Configure system settings by using cloud-init

You can use cloud-init to configure various system settings during the initial boot process of your Red Hat Enterprise Linux (RHEL) virtual machine or cloud instance.

It includes setting up authentication methods, managing Red Hat subscriptions, configuring static networking, setting up container storage, running custom shell scripts, and changing system locale settings. With these configuration options, you can automate the setup of your RHEL systems in cloud environments, ensuring consistent and repeatable deployments.

Overview of authentication configuration in cloud-init
Copy link

To manage users, configure access rights and sudo privileges, set or reset the root password, and require password changes at first login for virtual machine (VM), you can use the cloud-init utility

Procedure
Copy link

  • Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory:
    Note

    All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.
  • To add users and user options, follow these steps:
    • By default, users are labeled as unconfined_u if there is not an selinux-user value. Note

      This example places the user user2 into two groups: users and wheel.

    • Add or modify the users section to add users. For example: 
      #cloud-config
users:
  - default
  - name: user2
    gecos: User N. Ame
    selinux-user: staff_u
    groups: users,wheel
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AA..vz user@domain.com
chpasswd:
  list: |
    root:password
    cloud-user:mypassword
    user2:mypassword2
  expire: False
    • If you want cloud-user to be the default user created along with the other users you specify, ensure that you add default as the first entry in the section. If it is not the first entry, cloud-user is not created.
  • To add a sudo user to the users list, follow these steps:
    • Add a sudo entry and specify the user access. For example, sudo: ALL=(ALL) NOPASSWD:ALL allows a user unrestricted user access.
    • Add a groups entry and specify the groups that include the user: 
      #cloud-config
users:
  - default
  - name: user2
    gecos: User D. Two
    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
    groups: wheel,adm,systemd-journal
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AA...vz user@domain.com
chpasswd:
  list: |
    root:password
    cloud-user:mypassword
    user2:mypassword2
  expire: False
  • To configure an exclusive root access for a user, follow these steps:
    • Create an entry for the user root in the users section by modifying the name option: 
      users:
  - name: root
chpasswd:
  list: |
    root:password
  expire: False
    • Optional: Configure SSH keys for the root user: 
      users:
  - name: root
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AA..vz user@domain.com
  • To change the default cloud-init user name, follow these steps:
    • Add the line user: <username>, replacing <username> with the new default user name: 
      #cloud-config
user: username
password: mypassword
chpasswd: {expire: False}
ssh_pwauth: True
ssh_authorized_keys:
  - ssh-rsa AAA...SDvz user1@yourdomain.com
  - ssh-rsa AAB...QTuo user2@yourdomain.com
  • To reset a password for a new user, follow these steps:
    • Change the line chpasswd: {expire: False} to chpasswd: {expire: True}: 
      #cloud-config
password: mypassword
chpasswd: {expire: True}
ssh_pwauth: True
ssh_authorized_keys:
  - ssh-rsa AAA...SDvz user1@yourdomain.com
  - ssh-rsa AAB...QTuo user2@yourdomain.com
    • This step expires the password because password and chpasswd operate on the default user by default.
    • This is a global setting. When you set chpasswd to True, all users you create need to change their passwords when they log in.
  • To set a root password, follow these steps:
    • Create a user list in the chpasswd section: Note
      • White space is significant. Do not include white space before or after the colon in your user list. If you include white space, the password is set with a space in it.
      • If you use this method to set the user password, you must set all passwords in this section.
      #cloud-config
ssh_pwauth: True
ssh_authorized_keys:
  - ssh-rsa AAA...SDvz user1@yourdomain.com
  - ssh-rsa AAB...QTuo user2@yourdomain.com
chpasswd:
  list: |
     root:myrootpassword
     cloud-user:mypassword
  expire: False

Red Hat subscription management with cloud-init
Copy link

To register your system with Red Hat Subscription Management, you can use the rh_subscription directive in cloud-init. Configure the directive with username and password, activation key and organization, or a custom server hostname.

Using the default option

Under rh_subscription, add your username and password.

rh_subscription:
  username: <example@redhat.com>
  password: <example_password>
Using the activation-key and org options

Under rh_subscription, add your activation key and org number.

rh_subscription:
  activation-key: <example_key>
  org: <example_id>
Using the server-hostname option

You can set a server hostname in the /etc/rhsm/rhsm.conf file. Under rh_subscription, add your username, password, and server-hostname.

rh_subscription:
  username: <example@redhat.com>
  password: <example_password>
  server-hostname: <test.example.com>

Configure a static networking configuration by using cloud-init
Copy link

To configure network configuration with cloud-init, add a network-interfaces section to the metadata. With this setting, you can configure static IP addresses, gateways, and other network settings.

Before you begin
Copy link

  • You have the default networking service provided by NetworkManager, which manages network devices and connections dynamically on Red Hat Enterprise Linux (RHEL).
  • You have confirmed whether your datasource provides a network configuration. For more information, you have consulted the relevant cloud-init documentation section.
  • You have not specified a custom network configuration for cloud-init or disabled network configuration, allowing cloud-init to detect attached devices and auto-generate a Dynamic Host Configuration Protocol (DHCP)-based configuration if an active connection exists.
  • Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory: Note

    All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

Procedure
Copy link

  • Add a network-interfaces section to the user-data file: 
    network:
  version: 1
  config:
    - type: physical
      name: eth0
      subnets:
        - type: static
          address: 192.0.2.1/24
          gateway: 192.0.2.254
  • Optional: You can also disable the network configuration: 
    network:
  config: disabled

Results
Copy link

  • Verify that the static IP address is configured on the interface: 
    # ip addr show eth0
     
    inet 192.0.2.1/24 brd 192.0.2.255 scope global eth0

    If the output displays the static IP address 192.0.2.1/24, the network configuration applied successfully.

  • Optional: Verify that the gateway is reachable by pinging it: 
    # ping -c 1 192.0.2.254

    If the ping succeeds, the gateway configuration is working correctly.

Configure container storage by using cloud-init
Copy link

You can configure container storage by referencing the container-storage-setup utility within the write_files module of cloud-init.

Before you begin
Copy link

  • Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory: Note

    All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

Procedure
Copy link

Add or modify the write_files module to include the path to the container-storage-setup utility: 
write_files:
  - path: /etc/sysconfig/docker-storage-setup
    permissions: 0644
    owner: root
    content: |
    ROOT_SIZE=6G
Note

This example sets the size of the root logical volume to 6 GB rather than the default 3 GB.

Results
Copy link

  • Verify that the container storage is configured correctly: 
    # docker info | grep "Docker Root Dir"
     
    Docker Root Dir: /var/lib/docker

    If the output displays the container storage is configured correctly.

Shell scripts with cloud-init
Copy link

You can add list values or string values to bootcmd or runcmd in cloud-init. You can also provide a shell script within userdata to run custom commands during VM initialization.

  • If you use a string value, the entire string runs as a shell script.
  • If you use a list value for bootcmd or runcmd, each list item runs in turn using execve.
  • If you want to use cloud-init to run a shell script, provide a shell script (complete with shebang #!). Use this instead of providing cloud-init with a .yaml file.

Change the system locale with cloud-init
Copy link

You can configure the system locale with the locale module in cloud-init by adding the locale directive to your configuration.

Before you begin
Copy link

  • Depending on the requirements of your datasource, edit the meta-data file. You can also add the following directive to the cloud.cfg file or the cloud.cfg.d directory.

Procedure
Copy link

Add the locale directive, specifying the location. The following sample sets the locale to ja_JP (Japan) with Unicode character encoding (UTF-8): 
# vi /etc/cloud/cloud.cfg
 
#cloud-config
locale: ja_JP.UTF-8

Results
Copy link

  • Verify that the locale is set correctly: 
    # locale

    The output should show the locale is set to ja_JP.UTF-8.