us -uc' in '/tmp/tmpgiu1us
Wrote 'cloud-
Wrote 'cloud-
Wrote 'cloud-
Wrote 'cloud-
Linked 'cloud-
Wrote 'cloud-
+ sbuild --nolog --dist=artful cloud-init_
sbuild (Debian sbuild) 0.71.0 (24 Aug 2016) on torkoal
+======
| cloud-init 18.1-5-
+======
Package: cloud-init
Version: 18.1-5-
Source Version: 18.1-5-
Distribution: artful
Machine Architecture: amd64
Host Architecture: amd64
Build Architecture: amd64
I: NOTICE: Log filtering will replace 'var/lib/
+------
| Update chroot |
+------
Hit:1 http://
Get:2 http://
Get:3 http://
Get:4 http://
Get:5 http://
Get:6 http://
Get:7 http://
Get:8 http://
Get:9 http://
Get:10 http://
Get:11 http://
Get:12 http://
# Manual EC2 upgrade and clean install validation Xenial and Artful
csmith@uptown:~$ cat > sethostname.yaml <<EOF
> #cloud-config
> hostname: SRU-worked
> EOF
csmith@uptown:~$ EC2_INST=
csmith@uptown:~$ ssh $EC2_INST -- cat /run/cloud-
The authenticity of host 'ec2-18-
ECDSA key fingerprint is SHA256:
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ec2-18-
{
"v1": {
"datasource": "DataSourceEc2L
"errors": []
}
}
csmith@uptown:~$ ssh $EC2_INST -- grep Trace /var/log/
csmith@uptown:~$ ssh $EC2_INST "sudo sed -i 's/ $release / $release-proposed /' /etc/apt/
sudo: unable to resolve host SRU-worked
csmith@uptown:~$ ssh $EC2_INST -- sudo apt-get update;
sudo: unable to resolve host SRU-worked
Get:1 http://
Get:2 http://
Get:3 http://
Get:4 http://
Get:5 http://
Get:6 http://
Get:7 http://
Get:8 http://
Get:9 http://
Get:10 http://
Get:11 http://
Get:12 http://
Get:13 http://
Get:14 http://
Get:15 http://
Get:16 http://
Get:17 http://
Get:18 http://
Get:19 http://
Get:20 http://
Get:21 http://
Get:22 http://
This bug was fixed in the package cloud-init - 17.2-35-
---------------
cloud-init (17.2-35-
* cherry-pick 40e7738: GCE: fix reading of user-data that is not
base64 encoded. (LP: #1752711)
-- Chad Smith <email address hidden> 2018年3月01日 16:03:46 -0700
The verification of the Stable Release Update for cloud-init has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.
Validated as fixed in current GCE artful-proposed images.
This should be fixed in the latest released image on gce (20180303).
I filed https:/
$ cat /tmp/my.ud
#!/bin/sh
echo $(cat /proc/uptime) | tee /run/system-up
$ gcloud compute instances create smtest1 \
--zone=
--image-family ubuntu-1710 --image-project ubuntu-os-cloud \
--metadata-
## then on node
% cat /etc/cloud/
build_name: server
serial: 20180303
% cat /run/system-up
46.63 29.52
% cat /etc/cloud/
build_name: server
serial: 20180303
% dpkg-query --show cloud-init
cloud-init 17.2-35-
This bug was fixed in the package cloud-init - 17.2-35-
---------------
cloud-init (17.2-35-
* cherry-pick 40e7738: GCE: fix reading of user-data that is not
base64 encoded. (LP: #1752711)
cloud-init (17.2-35-
* New upstream snapshot. (LP: #1747059)
- tests: add support for logs with lxd from snap and future lxd 3.
- EC2: Fix get_instance_id called against cached datasource pickle.
- cli: fix cloud-init status to report running when before result.json
- net: accept network-config in netplan format for renaming interfaces
- Fix ssh keys validation in ssh_util [Tatiana Kholkina]
-- Chad Smith <email address hidden> 2018年3月01日 16:05:39 -0700
This bug is believed to be fixed in cloud-init in 18.2. If this is still a problem for you, please make a comment and set the state back to New
Thank you.
Tracked in GitHub Issues as https:/