cloud-init

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

cloud-init runs on almost every cloud Linux image (Azure, AWS, GCP, OpenStack, Proxmox). At first boot it reads metadata (host name, network) and your user-data — usually a #cloud-config YAML — and applies it: create users, add SSH keys, install packages, write files, run commands. Terraform passes user-data with custom_data (Azure) or user_data (AWS).

It runs in stages (local, network, config, final); logs are in /var/log/cloud-init.log and /var/log/cloud-init-output.log.

Zo schrijf je het

cloud-init status [--wait] [--long]
cloud-init schema --config-file FILE

Belangrijkste delen

Commands

status [--wait] [--long]: Is cloud-init done? Errors?
schema -c FILE / --system: Validate user-data.
analyze show|blame: Time per stage and module.
query userdata|ds: Show user-data / datasource data.
clean [--logs] [--reboot]: Reset so it runs again at next boot (for images).
single --name MODULE: Run one module again.
collect-logs: Make a tarball of logs for support.

Opties 9

Meest gebruikt

cloud-config keys (user-data)

users: Users, groups, sudo rules, SSH keys.
ssh_authorized_keys: Keys for the default user.
packages / package_update / package_upgrade: Install and update packages.
write_files: Create files (content, path, permissions).
runcmd: Commands at the end of first boot.
bootcmd: Commands very early on every boot.
timezone / ntp: Time settings.
disk_setup / fs_setup / mounts: Disks.
ssh_pwauth: false: Disable password login.

Voorbeelden 11

$ als gewone gebruiker# als root (of met sudo)

1A secure first-boot config

$cat user-data.yaml
#cloud-config
users:
  - name: admin
    groups: wheel
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    shell: /bin/bash
    ssh_authorized_keys:
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyOnly admin@laptop
ssh_pwauth: false
disable_root: true
package_upgrade: true
packages: [firewalld, chrony, fail2ban]
runcmd:
  - systemctl enable --now firewalld chronyd
  - firewall-cmd --permanent --remove-service=cockpit && firewall-cmd --reload

2Validate before use

$cloud-init schema -c user-data.yaml --annotate
Valid schema user-data.yaml

3Write a file at first boot

$cat files.yaml
#cloud-config
write_files:
  - path: /etc/sysctl.d/90-hardening.conf
    permissions: "0644"
    content: |
      net.ipv4.conf.all.rp_filter = 1
      kernel.kptr_restrict = 2

4Pass it from Terraform (Azure)

$cat vm.tf
resource "azurerm_linux_virtual_machine" "web" {
  custom_data = base64encode(file("user-data.yaml"))
}

5Pass it with the Azure CLI

$az vm create -g rg-lab -n web1 --image RedHat:RHEL:9-lvm-gen2:latest --custom-data user-data.yaml --ssh-key-values ~/.ssh/id_ed25519.pub

6Check that it finished

#cloud-init status --wait --long
status: done

7Read the logs when something failed

#tail -50 /var/log/cloud-init-output.log
#grep -i -E "error|warn" /var/log/cloud-init.log

8Find slow steps
```
#cloud-init analyze blame | head
```
9See the user-data the VM got
```
#cloud-init query userdata
```
10Prepare a VM to become an image
```
#cloud-init clean --logs
```

11Install a container runtime at first boot

$cat containers.yaml
#cloud-config
packages: [podman, container-tools]
runcmd:
  - loginctl enable-linger admin

Let op

User-data is readable from the metadata service inside the VM — never put secrets in it.
The first line must be exactly #cloud-config.
Most modules run only once per instance; changing user-data later does nothing without cloud-init clean.

Bestanden

/etc/cloud/cloud.cfg: Main config and module list.
/etc/cloud/cloud.cfg.d/: Extra config files.
/var/lib/cloud/: State, the user-data copy, per-instance data.
/var/log/cloud-init.log, /var/log/cloud-init-output.log: Logs.

Tips om te onthouden

Keep user-data small; put the big setup into Ansible or into the image (Packer).

Exitcodes

`0`	Success (status: done).
`1`	Error (unrecoverable).
`2`	Done with recoverable errors (status).

`cloud-init`

Wat het doet

Zo schrijf je het

Belangrijkste delen

Commands

Opties 9

cloud-config keys (user-data)

Voorbeelden 11

1A secure first-boot config

2Validate before use

3Write a file at first boot

4Pass it from Terraform (Azure)

5Pass it with the Azure CLI

6Check that it finished

7Read the logs when something failed

8Find slow steps

9See the user-data the VM got

10Prepare a VM to become an image

11Install a container runtime at first boot

Let op

Bestanden

Tips om te onthouden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Belangrijkste delen

Commands

Opties 9

cloud-config keys (user-data)

Voorbeelden 11

1A secure first-boot config

2Validate before use

3Write a file at first boot

4Pass it from Terraform (Azure)

5Pass it with the Azure CLI

6Check that it finished

7Read the logs when something failed

8Find slow steps

9See the user-data the VM got

10Prepare a VM to become an image

11Install a container runtime at first boot

Let op

Bestanden

Tips om te onthouden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`cloud-init`