Skip to content

Rocky Linux 9 and Ubuntu 24.04 template with cloud-init doesn't reset password on next subsequent boots #9630

Closed
Closed
Rocky Linux 9 and Ubuntu 24.04 template with cloud-init doesn't reset password on next subsequent boots#9630
Milestone
unplanned

Description

@hanisirfan
hanisirfan
opened on Sep 4, 2024
ISSUE TYPE
  • Other
COMPONENT NAME
UI, cloud-init integration
CLOUDSTACK VERSION
CloudStack 4.19.1.1
OS / ENVIRONMENT

cloud-init.noarch 23.4-7.el9_4.5.0.1 on Rocky Linux 9.4 and Ubuntu 24.04

SUMMARY
STEPS TO REPRODUCE

The steps below are for Rocky Linux but somewhat identical for Ubuntu.

Basically I ran the commands below to prepare a working Rocky Linux 9.4 template with password management/reset. I'm just following the CloudStack documentation on cloud-init integration.

Install the necessary packages
```bash
# Verify the hostname is set to localhost
hostnamectl

# Update the system first
dnf -y upgrade && reboot now

# Enable EPEL repo
dnf config-manager --set-enabled crb
dnf -y install epel-release
crb enable

# Install common packages
dnf -y install curl wget nano tmux vim telnet acpid fastfetch

# Install guest agents
## QEMU agent: https://pve.proxmox.com/wiki/Qemu-guest-agent
dnf -y install qemu-guest-agent
systemctl enable --now qemu-guest-agent

## VMware agent: https://docs.vmware.com/en/VMware-Tools/12.4.0/com.vmware.vsphere.vmwaretools.doc/GUID-C48E1F14-240D-4DD1-8D4C-25B6EBE4BB0F.html
dnf -y install open-vm-tools

# Install cloud-init package
dnf -y install cloud-init

# Configure cloud-init to detect Cloudstack data source during runtime.
nano /etc/cloud/cloud.cfg.d/99_cloudstack.cfg
--------------------------------------------------------------------------------------------------------------
#cloud-config
datasource_list: [ ConfigDrive, CloudStack, None ]
datasource:
  CloudStack: {}
  None: {}
--------------------------------------------------------------------------------------------------------------

# Enable cloud-init without any aid from ds-identify
echo "policy: enabled" >  /etc/cloud/ds-identify.cfg

# Enable set_passwords module on every boot
sed -i s/" - set[_|-]passwords"/" - [set_passwords, always]"/g /etc/cloud/cloud.cfg

# Configures root password with cloud-init
## lock_passwd: false = Allow password login.
## disable_root: false = Allow root to remotely SSH
## ssh_pwauth: true = Accept password when logging into SSH
nano /etc/cloud/cloud.cfg.d/80_user.cfg
--------------------------------------------------------------------------------------------------------------
#cloud-config
system_info:
  default_user:
    name: root
    lock_passwd: false
disable_root: false
ssh_pwauth: true
--------------------------------------------------------------------------------------------------------------

# Enable Cloudstack reset SSH keys feature configure cloud-init ssh module to run on every boot.
sed -i s/" - ssh$"/" - [ssh, always]"/g /etc/cloud/cloud.cfg

# Disable cloud-init regenerating host certificates on boot.
echo "ssh_deletekeys: false" > /etc/cloud/cloud.cfg.d/49_hostkeys.cfg

# Partition management
## Install Growpart module
dnf -y install cloud-utils-growpart

## Locate the root partition.
lvs
vgs
pvs

## Every boot growpart will check and extend <PHYSICAL_VOLUME_PARTITION e.g. /dev/vda2> if there is change in size
nano /etc/cloud/cloud.cfg.d/50_growpartion.cfg
--------------------------------------------------------------------------------------------------------------
#cloud-config
growpart:
  mode: auto
  devices: ['/dev/vda2']
  ignore_growroot_disabled: false
--------------------------------------------------------------------------------------------------------------

## Extend volume group and root LV (runcmd is used) (this is for XFS filesystem)
nano /etc/cloud/cloud.cfg.d/51_extend_volume.cfg
--------------------------------------------------------------------------------------------------------------
#cloud-config
runcmd:
  - [ cloud-init-per, always, grow_VG, pvresize, /dev/vda2 ]
  - [ cloud-init-per, always, grow_LV, lvresize, -l, '+100%FREE', /dev/rocky/root ]
  - [ cloud-init-per, always, grow_FS, xfs_growfs, /dev/rocky/root ]
--------------------------------------------------------------------------------------------------------------

## Enable autoresize on every boot
sed -i s/" - runcmd"/" - [runcmd, always]"/g /etc/cloud/cloud.cfg
sed -i s/" - scripts_user"/" - [scripts_user, always]"/g /etc/cloud/cloud.cfg

## Network configuration with ConfigDrive
echo -e "\nnetwork: {}" >> /etc/cloud/cloud.cfg

# Configures cloud-init final message
#cloud-config
nano /etc/cloud/cloud.cfg.d/100_extend_volume.cfg
--------------------------------------------------------------------------------------------------------------
#cloud-config
final_message: |
  Welcome to Rocky Linux 9 running on Nebula Cloud!
--------------------------------------------------------------------------------------------------------------

# cloud-init clean up
cloud-init clean --machine-id
rm -rf /etc/sudoers.d/*

# Template clean up

## Remove the udev persistent device rules and DHCP leases
rm -f /etc/udev/rules.d/70*
rm -f /var/lib/dhclient/*
rm -f /var/lib/NetworkManager/*.lease

## Remove SSH Keys to ensure template instances doesn't have the same SSH keys.
rm -f /etc/ssh/*key*

## Cleaning log files
cat /dev/null > /var/log/audit/audit.log 2>/dev/null
cat /dev/null > /var/log/wtmp 2>/dev/null
logrotate -f /etc/logrotate.conf 2>/dev/null
rm -f /var/log/*-* /var/log/*.gz 2>/dev/null

## Set User password to expire
passwd --expire root

## Clearing User History
history -c
unset HISTFILE

## Shutdown the Instance
halt -p
EXPECTED RESULTS
When the template has "Password enabled" turned on, I'm expecting these results:
1. The instance uses the randomly generated password on the first boot.
2. The instance uses a new randomly generated password after shutting it down and using the "Reset password" icon in the UI.
ACTUAL RESULTS
1. This works.
2. The newly generated password is not being applied by cloud-init. But, on the same instance, I ran clean-init clean --logs and rebooted the instance. The new password is applied after that.

My initial thought after looking at the logs is that, the cc_set_passwords module did ran with always frequency as configured. But, it's using a cached password from CloudStack datastore.

This is my first time trying to create template especially with cloud-init being integrated. My previous tests with CloudStack is jus using the default CentOS 5 template. Tried following the issue #8767 , which resulted in the config I pasted on STEPS TO REPRODUCE section.

I have additional question, say a user change the CIDR of their guest network, will cloud-init still able to detect the metadata hosted on the VR with the other CIDR than default?

Sorry if I'm not supposed to post on GitHub and should use the mailing list instead.

Activity

  1. boring-cyborg commented on Sep 4, 2024

    @boring-cyborg
    boring-cyborgbot
    on Sep 4, 2024 – with boring-cyborg

    Thanks for opening your first issue here! Be sure to follow the issue template!

  2. hanisirfan
    changed the title [-]Rocky Linux 9 template with cloud-init doesn't reset password on next subsequent boots[/-] [+]Rocky Linux 9 and Ubuntu 24.04 template with cloud-init doesn't reset password on next subsequent boots[/+] on Sep 4, 2024
  3. DaanHoogland
    added this to Apache CloudStack BugFest - Issueson Sep 4, 2024

  4. weizhouapache commented on Sep 6, 2024

    @weizhouapache
    weizhouapache
    on Sep 6, 2024
    Member

    just for your information, I have tested the ubuntu 24.04 cloud images, the ssh and password reset worked fine
    https://cloud-images.ubuntu.com/minimal/releases/noble/release/

    it may be better to share the /var/log/cloud-init*log or journal logs

    • journalctl -xeu cloud-init
    • journalctl -xeu cloud-config

  5. top-secrett commented on Sep 9, 2024

    @top-secrett
    top-secrett
    on Sep 9, 2024

    @weizhouapache @hanisirfan I faced with same problem. I create new template from iso image. After reboot new password doesn't apply. But if I do cloud-init clean --logs command before reboot, new password applies.
    My configuration is similar

  6. weizhouapache commented on Sep 9, 2024

    @weizhouapache
    weizhouapache
    on Sep 9, 2024
    Member

    @weizhouapache @hanisirfan I faced with same problem. I create new template from iso image. After reboot new password doesn't apply. But if I do cloud-init clean --logs command before reboot, new password applies. My configuration is similar

    thanks @top-secrett
    early last week I faced a similar issue, same as you, I have to run cloud-init clean

    maybe cloud-init clean should be the last step before creating a vm template

  7. top-secrett commented on Sep 9, 2024

    @top-secrett
    top-secrett
    on Sep 9, 2024

    @weizhouapache it works only once.
    I've tryed to deal with this script https://github.com/apache/cloudstack/blob/main/setup/bindir/cloud-set-guest-password.in
    After resetting password in CS new password applyed in instance, BUT if I reboot intance again password returns to the previous one.

  8. hanisirfan commented on Sep 9, 2024

    @hanisirfan
    hanisirfan
    on Sep 9, 2024 via email
    Author

  9. top-secrett commented on Sep 10, 2024

    @top-secrett
    top-secrett
    on Sep 10, 2024

    @hanisirfan @weizhouapache I think I found a solution. Maybe It is not the best, but it works on Ubuntu 22.

    1. In /etc/cloud/cloud.cfg do not touch - set_passwords.
    2. Create service based on scipt https://github.com/apache/cloudstack/blob/main/setup/bindir/cloud-set-guest-password.in
      2.1. Place it in folder /etc/init.d/ folder with name for example "reset-cloud-password"
      2.2. chmod +x /etc/init.d/reset-cloud-password
      2.3. Add lines in script after #!/bin/bash
    ### BEGIN INIT INFO
# Provides:          password
# Required-Start:    $all
# Required-Stop:
# Default-Start:     2 3 4 5
# Default-Stop:
# Short-Description: your description here
### END INIT INFO

    And change user in script if it is necessary

    2.4. Execute command to create service systemctl enable reset-cloud-password
    2.5. Edit service systemctl edit --full reset-cloud-password
    Add lines in the end

    [Install]
WantedBy=multi-user.target

    2.6. Enable service systemctl enable reset-cloud-password

  10. top-secrett commented on Sep 11, 2024

    @top-secrett
    top-secrett
    on Sep 11, 2024

    On Almalinux 9 all works fine without script. You just neet to install wget to get password from virtual router

  11. top-secrett commented on Sep 11, 2024

    @top-secrett
    top-secrett
    on Sep 11, 2024

    @hanisirfan On Ubuntu 22 instead service with script above, I created service with script in /etc/init.d/ and enabled it. In cloud.cfg - [set_passwords, always]

    ### BEGIN INIT INFO
# Provides:          password
# Required-Start:    $all
# Required-Stop:
# Default-Start:     2 3 4 5
# Default-Stop:
# Short-Description: your description here
### END INIT INFO
cloud-init clean

  12. weizhouapache commented on Sep 12, 2024

    @weizhouapache
    weizhouapache
    on Sep 12, 2024
    Member

    @hanisirfan On Ubuntu 22 instead service with script above, I created service with script in /etc/init.d/ and enabled it. In cloud.cfg - [set_passwords, always]

    ### BEGIN INIT INFO
# Provides:          password
# Required-Start:    $all
# Required-Stop:
# Default-Start:     2 3 4 5
# Default-Stop:
# Short-Description: your description here
### END INIT INFO
cloud-init clean

    @top-secrett
    that could be a good solution. will it run before cloud-init ?

    It looks like the issue is, without cloud-init clean, cloud-init will not re-fetch userdata/metadata/password information from cloudstack VR, therefore new sshkey/password are not applied.

  13. top-secrett commented on Sep 12, 2024

    @top-secrett
    top-secrett
    on Sep 12, 2024

    will it run before cloud-init ?

    I don't know exactly, but it works. BUT I try to find another solutions, because after cloud-init clean my runcmd scripts lvresize and resize2fs don't work :(

  14. hanisirfan commented on Sep 12, 2024

    @hanisirfan
    hanisirfan
    on Sep 12, 2024
    Author

    I was having problem with Rocky Linux 9.4 and Ubuntu 24.04. Rocky now fixed but Ubuntu haven't. It's due to a bug in cloud-init. Can refer here: canonical/cloud-init#5486

  15. top-secrett commented on Sep 12, 2024

    @top-secrett
    top-secrett
    on Sep 12, 2024

    @hanisirfan thank you
    For now I found working solution. All my features like password and ssh key reset, lvresize and resize2fs work right

    
### BEGIN INIT INFO
# Provides:          password
# Required-Start:    $all
# Required-Stop:
# Default-Start:     2 3 4 5
# Default-Stop:
# Short-Description: your description here
### END INIT INFO
cloud-init clean
cloud-init init --local
cloud-init init
cloud-init modules --mode config
cloud-init modules --mode final

  16. weizhouapache commented on Sep 13, 2024

    @weizhouapache
    weizhouapache
    on Sep 13, 2024
    Member

    @hanisirfan @top-secrett
    thank you both for the sharing

  17. DaanHoogland commented on Sep 16, 2024

    @DaanHoogland
    DaanHoogland
    on Sep 16, 2024
    Contributor

    thanks guys, it sounds like this does not need fixing in CloudStack, is that right?

  18. weizhouapache commented on Sep 16, 2024

    @weizhouapache
    weizhouapache
    on Sep 16, 2024
    Member

    thanks guys, it sounds like this does not need fixing in CloudStack, is that right?

    I think yes, you are right
    you can move to a discussion

  19. apache
    locked and limited conversation to collaborators on Sep 16, 2024
  20. DaanHoogland
    converted this issue into a discussion #9690 on Sep 16, 2024
  21. github-project-automation
    moved this to Done in Apache CloudStack BugFest - Issueson Sep 16, 2024
  22. DaanHoogland
    removed this from Apache CloudStack BugFest - Issueson Dec 10, 2024
  23. DaanHoogland
    added this to the unplanned milestone on Sep 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions