088c30
From 3ec4ddbc595c5fe781b3dc501631d23569849818 Mon Sep 17 00:00:00 2001
088c30
From: Thomas Stringer <thstring@microsoft.com>
088c30
Date: Mon, 26 Apr 2021 09:41:38 -0400
088c30
Subject: [PATCH 5/7] Azure: Retrieve username and hostname from IMDS (#865)
088c30
088c30
RH-Author: Eduardo Otubo <otubo@redhat.com>
088c30
RH-MergeRequest: 45: Add support for userdata on Azure from IMDS
088c30
RH-Commit: [5/7] 6fab7ef28c7fd340bda4f82dbf828f10716cb3f1
088c30
RH-Bugzilla: 2023940
088c30
RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
088c30
RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
088c30
088c30
This change allows us to retrieve the username and hostname from
088c30
IMDS instead of having to rely on the mounted OVF.
088c30
---
088c30
 cloudinit/sources/DataSourceAzure.py          | 149 ++++++++++++++----
088c30
 tests/unittests/test_datasource/test_azure.py |  87 +++++++++-
088c30
 2 files changed, 205 insertions(+), 31 deletions(-)
088c30
088c30
diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
088c30
index 39e67c4f..6d7954ee 100755
088c30
--- a/cloudinit/sources/DataSourceAzure.py
088c30
+++ b/cloudinit/sources/DataSourceAzure.py
088c30
@@ -5,6 +5,7 @@
088c30
 # This file is part of cloud-init. See LICENSE file for license information.
088c30
 
088c30
 import base64
088c30
+from collections import namedtuple
088c30
 import contextlib
088c30
 import crypt
088c30
 from functools import partial
088c30
@@ -25,6 +26,7 @@ from cloudinit.net import device_driver
088c30
 from cloudinit.net.dhcp import EphemeralDHCPv4
088c30
 from cloudinit import sources
088c30
 from cloudinit.sources.helpers import netlink
088c30
+from cloudinit import ssh_util
088c30
 from cloudinit import subp
088c30
 from cloudinit.url_helper import UrlError, readurl, retry_on_url_exc
088c30
 from cloudinit import util
088c30
@@ -80,7 +82,12 @@ AGENT_SEED_DIR = '/var/lib/waagent'
088c30
 IMDS_TIMEOUT_IN_SECONDS = 2
088c30
 IMDS_URL = "http://169.254.169.254/metadata"
088c30
 IMDS_VER_MIN = "2019-06-01"
088c30
-IMDS_VER_WANT = "2020-09-01"
088c30
+IMDS_VER_WANT = "2020-10-01"
088c30
+
088c30
+
088c30
+# This holds SSH key data including if the source was
088c30
+# from IMDS, as well as the SSH key data itself.
088c30
+SSHKeys = namedtuple("SSHKeys", ("keys_from_imds", "ssh_keys"))
088c30
 
088c30
 
088c30
 class metadata_type(Enum):
088c30
@@ -391,6 +398,8 @@ class DataSourceAzure(sources.DataSource):
088c30
         """Return the subplatform metadata source details."""
088c30
         if self.seed.startswith('/dev'):
088c30
             subplatform_type = 'config-disk'
088c30
+        elif self.seed.lower() == 'imds':
088c30
+            subplatform_type = 'imds'
088c30
         else:
088c30
             subplatform_type = 'seed-dir'
088c30
         return '%s (%s)' % (subplatform_type, self.seed)
088c30
@@ -433,9 +442,11 @@ class DataSourceAzure(sources.DataSource):
088c30
 
088c30
         found = None
088c30
         reprovision = False
088c30
+        ovf_is_accessible = True
088c30
         reprovision_after_nic_attach = False
088c30
         for cdev in candidates:
088c30
             try:
088c30
+                LOG.debug("cdev: %s", cdev)
088c30
                 if cdev == "IMDS":
088c30
                     ret = None
088c30
                     reprovision = True
088c30
@@ -462,8 +473,18 @@ class DataSourceAzure(sources.DataSource):
088c30
                 raise sources.InvalidMetaDataException(msg)
088c30
             except util.MountFailedError:
088c30
                 report_diagnostic_event(
088c30
-                    '%s was not mountable' % cdev, logger_func=LOG.warning)
088c30
-                continue
088c30
+                    '%s was not mountable' % cdev, logger_func=LOG.debug)
088c30
+                cdev = 'IMDS'
088c30
+                ovf_is_accessible = False
088c30
+                empty_md = {'local-hostname': ''}
088c30
+                empty_cfg = dict(
088c30
+                    system_info=dict(
088c30
+                        default_user=dict(
088c30
+                            name=''
088c30
+                        )
088c30
+                    )
088c30
+                )
088c30
+                ret = (empty_md, '', empty_cfg, {})
088c30
 
088c30
             report_diagnostic_event("Found provisioning metadata in %s" % cdev,
088c30
                                     logger_func=LOG.debug)
088c30
@@ -490,6 +511,10 @@ class DataSourceAzure(sources.DataSource):
088c30
                 self.fallback_interface,
088c30
                 retries=10
088c30
             )
088c30
+            if not imds_md and not ovf_is_accessible:
088c30
+                msg = 'No OVF or IMDS available'
088c30
+                report_diagnostic_event(msg)
088c30
+                raise sources.InvalidMetaDataException(msg)
088c30
             (md, userdata_raw, cfg, files) = ret
088c30
             self.seed = cdev
088c30
             crawled_data.update({
088c30
@@ -498,6 +523,21 @@ class DataSourceAzure(sources.DataSource):
088c30
                 'metadata': util.mergemanydict(
088c30
                     [md, {'imds': imds_md}]),
088c30
                 'userdata_raw': userdata_raw})
088c30
+            imds_username = _username_from_imds(imds_md)
088c30
+            imds_hostname = _hostname_from_imds(imds_md)
088c30
+            imds_disable_password = _disable_password_from_imds(imds_md)
088c30
+            if imds_username:
088c30
+                LOG.debug('Username retrieved from IMDS: %s', imds_username)
088c30
+                cfg['system_info']['default_user']['name'] = imds_username
088c30
+            if imds_hostname:
088c30
+                LOG.debug('Hostname retrieved from IMDS: %s', imds_hostname)
088c30
+                crawled_data['metadata']['local-hostname'] = imds_hostname
088c30
+            if imds_disable_password:
088c30
+                LOG.debug(
088c30
+                    'Disable password retrieved from IMDS: %s',
088c30
+                    imds_disable_password
088c30
+                )
088c30
+                crawled_data['metadata']['disable_password'] = imds_disable_password  # noqa: E501
088c30
             found = cdev
088c30
 
088c30
             report_diagnostic_event(
088c30
@@ -676,6 +716,13 @@ class DataSourceAzure(sources.DataSource):
088c30
 
088c30
     @azure_ds_telemetry_reporter
088c30
     def get_public_ssh_keys(self):
088c30
+        """
088c30
+        Retrieve public SSH keys.
088c30
+        """
088c30
+
088c30
+        return self._get_public_ssh_keys_and_source().ssh_keys
088c30
+
088c30
+    def _get_public_ssh_keys_and_source(self):
088c30
         """
088c30
         Try to get the ssh keys from IMDS first, and if that fails
088c30
         (i.e. IMDS is unavailable) then fallback to getting the ssh
088c30
@@ -685,30 +732,50 @@ class DataSourceAzure(sources.DataSource):
088c30
         advantage, so this is a strong preference. But we must keep
088c30
         OVF as a second option for environments that don't have IMDS.
088c30
         """
088c30
+
088c30
         LOG.debug('Retrieving public SSH keys')
088c30
         ssh_keys = []
088c30
+        keys_from_imds = True
088c30
+        LOG.debug('Attempting to get SSH keys from IMDS')
088c30
         try:
088c30
-            raise KeyError(
088c30
-                "Not using public SSH keys from IMDS"
088c30
-            )
088c30
-            # pylint:disable=unreachable
088c30
             ssh_keys = [
088c30
                 public_key['keyData']
088c30
                 for public_key
088c30
                 in self.metadata['imds']['compute']['publicKeys']
088c30
             ]
088c30
-            LOG.debug('Retrieved SSH keys from IMDS')
088c30
+            for key in ssh_keys:
088c30
+                if not _key_is_openssh_formatted(key=key):
088c30
+                    keys_from_imds = False
088c30
+                    break
088c30
+
088c30
+            if not keys_from_imds:
088c30
+                log_msg = 'Keys not in OpenSSH format, using OVF'
088c30
+            else:
088c30
+                log_msg = 'Retrieved {} keys from IMDS'.format(
088c30
+                    len(ssh_keys)
088c30
+                    if ssh_keys is not None
088c30
+                    else 0
088c30
+                )
088c30
         except KeyError:
088c30
             log_msg = 'Unable to get keys from IMDS, falling back to OVF'
088c30
+            keys_from_imds = False
088c30
+        finally:
088c30
             report_diagnostic_event(log_msg, logger_func=LOG.debug)
088c30
+
088c30
+        if not keys_from_imds:
088c30
+            LOG.debug('Attempting to get SSH keys from OVF')
088c30
             try:
088c30
                 ssh_keys = self.metadata['public-keys']
088c30
-                LOG.debug('Retrieved keys from OVF')
088c30
+                log_msg = 'Retrieved {} keys from OVF'.format(len(ssh_keys))
088c30
             except KeyError:
088c30
                 log_msg = 'No keys available from OVF'
088c30
+            finally:
088c30
                 report_diagnostic_event(log_msg, logger_func=LOG.debug)
088c30
 
088c30
-        return ssh_keys
088c30
+        return SSHKeys(
088c30
+            keys_from_imds=keys_from_imds,
088c30
+            ssh_keys=ssh_keys
088c30
+        )
088c30
 
088c30
     def get_config_obj(self):
088c30
         return self.cfg
088c30
@@ -1325,30 +1392,21 @@ class DataSourceAzure(sources.DataSource):
088c30
         self.bounce_network_with_azure_hostname()
088c30
 
088c30
         pubkey_info = None
088c30
-        try:
088c30
-            raise KeyError(
088c30
-                "Not using public SSH keys from IMDS"
088c30
-            )
088c30
-            # pylint:disable=unreachable
088c30
-            public_keys = self.metadata['imds']['compute']['publicKeys']
088c30
-            LOG.debug(
088c30
-                'Successfully retrieved %s key(s) from IMDS',
088c30
-                len(public_keys)
088c30
-                if public_keys is not None
088c30
+        ssh_keys_and_source = self._get_public_ssh_keys_and_source()
088c30
+
088c30
+        if not ssh_keys_and_source.keys_from_imds:
088c30
+            pubkey_info = self.cfg.get('_pubkeys', None)
088c30
+            log_msg = 'Retrieved {} fingerprints from OVF'.format(
088c30
+                len(pubkey_info)
088c30
+                if pubkey_info is not None
088c30
                 else 0
088c30
             )
088c30
-        except KeyError:
088c30
-            LOG.debug(
088c30
-                'Unable to retrieve SSH keys from IMDS during '
088c30
-                'negotiation, falling back to OVF'
088c30
-            )
088c30
-            pubkey_info = self.cfg.get('_pubkeys', None)
088c30
+            report_diagnostic_event(log_msg, logger_func=LOG.debug)
088c30
 
088c30
         metadata_func = partial(get_metadata_from_fabric,
088c30
                                 fallback_lease_file=self.
088c30
                                 dhclient_lease_file,
088c30
-                                pubkey_info=pubkey_info,
088c30
-                                iso_dev=self.iso_dev)
088c30
+                                pubkey_info=pubkey_info)
088c30
 
088c30
         LOG.debug("negotiating with fabric via agent command %s",
088c30
                   self.ds_cfg['agent_command'])
088c30
@@ -1404,6 +1462,41 @@ class DataSourceAzure(sources.DataSource):
088c30
         return self.metadata.get('imds', {}).get('compute', {}).get('location')
088c30
 
088c30
 
088c30
+def _username_from_imds(imds_data):
088c30
+    try:
088c30
+        return imds_data['compute']['osProfile']['adminUsername']
088c30
+    except KeyError:
088c30
+        return None
088c30
+
088c30
+
088c30
+def _hostname_from_imds(imds_data):
088c30
+    try:
088c30
+        return imds_data['compute']['osProfile']['computerName']
088c30
+    except KeyError:
088c30
+        return None
088c30
+
088c30
+
088c30
+def _disable_password_from_imds(imds_data):
088c30
+    try:
088c30
+        return imds_data['compute']['osProfile']['disablePasswordAuthentication'] == 'true'  # noqa: E501
088c30
+    except KeyError:
088c30
+        return None
088c30
+
088c30
+
088c30
+def _key_is_openssh_formatted(key):
088c30
+    """
088c30
+    Validate whether or not the key is OpenSSH-formatted.
088c30
+    """
088c30
+
088c30
+    parser = ssh_util.AuthKeyLineParser()
088c30
+    try:
088c30
+        akl = parser.parse(key)
088c30
+    except TypeError:
088c30
+        return False
088c30
+
088c30
+    return akl.keytype is not None
088c30
+
088c30
+
088c30
 def _partitions_on_device(devpath, maxnum=16):
088c30
     # return a list of tuples (ptnum, path) for each part on devpath
088c30
     for suff in ("-part", "p", ""):
088c30
diff --git a/tests/unittests/test_datasource/test_azure.py b/tests/unittests/test_datasource/test_azure.py
088c30
index 320fa857..d9817d84 100644
088c30
--- a/tests/unittests/test_datasource/test_azure.py
088c30
+++ b/tests/unittests/test_datasource/test_azure.py
088c30
@@ -108,7 +108,7 @@ NETWORK_METADATA = {
088c30
         "zone": "",
088c30
         "publicKeys": [
088c30
             {
088c30
-                "keyData": "key1",
088c30
+                "keyData": "ssh-rsa key1",
088c30
                 "path": "path1"
088c30
             }
088c30
         ]
088c30
@@ -1761,8 +1761,29 @@ scbus-1 on xpt0 bus 0
088c30
         dsrc.get_data()
088c30
         dsrc.setup(True)
088c30
         ssh_keys = dsrc.get_public_ssh_keys()
088c30
-        # Temporarily alter this test so that SSH public keys
088c30
-        # from IMDS are *not* going to be in use to fix a regression.
088c30
+        self.assertEqual(ssh_keys, ["ssh-rsa key1"])
088c30
+        self.assertEqual(m_parse_certificates.call_count, 0)
088c30
+
088c30
+    @mock.patch(
088c30
+        'cloudinit.sources.helpers.azure.OpenSSLManager.parse_certificates')
088c30
+    @mock.patch(MOCKPATH + 'get_metadata_from_imds')
088c30
+    def test_get_public_ssh_keys_with_no_openssh_format(
088c30
+            self,
088c30
+            m_get_metadata_from_imds,
088c30
+            m_parse_certificates):
088c30
+        imds_data = copy.deepcopy(NETWORK_METADATA)
088c30
+        imds_data['compute']['publicKeys'][0]['keyData'] = 'no-openssh-format'
088c30
+        m_get_metadata_from_imds.return_value = imds_data
088c30
+        sys_cfg = {'datasource': {'Azure': {'apply_network_config': True}}}
088c30
+        odata = {'HostName': "myhost", 'UserName': "myuser"}
088c30
+        data = {
088c30
+            'ovfcontent': construct_valid_ovf_env(data=odata),
088c30
+            'sys_cfg': sys_cfg
088c30
+        }
088c30
+        dsrc = self._get_ds(data)
088c30
+        dsrc.get_data()
088c30
+        dsrc.setup(True)
088c30
+        ssh_keys = dsrc.get_public_ssh_keys()
088c30
         self.assertEqual(ssh_keys, [])
088c30
         self.assertEqual(m_parse_certificates.call_count, 0)
088c30
 
088c30
@@ -1818,6 +1839,66 @@ scbus-1 on xpt0 bus 0
088c30
         self.assertIsNotNone(dsrc.metadata)
088c30
         self.assertFalse(dsrc.failed_desired_api_version)
088c30
 
088c30
+    @mock.patch(MOCKPATH + 'get_metadata_from_imds')
088c30
+    def test_hostname_from_imds(self, m_get_metadata_from_imds):
088c30
+        sys_cfg = {'datasource': {'Azure': {'apply_network_config': True}}}
088c30
+        odata = {'HostName': "myhost", 'UserName': "myuser"}
088c30
+        data = {
088c30
+            'ovfcontent': construct_valid_ovf_env(data=odata),
088c30
+            'sys_cfg': sys_cfg
088c30
+        }
088c30
+        imds_data_with_os_profile = copy.deepcopy(NETWORK_METADATA)
088c30
+        imds_data_with_os_profile["compute"]["osProfile"] = dict(
088c30
+            adminUsername="username1",
088c30
+            computerName="hostname1",
088c30
+            disablePasswordAuthentication="true"
088c30
+        )
088c30
+        m_get_metadata_from_imds.return_value = imds_data_with_os_profile
088c30
+        dsrc = self._get_ds(data)
088c30
+        dsrc.get_data()
088c30
+        self.assertEqual(dsrc.metadata["local-hostname"], "hostname1")
088c30
+
088c30
+    @mock.patch(MOCKPATH + 'get_metadata_from_imds')
088c30
+    def test_username_from_imds(self, m_get_metadata_from_imds):
088c30
+        sys_cfg = {'datasource': {'Azure': {'apply_network_config': True}}}
088c30
+        odata = {'HostName': "myhost", 'UserName': "myuser"}
088c30
+        data = {
088c30
+            'ovfcontent': construct_valid_ovf_env(data=odata),
088c30
+            'sys_cfg': sys_cfg
088c30
+        }
088c30
+        imds_data_with_os_profile = copy.deepcopy(NETWORK_METADATA)
088c30
+        imds_data_with_os_profile["compute"]["osProfile"] = dict(
088c30
+            adminUsername="username1",
088c30
+            computerName="hostname1",
088c30
+            disablePasswordAuthentication="true"
088c30
+        )
088c30
+        m_get_metadata_from_imds.return_value = imds_data_with_os_profile
088c30
+        dsrc = self._get_ds(data)
088c30
+        dsrc.get_data()
088c30
+        self.assertEqual(
088c30
+            dsrc.cfg["system_info"]["default_user"]["name"],
088c30
+            "username1"
088c30
+        )
088c30
+
088c30
+    @mock.patch(MOCKPATH + 'get_metadata_from_imds')
088c30
+    def test_disable_password_from_imds(self, m_get_metadata_from_imds):
088c30
+        sys_cfg = {'datasource': {'Azure': {'apply_network_config': True}}}
088c30
+        odata = {'HostName': "myhost", 'UserName': "myuser"}
088c30
+        data = {
088c30
+            'ovfcontent': construct_valid_ovf_env(data=odata),
088c30
+            'sys_cfg': sys_cfg
088c30
+        }
088c30
+        imds_data_with_os_profile = copy.deepcopy(NETWORK_METADATA)
088c30
+        imds_data_with_os_profile["compute"]["osProfile"] = dict(
088c30
+            adminUsername="username1",
088c30
+            computerName="hostname1",
088c30
+            disablePasswordAuthentication="true"
088c30
+        )
088c30
+        m_get_metadata_from_imds.return_value = imds_data_with_os_profile
088c30
+        dsrc = self._get_ds(data)
088c30
+        dsrc.get_data()
088c30
+        self.assertTrue(dsrc.metadata["disable_password"])
088c30
+
088c30
 
088c30
 class TestAzureBounce(CiTestCase):
088c30
 
088c30
-- 
088c30
2.27.0
088c30