podvm: allow only safe cloud-init modules #2003
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
snir911
force-pushed
the
disable_cloudinit5
branch
from
bf75f8f
to
37d60b9
Compare
Usually ssh and scripts injection modules are enabled by default, with this patch we allow only subset of modules that are considered safe or essential for cloud-providers. Makefiles reverts back to the original distribution cloud-init settings when DEBUG is set or by running make image-debug Signed-off-by: Snir Sheriber <[email protected]>
snir911
force-pushed
the
disable_cloudinit5
branch
from
37d60b9
to
d4010ba
Compare
bpradipt
approved these changes
Aug 20, 2024
There was a problem hiding this comment.
The code looks good to me.
I haven't got the opportunity to test it yet.
@mkulke @liudalibj are you ok with this approach to disable ssh for packer based images? Not sure if this will help with mkosi images for s390x as well since afaik s390x uses cloud-init.
beraldoleal
approved these changes
Aug 21, 2024
|
added hold as it seems there's some issue with ubuntu & libvirt |
|
When I try to build UBUNTU s390x image with packer from this PR. I found that the image-debug task seems doesn't work as expected: I update ...
#14 24.93 Processing triggers for libc-bin (2.31-0ubuntu9.16) ...
#14 DONE 25.9s
#15 [podvm_builder 9/9] RUN make image-debug
#15 1.054 Makefile.inc:49: A foreign ARCH was passed, but no CC alternative. Using s390x-linux-gnu-gcc as best guess
#15 1.120 ln -s -f "99_allowed_modules.cfg.template" "/src/cloud-api-adaptor/podvm/files/etc/cloud/cloud.cfg.d/99_allowed_modules.cfg"
#15 1.125 cd "./../" && ARCH=s390x make agent-protocol-forwarder
#15 1.129 make[1]: Entering directory '/src/cloud-api-adaptor'
#15 1.809 go: downloading github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f
...Which is not expected, if we are using |
|
And another found that start vm from the built the podvm image from this PR But from the VM start console log, I can found that the And if I ssh to the ip for this VSI Is this expected? |
|
Thanks for testing it @liudalibj , indeed this is not expected, firstly the link should be removed when it's in debug as you mentioned, and ssh also should be disabled when it's not in debug. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Usually ssh and scripts injection modules are enabled by default, with this patch we allow only subset of modules that are considered safe or essential for cloud-providers.
Makefiles reverts back to the original distribution cloud-init settings when DEBUG is set or by running make image-debug
This was tested on AWS and Azure with rhel podvm only as i failed to build working Ubuntu podvm from upstream (also with main) due to unrelated issue.
This is related also to #1962 , as a main goal is to disable ssh