summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* releasing cloud-init version 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm121.1-19-gbad84ad4-0ubuntu1_16.04.4+esm1ubuntu/xenialChad Smith2023-04-251-0/+6
|
* releasing cloud-init version 21.1-19-gbad84ad4-0ubuntu1~16.04.421.1-19-gbad84ad4-0ubuntu1_16.04.4Chad Smith2023-04-251-1/+1
|
* update changelogChad Smith2023-04-251-0/+8
|
* d/patches/backport-redact-sensitive-json sync upstream unittest fixChad Smith2023-04-251-2/+25
| | | | | Backport unittest fixes to avoid testing \r \t \n on newer versions of python because urllib.split automatically redacts those chars.
* releasing cloud-init version 21.1-19-gbad84ad4-0ubuntu1~16.04.3James Falcon2023-04-251-2/+2
|
* update changelogJames Falcon2023-04-251-0/+25
|
* d/patches: redact sensitive instance-data.json keys 640 log permChad Smith2023-04-242-0/+254
| | | | | | Backport quilt patch which addresses two runtime runtime fixes: - set perms to 640 instead of 600 on /var/log/cloud-init.log - redact nested sensitive keys from world-readable instance-data.json
* Backport postinst for LP: #2013967Chad Smith2023-04-241-0/+45
|
* update changelogJames Falcon2021-04-191-0/+9
|
* cherry pick d132356cJames Falcon2021-04-192-0/+148
| | | | LP: #1922739
* cherry-pick 83f6bbfbJames Falcon2021-04-192-0/+577
| | | | LP: #1899299
* releasing cloud-init version 21.1-19-gbad84ad4-0ubuntu1~16.04.1ubuntu/21.1-19-gbad84ad4-0ubuntu1_16.04.1James Falcon2021-03-221-1/+1
|
* debian/cloud-init.templates: Add UpCloud datasourceJames Falcon2021-03-221-3/+3
|
* debian/cloud-init.postinst: Change output log permissions on upgradeJames Falcon2021-03-222-0/+19
| | | | | | | | In b794d426 (#847), we changed log permissions on /var/log/cloud-init.log to be owned by root:adm and have 740 permissions by default. This commit performs that same change on upgrade. LP: #1918303
* d/cloud-init.manpages: include upstream manpages in package.Daniel Watkins2021-03-222-1/+4
|
* update changelog (New upstream snapshot 21.1-19-gbad84ad4).James Falcon2021-03-221-1/+133
|
* update changelog.James Falcon2021-03-221-1/+4
|
* refresh patches against upstream/master commit bad84ad4James Falcon2021-03-222-2/+2
| | | | | | refresh patches against upstream/master commit bad84ad4: debian/patches/azure-apply-network-config-false.patch debian/patches/openstack-no-network-config.patch
* merge from upstream/master at 21.1-19-gbad84ad4James Falcon2021-03-22118-880/+5043
|\
| * .travis.yml: generate an SSH key before running tests (#848)Daniel Watkins2021-03-191-0/+1
| |
| * write passwords only to serial console, lock down cloud-init-output.log (#847)Daniel Watkins2021-03-197-16/+173
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this commit, when a user specified configuration which would generate random passwords for users, cloud-init would cause those passwords to be written to the serial console by emitting them on stderr. In the default configuration, any stdout or stderr emitted by cloud-init is also written to `/var/log/cloud-init-output.log`. This file is world-readable, meaning that those randomly-generated passwords were available to be read by any user with access to the system. This presents an obvious security issue. This commit responds to this issue in two ways: * We address the direct issue by moving from writing the passwords to sys.stderr to writing them directly to /dev/console (via util.multi_log); this means that the passwords will never end up in cloud-init-output.log * To avoid future issues like this, we also modify the logging code so that any files created in a log sink subprocess will only be owner/group readable and, if it exists, will be owned by the adm group. This results in `/var/log/cloud-init-output.log` no longer being world-readable, meaning that if there are other parts of the codebase that are emitting sensitive data intended for the serial console, that data is no longer available to all users of the system. LP: #1918303
| * Fix apt default integration test (#845)James Falcon2021-03-192-6/+28
| | | | | | | | | | | | | | | | | | | | The apt default test wasn't ported over from cloud-tests correctly. uri should be specified in the test, but it was not, so the test failed on openstack (and likely other platforms) because without a specified uri, the default uri will vary by platform. I separated this uri test out into a separate test function. Also add openstack specific test for apt configuration with no uri. Other platform-specific tests should be added here over time.
| * integration_tests: bump pycloudlib dependency (#846)Daniel Watkins2021-03-182-1/+22
| | | | | | | | | | | | The latest pycloudlib now launches official Ubuntu cloud images for xenial, meaning that `lxc exec` no longer works against them. This commit includes handling for tests which are affected by this change; further details and reasoning in the included comment.
| * Fix stack trace if vendordata_raw contained an array (#837)eb30952021-03-162-4/+15
| | | | | | | | | | | | | | | | | | | | The implementation in existing datasources means that vendordata_raw is not "raw" as it ideally would be. Instead, actual values may include bytes, string or list. If the value was a list, then the attempt to persist that data to a file in '_store_rawdata' would raise a TypeError. The change is to encode with util.json_dumps (which is safe for binary data) before writing.
| * archlinux: Fix broken locale logic (#841)Kristian Klausen2021-03-152-7/+34
| | | | | | | | | | The locale wasn't persisted correct nor set. LP: #1402406
| * Integration test for #783 (#832)James Falcon2021-03-111-5/+40
| | | | | | | | | | Newer verisons of /etc/sudoers prefer @includedir over #includedir. Ensure we handle that properly and don't include an additional #includedir when one isn't warranted.
| * integration_tests: mount more paths IN_PLACE (#838)Daniel Watkins2021-03-111-17/+27
| | | | | | | | | | This mounts the full directories that we install into systems over their corresponding paths within the system under test, getting us slightly closer to testing what a package would install.
| * Fix requiring device-number on EC2 derivatives (#836)James Falcon2021-03-082-1/+32
| | | | | | | | | | | | | | | | #342 (70dbccbb) introduced the ability to determine route-metrics based on the `device-number` provided by the EC2 IMDS. Not all datasources that subclass EC2 will have this attribute, so allow the old behavior if `device-number` is not present. LP: #1917875
| * Remove the vi comment from the part-handler example (#835)James Falcon2021-03-081-1/+0
| |
| * net: exclude OVS internal interfaces in get_interfaces (#829)Daniel Watkins2021-03-087-0/+321
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `get_interfaces` is used to in two ways, broadly: firstly, to determine the available interfaces when converting cloud network configuration formats to cloud-init's network configuration formats; and, secondly, to ensure that any interfaces which are specified in network configuration are (a) available, and (b) named correctly. The first of these is unaffected by this commit, as no clouds support Open vSwitch configuration in their network configuration formats. For the second, we check that MAC addresses of physical devices are unique. In some OVS configurations, there are OVS-created devices which have duplicate MAC addresses, either with each other or with physical devices. As these interfaces are created by OVS, we can be confident that (a) they will be available when appropriate, and (b) that OVS will name them correctly. As such, this commit excludes any OVS-internal interfaces from the set of interfaces returned by `get_interfaces`. LP: #1912844
| * tox.ini: pass OS_* environment variables to integration tests (#830)Daniel Watkins2021-03-031-2/+2
| | | | | | This allows source'd OpenStack credentials to be used for tox tests.
| * integration_tests: add OpenStack as a platform (#804)James Falcon2021-03-034-3/+51
| |
| * Add flexibility to IMDS api-version (#793)Thomas Stringer2021-03-032-26/+129
| | | | | | | | | | | | Add flexibility to IMDS api-version by having both a desired IMDS api-version and a minimum api-version. The desired api-version will be used first, and if that fails it will fall back to the minimum api-version.
| * Fix the TestApt tests using apt-key on Xenial and Hirsute (#823)Paride Legovini2021-03-031-17/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Xenial issue The `apt-key finger` format changed since Xenial. Sample Xenial output: pub 4096R/991BC93C 2018-09-17 Key fingerprint = F6EC B376 2474 EDA9 D21B 7022 8719 20D1 991B Sample Focal output: pub rsa4096 2016-04-12 [SC] EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796 What didn't change is the format of the key fingerprint, which should be enough to ensure that the right key is in place across all the supported releases. * Hirsute issue TestApt::test_ppa_source also fails on Hirsute because of a difference in how the PPA keys are added. On Focla this command: add-apt-repository ppa:simplestreams-dev/trunk install /etc/apt/trusted.gpg.d/simplestreams-dev_ubuntu_trunk.gpg, while on Hirsute the file is names simplestreams-dev-ubuntu-trunk.gpg. The filename is part of the `apt-key finger` output, and this the test fails. Only checking for the presence of the key fingerprint in apt-key also covers this case. LP: #1916629
| * doc: remove duplicate "it" from nocloud.rst (#825)V.I. Wood2021-02-251-1/+1
| |
| * archlinux: Use hostnamectl to set the transient hostname (#797)Kristian Klausen2021-02-252-0/+12
| | | | | | | | hostname (inetutils) isn't installed per default on arch, so switch to hostnamectl which is installed per default (systemd).
| * cc_keys_to_console.py: Add documentation for recently added config key (#824)dermotbradley2021-02-241-8/+14
| | | | | | | | PR #811 added a new config key, emit_keys_to_console, but didn't update the documentation for mention it.
| * Update cc_set_hostname documentation (#818)Toshi Aoyama2021-02-232-2/+3
| | | | | | It is distro dependent whether hostname or fqdn is used
| * Release 21.1 (#820)21.1Daniel Watkins2021-02-232-1/+108
| | | | | | | | | | | | Bump the version in cloudinit/version.py to 21.1 and update ChangeLog. LP: #1916540
| * Azure: Support for VMs without ephemeral resource disks. (#800)Johnson Shi2021-02-224-35/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Only merge in default Azure cloud ephemeral disk configs during DataSourceAzure._get_data() if the ephemeral disk exists. * DataSourceAzure.address_ephemeral_resize() (which is invoked in DataSourceAzure.activate() should only set up the ephemeral disk if the disk exists. Azure VMs may or may not come with ephemeral resource disks depending on the VM SKU. For VM SKUs that come with ephemeral resource disks, the Azure platform guarantees that the ephemeral resource disk is attached to the VM before the VM is booted. For VM SKUs that do not come with ephemeral resource disks, cloud-init currently attempts to wait and set up a non-existent ephemeral resource disk, which wastes boot time. It also causes disk setup modules to fail (due to non-existent references to the ephemeral resource disk). udevadm settle is invoked by cloud-init very early in boot. udevadm settle is invoked very early, before DataSourceAzure's _get_data() and activate() methods. Within DataSourceAzure's _get_data() and activate() methods, the ephemeral resource disk path should exist if the VM SKU comes with an ephemeral resource disk. The ephemeral resource disk path should not exist if the VM SKU does not come with an ephemeral resource disk. LP: #1901011
| * cc_keys_to_console: add option to disable key emission (#811)Michael Hudson-Doyle2021-02-224-0/+97
| | | | | | | | | | | | | | | | | | | | | | Specifically: ssh: emit_keys_to_console: false We also port the cc_keys_to_console cloud tests to the new integration testing framework, and add a test for this new option. LP: #1915460
| * integration_tests: introduce lxd_use_exec mark (#802)Daniel Watkins2021-02-225-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | pycloudlib has modified the way LXD executes tests (https://github.com/canonical/pycloudlib/pull/114): it will always use SSH to access them by default, instead of using `lxc exec`. This behaviour is transparent for them majority of cloud-init's integration tests, but some currently depend on using `lxc exec` to access instances with (intentionally) broken networking: obviously these are not accessible via SSH. pycloudlib retains support for switching an instance to use `lxc exec`. This commit introduces the `lxd_use_exec` mark, which tests can use to indicate to the integration testing framework that they should be so switched, and applies it to all applicable tests.
| * azure: case-insensitive UUID to avoid new IID during kernel upgrade (#798)Chad Smith2021-02-195-9/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel's newer than 4.15 present /sys/dmi/id/product_uuid as a lowercase value. Previously UUID was uppercase. Azure datasource reads the product_uuid directly as their platform's instance-id. This presents a problem if a kernel is either upgraded or downgraded across the 4.15 kernel version boundary because the case of the UUID will change, resulting in cloud-init seeing a "new" instance id and re-running all modules. Re-running cc_ssh in cloud-init deletes and regenerates ssh_host keys on a system which can cause concern on long-running instances that somethingnefarious has happened. Also add: - An integration test for this for Azure Bionic Ubuntu FIPS upgrading from a FIPS kernel with uppercase UUID to a lowercase UUID in linux-azure - A new pytest.mark.sru_next to collect all integration tests related to our next SRU LP: #1835584
| * stale.yml: don't ask submitters to reopen PRs (#816)Daniel Watkins2021-02-181-1/+1
| | | | | | | | | | Because they don't have the permissions to do it. Instead, reword the message to ask people to ping mitechie, in line with the rest of the message.
| * integration_tests: fix use of SSH agent within tox (#815)Daniel Watkins2021-02-181-2/+2
| | | | | | | | We need to allow the SSH_AUTH_SOCK environment variable through for paramiko to be able to find the agent.
| * integration_tests: add UPGRADE CloudInitSource (#812)Daniel Watkins2021-02-183-0/+12
| | | | | | | | | | This allows out-of-date images to be brought up-to-date with the archive, so that tests written against the latest cloud-init release will pass.
| * integration_tests: use unique MAC addresses for tests (#813)Daniel Watkins2021-02-186-8/+26
| | | | | | | | | | | | | | | | | | | | | | Using the same MAC address results in strange test behaviour if more than one such instance is up: traffic gets routed to an arbitrary interface with the given MAC address. This can happen if running tests in parallel, or on a system which retains test instances from previous runs. The introduction of tests/integration_tests/__init__.py means that pylint now checks the integration tests: this commit also addresses those failures.
| * Update .gitignore (#814)James Falcon2021-02-181-0/+3
| |
| * Port apt cloud_tests to integration tests (#808)James Falcon2021-02-162-52/+291
| |
| * integration_tests: fix test_gh626 on LXD VMs (#809)Daniel Watkins2021-02-161-2/+6
| | | | | | | | | | Without a MAC address match clause, the test network configuration is not applied to the primary interface in LXD VMs (which is named enp*s* rather than eth0).
View Lorry Controller Status