Configuring and managing cloud-init for RHEL

• The meta-data file includes instance details.
• The user-data file includes information to create a user and grant access.

Prerequisites

• You have created a Red Hat account.
• You have downloaded a KVM guest image which has cloud-init preinstalled and cloud-init is set to run automatically on the VM.

Verification

• Check the status of the cloud-init service to confirm that the utility has completed its defined tasks:

  [cloud-user@citest-1 instance]$ cloud-init status
  status: done

  The cloud-init utility creates the cloud-init directory layout under /var/lib/cloud when it runs, and it updates or changes certain directory contents based upon the directives you have specified.

• For example, you can confirm that the datasource is NoCloud by checking the datasource file.

  $ cd /var/lib/cloud/instance
  $ cat datasource
  
  DataSourceNoCloud: DataSourceNoCloud [seed=/dev/sr0][dsmode=net]

• cloud-init copies user-data into /var/lib/cloud/instance/user-data.txt:

  $ cat user-data.txt
  
  #cloud-config
  password: cilogon
  chpasswd: {expire: False}
  ssh_pwauth: True
  ssh_authorized_keys:
    - ssh-rsa AAA...fhHQ== sample@redhat.com

• The bootcmd section executes early in the initialization process and by default runs on every boot.
• The runcmd section executes near the end of the process and is only executed during the first boot and initialization.

Prerequisites

• Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory:

  Note

  All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

• Create and describe users in a users section. If you add the users section, you must also set the default user options in that section. You can modify the section to add more users to the initial system configuration, and also set additional user options.
• Configure a user as a sudoer by adding a sudo and groups entry to the users section.
• Configure the user data so that only you have a root user access.
• Force cloud-user to change the cloud-user password at the first login to reset the password.
• Set the root password by creating a user list.

Prerequisites

• Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory:

  Note

  All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

Procedure

• To add users and user options:

  • By default, users are labeled as unconfined_u if there is not an selinux-user value.

    Note

    This example places the user user2 into two groups: users and wheel.

  • Add or modify the users section to add users. For example:

    #cloud-config
    users:
      - default
      - name: user2
        gecos: User N. Ame
        selinux-user: staff_u
        groups: users,wheel
        ssh_pwauth: True
        ssh_authorized_keys:
          - ssh-rsa AA..vz user@domain.com
    chpasswd:
      list: |
        root:password
        cloud-user:mypassword
        user2:mypassword2
      expire: False

  • If you want cloud-user to be the default user created along with the other users you specify, ensure that you add default as the first entry in the section. If it is not the first entry, cloud-user is not created.

• To add a sudo user to the users list:

  • Add a sudo entry and specify the user access. For example, sudo: ALL=(ALL) NOPASSWD:ALL allows a user unrestricted user access.

  • Add a groups entry and specify the groups that include the user:

    #cloud-config
    users:
      - default
      - name: user2
        gecos: User D. Two
        sudo: ["ALL=(ALL) NOPASSWD:ALL"]
        groups: wheel,adm,systemd-journal
        ssh_pwauth: True
        ssh_authorized_keys:
          - ssh-rsa AA...vz user@domain.com
    chpasswd:
      list: |
        root:password
        cloud-user:mypassword
        user2:mypassword2
      expire: False

• To configure an exclusive root access for a user:

  • Create an entry for the user root in the users section by modifying the name option:

    users:
      - name: root
    chpasswd:
      list: |
        root:password
      expire: False

  • Optional: Set up SSH keys for the root user:

    users:
      - name: root
        ssh_pwauth: True
        ssh_authorized_keys:
          - ssh-rsa AA..vz user@domain.com

• To change the default cloud-init user name, follow:

  • Add the line user: <username>, replacing <username> with the new default user name:

    #cloud-config
    user: username
    password: mypassword
    chpasswd: {expire: False}
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AAA...SDvz user1@yourdomain.com
      - ssh-rsa AAB...QTuo user2@yourdomain.com

• To reset a password for a new user:

  • Change the line chpasswd: {expire: False} to chpasswd: {expire: True}:

    #cloud-config
    password: mypassword
    chpasswd: {expire: True}
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AAA...SDvz user1@yourdomain.com
      - ssh-rsa AAB...QTuo user2@yourdomain.com

    Note
    • This works to expire the password because password and chpasswd operate on the default user unless you indicate otherwise.
    • This is a global setting. When you set chpasswd to True, all users you create need to change their passwords when they log in.

• To set a root password:

  • Create a user list in the chpasswd section:

    Note

    White space is significant. Do not include white space before or after the colon in your user list. If you include white space, the password is set with a space in it.

    #cloud-config
    ssh_pwauth: True
    ssh_authorized_keys:
      - ssh-rsa AAA...SDvz user1@yourdomain.com
      - ssh-rsa AAB...QTuo user2@yourdomain.com
    chpasswd:
      list: |
         root:myrootpassword
         cloud-user:mypassword
      expire: False

    Note

    If you use this method to set the user password, you must set all passwords in this section.

Prerequisites

• Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory:

  Note

  All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

Procedure

• Add a network-interfaces section. For example:

  network:
    version: 1
    config:
      - type: physical
        name: eth0
        subnets:
          - type: static
            address: 192.0.2.1/24
            gateway: 192.0.2.254

  Note

  You can disable a network configuration as follows:

  network:
    config: disabled

Prerequisites

• Depending on the requirements of your datasource, edit the user-data file or add the following directive to the cloud.cfg.d directory:

  Note

  All user directives include #cloud-config at the top of the file so that cloud-init recognizes the file as containing user directives. When you include directives in the cloud.cfg.d directory, name the file *.cfg, and always include #cloud-config at the top of the file.

Procedure

• Add or modify the write_files module to include the path to the container-storage-setup utility:

  write_files:
    - path: /etc/sysconfig/docker-storage-setup
      permissions: 0644
      owner: root
      content: |
      ROOT_SIZE=6G

  This example sets the size of the root logical volume to 6 GB rather than the default 3 GB.

• If you use a string value, the entire string runs as a shell script.
• If you use a list value for bootcmd or runcmd, each list item runs in turn using execve.
• If you want to use cloud-init to run a shell script, provide a shell script (complete with shebang #!) instead of providing cloud-init with a .yaml file.

Prerequisites

• Depending on the requirements of your datasource, edit the meta-data file. You can also add the following directive to the cloud.cfg file or the cloud.cfg.d directory.

Procedure

• Add the locale directive, specifying the location. The following sample sets the locale to ja_JP (Japan) with UTF-8 encoding.

Verification

• To check the configuration files updated by cloud-init, examine the /var/log/cloud/cloud-init.log file. Updated files are logged during instance startup with messages beginning with Writing to:

  2019-09-03 00:16:07,XXX - util.py[DEBUG]: Writing to /root/.ssh/authorized_keys - wb: [XXX] 554 bytes
  2019-09-03 00:16:08,XXX - util.py[DEBUG]: Writing to /etc/ssh/sshd_config - wb: [XXX] 3905 bytes

• For general configuration issues, review the cloud-init configuration files:

  1. Examine the /etc/cloud/cloud.cfg configuration file. Check which modules are included under cloud_init_modules, cloud_config_modules, and cloud_final_modules.
  2. Check directives (*.cfg files) in the /etc/cloud/cloud.cfg.d directory.

• If the root partition was not automatically extended, check log messages for the growpart utility.

  Note

  growpart does not support LVM. If your root partition is based in LVM, the root partition is not automatically extended upon first boot.

  • Review the /var/log/cloud-init.log and /var/log/cloud-init-output.log files for details on any specific issue.

• If the file system was not extended, check log messages for resizefs

  # grep resizefs /var/log/cloud-init.log

• Rerun cloud-init with only the init modules:

  # /usr/bin/cloud-init -d init

• Rerun cloud-init with all modules in the configuration:

  # /usr/bin/cloud-init -d modules

• Delete the cloud-init cache and force cloud-init to run after boot:

  # rm -rf /var/lib/cloud/ && /usr/bin/cloud-init -d init

• Clean directories and simulate a clean instance:

  # rm -rf /var/lib/cloud/instances/
  # rm -rf /var/lib/cloud/instance
  # rm -rf /var/lib/cloud/data/
  # reboot

• Rerun the cloud-init utility:

  # cloud-init init --local
  # cloud-init init