You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "wido (via GitHub)" <gi...@apache.org> on 2026/09/14 12:42:24 UTC
[PR] ConfigDrive: write every SSH key as its own entry in the OpenStack metadata [cloudstack]
wido opened a new pull request, #14164:
URL: https://github.com/apache/cloudstack/pull/14164
### Description
An Instance with more than one SSH keypair receives its keys as one newline-joined string. The OpenStack `meta_data.json` builder wrote that string as a single key: `keys` held one object and `public_keys` one entry whose value contained both keys with a newline in between. cloud-init treats every `public_keys` value as one key and never splits it, so only the first key worked at best. Present since multiple SSH keys were introduced in 4.17 (#5965).
The builder now emits one `keys` object and one `public_keys` entry per key. A key is named after its comment when it has one that no earlier key used, otherwise `key` for a single key and `key0`, `key1`, ... for several.
Output for an Instance with two keys, the second one with a comment:
```json
{
"keys": [
{"type": "ssh", "data": "ssh-ed25519 AAAA...bsP2", "name": "key0"},
{"type": "ssh", "data": "ssh-ed25519 AAAA...LOn user@laptop", "name": "user@laptop"}
],
"public_keys": {
"key0": "ssh-ed25519 AAAA...bsP2",
"user@laptop": "ssh-ed25519 AAAA...LOn user@laptop"
}
}
```
### Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
### Feature/Enhancement Scale or Bug Severity
- [x] Major
### How Has This Been Tested?
Unit tests added to `ConfigDriveBuilderTest` for a single key, a key with a comment, two keys, duplicate comments with blank lines, and untouched other metadata. Observed on a KVM Instance with two keypairs: `meta_data.json` on the ConfigDrive had both keys in one string and cloud-init installed neither correctly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ConfigDrive: write every SSH key as its own entry in the OpenStack metadata [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #14164:
URL: https://github.com/apache/cloudstack/pull/14164#issuecomment-5664237898
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/14164?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 3.71%. Comparing base ([`dc0ba1c`](https://app.codecov.io/gh/apache/cloudstack/commit/dc0ba1cba7475f2c5e0d6346a0e974549c35f00e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`b157e67`](https://app.codecov.io/gh/apache/cloudstack/commit/b157e670c782585493053e37bffce9eba7fdb06d?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (dc0ba1c) and HEAD (b157e67). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (dc0ba1c) | HEAD (b157e67) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #14164 +/- ##
=============================================
- Coverage 19.89% 3.71% -16.19%
=============================================
Files 6371 487 -5884
Lines 576829 41992 -534837
Branches 70627 7942 -62685
=============================================
- Hits 114778 1558 -113220
+ Misses 449507 40208 -409299
+ Partials 12544 226 -12318
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/14164/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/14164/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `3.71% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/14164/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/cloudstack/pull/14164?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ConfigDrive: write every SSH key as its own entry in the OpenStack metadata [cloudstack]
Posted by "wido (via GitHub)" <gi...@apache.org>.
wido commented on PR #14164:
URL: https://github.com/apache/cloudstack/pull/14164#issuecomment-5665047268
I came accross this while testing PR #13758
The authorized_keys file was wrong:
```
root@VM-c38cdf78-5132-4e69-bd30-0a246165447e:~# cat .ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn
root@VM-c38cdf78-5132-4e69-bd30-0a246165447e:~#
```
The newline between the SSH keys wasn't correct. After this commit it now works as expected.
```
root@VM-baf04c61-ddbc-456b-b0bd-7bfdaee8d896:~# cat /root/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2
root@VM-baf04c61-ddbc-456b-b0bd-7bfdaee8d896:~#
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ConfigDrive: write every SSH key as its own entry in the OpenStack metadata [cloudstack]
Posted by "wido (via GitHub)" <gi...@apache.org>.
wido commented on PR #14164:
URL: https://github.com/apache/cloudstack/pull/14164#issuecomment-5670284287
To add, this is how meta_data.json looked in the incorrect format and the correct format:
```
{
"availability_zone": "AMS02",
"hostname": "VM-c38cdf78-5132-4e69-bd30-0a246165447e",
"uuid": "c38cdf78-5132-4e69-bd30-0a246165447e",
"keys": [
{
"type": "ssh",
"data": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn",
"name": "key"
}
],
"public_keys": {
"key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn"
}
}
```
```
{
"availability_zone": "AMS02",
"hostname": "VM-baf04c61-ddbc-456b-b0bd-7bfdaee8d896",
"uuid": "baf04c61-ddbc-456b-b0bd-7bfdaee8d896",
"keys": [
{
"type": "ssh",
"data": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2",
"name": "key0"
},
{
"type": "ssh",
"data": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn",
"name": "key1"
}
],
"public_keys": {
"key0": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeMnwadvS7Z/sN0yCVnfcMgvxrmlNr2zElAMlFvbsP2",
"key1": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPnHzS1LN+3VoXrUBWhRlIbWlSiqVdPynRNDy4bnLOn"
}
}
```
This PR has been tested in real-life with a Ubuntu 26.04 VM using ConfigDrive as it's cloud-init datasource.
```
root@VM-baf04c61-ddbc-456b-b0bd-7bfdaee8d896:~# cat /etc/cloud/cloud.cfg.d/99-cloudstack.cfg
# cloud-init settings for Apache CloudStack guests.
#
# Installed as /etc/cloud/cloud.cfg.d/99-cloudstack.cfg so that the
# distribution's own /etc/cloud/cloud.cfg (system_info.distro, paths, package
# handling) stays in place and only the keys below are overridden.
# ConfigDrive is tried first: CloudStack attaches it as an ISO labeled
# 'config-2' and cloud-init reads it in the local stage, before networking.
# The CloudStack datasource (metadata served by the virtual router) is the
# fallback for networks without ConfigDrive.
datasource_list: [ConfigDrive, CloudStack, None]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ConfigDrive: write every SSH key as its own entry in the OpenStack metadata [cloudstack]
Posted by "wido (via GitHub)" <gi...@apache.org>.
wido commented on PR #14164:
URL: https://github.com/apache/cloudstack/pull/14164#issuecomment-6471303782
> clgtm, just wonder how we can best follow changing open stack standards... 🤔
This standard has not changed, it just originated from OpenStack. We simply did not implement it correctly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org