Azure stack poc 26 1 2404

cloudinit/sources/DataSourceAzure.py

@@ -335,12 +335,16 @@ def __init__(self, sys_cfg, distro, paths):
         )
         self._iso_dev = None
         self._network_config = None
+        self._ovf_network_config = None
         self._ephemeral_dhcp_ctx: Optional[EphemeralDHCPv4] = None
         self._reported_ready_marker_file = os.path.join(
             paths.cloud_dir, "data", "reported_ready"
         )
         self._route_configured_for_imds = False
         self._route_configured_for_wireserver = False
+        self._is_azure_stack = False
+        self._disable_imds = False
+        self._disable_wireserver = False
         self._system_uuid = None
         self._vm_id = None
         self._wireserver_endpoint = DEFAULT_WIRESERVER_ENDPOINT
@@ -350,11 +354,15 @@ def _unpickle(self, ci_pkl_version: int) -> None:
 
         self._ephemeral_dhcp_ctx = None
         self._iso_dev = None
+        self._ovf_network_config = None
         self._reported_ready_marker_file = os.path.join(
             self.paths.cloud_dir, "data", "reported_ready"
         )
         self._route_configured_for_imds = False
         self._route_configured_for_wireserver = False
+        self._is_azure_stack = False
+        self._disable_imds = False
+        self._disable_wireserver = False
         self._system_uuid = None
         self._vm_id = None
         self._wireserver_endpoint = DEFAULT_WIRESERVER_ENDPOINT
@@ -705,17 +713,38 @@ def crawl_metadata(self):
             )
             report_diagnostic_event(msg, logger_func=LOG.warning)
 
+        # Azure Stack may opt out of IMDS and/or Wireserver via ovf-env.xml.
+        self._disable_imds = bool(cfg.get("DisableIMDS"))
+        self._disable_wireserver = bool(cfg.get("DisableWireserver"))
+
+        # Azure Stack may provide a native v2 network config in ovf-env.xml.
+        self._ovf_network_config = cfg.get("Network")
+
         # If we read OVF from attached media, we are provisioning.  If OVF
         # is not found, we are probably provisioning on a system which does
         # not have UDF support.  In either case, require IMDS metadata.
         # If we require IMDS metadata, try harder to obtain networking, waiting
-        # for at least 20 minutes.  Otherwise only wait 5 minutes.
-        requires_imds_metadata = bool(self._iso_dev) or ovf_source is None
-        timeout_minutes = 20 if requires_imds_metadata else 5
-        try:
-            self._setup_ephemeral_networking(timeout_minutes=timeout_minutes)
-        except NoDHCPLeaseError:
-            pass
+        # for at least 20 minutes.  Otherwise only wait 5 minutes.  With IMDS
+        # disabled we never query it, so do not wait longer on its behalf.
+        # Networking only exists to reach IMDS and/or Wireserver, so skip DHCP
+        # entirely when both are disabled.
+        if self._disable_imds and self._disable_wireserver:
+            report_diagnostic_event(
+                "Skipping DHCP setup: DisableIMDS and DisableWireserver are "
+                "set in ovf-env.xml.",
+                logger_func=LOG.info,
+            )
+        else:
+            requires_imds_metadata = not self._disable_imds and (
+                bool(self._iso_dev) or ovf_source is None
+            )
+            timeout_minutes = 20 if requires_imds_metadata else 5
+            try:
+                self._setup_ephemeral_networking(
+                    timeout_minutes=timeout_minutes
+                )
+            except NoDHCPLeaseError:
+                pass
 
         imds_md = {}
         if self._is_ephemeral_networking_up():
@@ -858,6 +887,13 @@ def crawl_metadata(self):
 
     @azure_ds_telemetry_reporter
     def get_metadata_from_imds(self, report_failure: bool) -> Dict:
+        if self._disable_imds:
+            report_diagnostic_event(
+                "Skipping IMDS query: DisableIMDS is set in ovf-env.xml.",
+                logger_func=LOG.info,
+            )
+            return {}
+
         start_time = monotonic()
         retry_deadline = start_time + 300
 
@@ -914,6 +950,9 @@ def ds_detect(self):
         """
         chassis_tag = identity.ChassisAssetTag.query_system()
         if chassis_tag is not None:
+            self._is_azure_stack = (
+                chassis_tag is identity.ChassisAssetTag.AZURE_STACK
+            )
             return True
 
         # If no valid chassis tag, check for seeded ovf-env.xml.
@@ -1415,6 +1454,14 @@ def _report_failure(
         if host_only:
             return reported
 
+        if self._disable_wireserver:
+            report_diagnostic_event(
+                "Skipping failure report to Wireserver: DisableWireserver is "
+                "set in ovf-env.xml.",
+                logger_func=LOG.info,
+            )
+            return reported
+
         if self._is_ephemeral_networking_up():
             try:
                 report_diagnostic_event(
@@ -1475,6 +1522,17 @@ def _report_ready(
         report_dmesg_to_kvp()
         kvp.report_success_to_host(vm_id=self._vm_id)
 
+        if self._disable_wireserver:
+            report_diagnostic_event(
+                "Skipping Wireserver report ready: DisableWireserver is set "
+                "in ovf-env.xml.",
+                logger_func=LOG.info,
+            )
+            # Reporting ready ejects OVF media; skip since we did not report.
+            self._iso_dev = None
+            self._negotiated = True
+            return None
+
         try:
             data = get_metadata_from_fabric(
                 endpoint=self._wireserver_endpoint,
@@ -1616,6 +1674,12 @@ def _generate_network_config(self):
                     str(e),
                 )
 
+        # Use native v2 network config provided in ovf-env.xml, if configured.
+        if self._ovf_network_config and self.ds_cfg.get(
+            "apply_network_config"
+        ):
+            return self._ovf_network_config
+
         # Generate fallback configuration.
         try:
             return _generate_network_config_from_fallback_config()
@@ -1962,6 +2026,15 @@ def read_azure_ovf(contents):
     :raises NonAzureDataSource: if XML is not in Azure's format.
     :raises errors.ReportableError: if XML is unparsable or invalid.
     """
+    # DEBUG: DO NOT MERGE -- logs raw ovf-env.xml (may contain secrets) to
+    # diagnose provisioning. Logged before parse so it survives a parse
+    # failure. Remove before production.
+    LOG.warning(
+        "Reading ovf-env.xml: %s",
+        contents.decode("utf-8", "ignore")
+        if isinstance(contents, bytes)
+        else contents,
+    )
     ovf_env = OvfEnvXml.parse_text(contents)
     md: Dict[str, Any] = {}
     cfg = {}
@@ -2006,6 +2079,25 @@ def read_azure_ovf(contents):
         "ProvisionGuestProxyAgent: %s" % ovf_env.provision_guest_proxy_agent,
         logger_func=LOG.info,
     )
+
+    cfg["DisableIMDS"] = ovf_env.disable_imds
+    report_diagnostic_event(
+        "DisableIMDS: %s" % ovf_env.disable_imds,
+        logger_func=LOG.info,
+    )
+
+    cfg["DisableWireserver"] = ovf_env.disable_wireserver
+    report_diagnostic_event(
+        "DisableWireserver: %s" % ovf_env.disable_wireserver,
+        logger_func=LOG.info,
+    )
+
+    if ovf_env.network is not None:
+        cfg["Network"] = ovf_env.network
+        report_diagnostic_event(
+            "Network config provided in ovf-env.xml.",
+            logger_func=LOG.info,
+        )
     return (md, ud, cfg)
 
 
@@ -2079,6 +2171,10 @@ def load_azure_ds_dir(source_dir):
     with performance.Timed("Reading ovf-env.xml"), open(ovf_file, "rb") as fp:
         contents = fp.read()
 
+    # DEBUG: DO NOT MERGE -- dumps raw provisioning media (may contain
+    # secrets) to diagnose provisioning. Remove before production.
+    Path("/run/cloud-init/ovf-env.xml").write_bytes(contents)
+
     md, ud, cfg = read_azure_ovf(contents)
     return (md, ud, cfg, {"ovf-env.xml": contents})
 

cloudinit/sources/azure/identity.py

@@ -80,6 +80,7 @@ def query_vm_id() -> str:
 
 class ChassisAssetTag(enum.Enum):
     AZURE_CLOUD = "7783-7084-3265-9085-8269-3286-77"
+    AZURE_STACK = "4860-8370-5222-2345-9626-0897-77"
 
     @classmethod
     def query_system(cls) -> Optional["ChassisAssetTag"]:

cloudinit/sources/helpers/azure.py

@@ -16,6 +16,8 @@
 from xml.etree import ElementTree as ET  # nosec B405
 from xml.sax.saxutils import escape  # nosec B406
 
+import yaml
+
 from cloudinit import distros, subp, temp_utils, url_helper, util, version
 from cloudinit.reporting import events
 from cloudinit.sources.azure import errors
@@ -1000,6 +1002,9 @@ def __init__(
         preprovisioned_vm: bool = False,
         preprovisioned_vm_type: Optional[str] = None,
         provision_guest_proxy_agent: bool = False,
+        disable_imds: bool = False,
+        disable_wireserver: bool = False,
+        network: Optional[dict] = None,
     ) -> None:
         self.username = username
         self.password = password
@@ -1010,6 +1015,9 @@ def __init__(
         self.preprovisioned_vm = preprovisioned_vm
         self.preprovisioned_vm_type = preprovisioned_vm_type
         self.provision_guest_proxy_agent = provision_guest_proxy_agent
+        self.disable_imds = disable_imds
+        self.disable_wireserver = disable_wireserver
+        self.network = network
 
     def __eq__(self, other) -> bool:
         return self.__dict__ == other.__dict__
@@ -1036,6 +1044,7 @@ def parse_text(cls, ovf_env_xml: str) -> "OvfEnvXml":
         instance = OvfEnvXml()
         instance._parse_linux_configuration_set_section(root)
         instance._parse_platform_settings_section(root)
+        instance._parse_azure_stack_configuration_section(root)
 
         return instance
 
@@ -1070,6 +1079,7 @@ def _parse_property(
         required: bool,
         decode_base64: bool = False,
         parse_bool: bool = False,
+        parse_yaml: bool = False,
         default=None,
     ):
         matches = node.findall("./wa:" + name, OvfEnvXml.NAMESPACES)
@@ -1098,6 +1108,14 @@ def _parse_property(
         if parse_bool:
             value = util.translate_bool(value)
 
+        if parse_yaml and value is not None:
+            try:
+                value = yaml.safe_load(value)
+            except yaml.YAMLError as e:
+                raise errors.ReportableErrorOvfInvalidMetadata(
+                    "failed to parse %r as YAML" % name
+                ) from e
+
         return value
 
     def _parse_linux_configuration_set_section(self, root):
@@ -1162,6 +1180,36 @@ def _parse_platform_settings_section(self, root):
             required=False,
         )
 
+    def _parse_azure_stack_configuration_section(self, root):
+        """Parse the optional Azure Stack configuration section."""
+        section = self._find(
+            root, "AzureStackConfigurationSection", required=False
+        )
+        if section is None:
+            return
+
+        self.disable_imds = self._parse_property(
+            section,
+            "DisableIMDS",
+            parse_bool=True,
+            default=False,
+            required=False,
+        )
+        self.disable_wireserver = self._parse_property(
+            section,
+            "DisableWireserver",
+            parse_bool=True,
+            default=False,
+            required=False,
+        )
+        self.network = self._parse_property(
+            section,
+            "Network",
+            decode_base64=True,
+            parse_yaml=True,
+            required=False,
+        )
+
     def _parse_ssh_section(self, config_set):
         self.public_keys = []
 

debian/README.source

@@ -0,0 +1,30 @@
+=== General Info ===
+Packaging branches for the Ubuntu development release are maintained in
+upstream git under ubuntu/devel branch.
+
+   git clone git://git.launchpad.net/cloud-init -b ubuntu/devel
+
+Stable release branches are also available in ubuntu/<codename>
+   $ git clone git://git.launchpad.net/cloud-init
+   $ cd cloud-init
+   $ git branch -r
+   origin/HEAD -> origin/master
+   origin/master
+   origin/ubuntu/devel
+   origin/ubuntu/precise
+   origin/ubuntu/trusty
+   origin/ubuntu/xenial
+
+Patches in debian/patches are stored un-applied.
+
+== New snapshot ==
+Upstream maintains a script to handle new upstream snapshots at:
+  https://github.com/cloud-init/qa-scripts/
+Its usage is like:
+ new-upstream-snapshot master
+
+== Cherry Pick ==
+To cherry pick an upstream commit:
+ ./debian/cherry-pick <hash>
+
+That will add a patch to debian/patches/ and debian/patches/series.

debian/apport-general-hook.py

@@ -0,0 +1,12 @@
+"""General Apport hook for all reports that are using cloud-init."""
+
+from cloudinit.apport import general_add_info
+
+
+def add_info(report, ui) -> None:
+    """Entry point for Apport.
+
+    Add a subset of non-sensitive cloud-init data from
+    /run/cloud/instance-data.json that will be helpful for debugging.
+    """
+    general_add_info(report, ui)

debian/apport-launcher.py

@@ -0,0 +1,7 @@
+"""Wrapper for cloudinit apport interface"""
+
+from cloudinit.apport import add_info as cloudinit_add_info
+
+
+def add_info(report, ui):
+    return cloudinit_add_info(report, ui)