kacerrandClaude Opus 5
c23def0051
Merging the bootstrap into each Proxy's cloud-config was the wrong mechanism twice over. Detection only matched a literal #cloud-config first line, so a jinja template or a MIME archive still fell back to vendor-data, where cloud-init's default mergers drop it — the exact failure the merge existed to prevent. And the YAML round-trip re-typed unquoted scalars: version: 1.10 reached the guest as 1.1, comments were dropped and keys reordered. Neither is worth patching, because vendor-data delivered as a shell script bypasses the merger entirely: cloud-init hands vendor-data to its own handler chain, writes scripts to a separate directory and runs them from cc_scripts_vendor, after the user's packages and before the user's runcmd. The merge could not have been rescued anyway — merge_how in user-data governs only the first source, and merge_how in vendor-data is discarded before the document is stored. The Proxy's cloud-init now reaches the seed byte for byte in any format. installGuestAgent (default true) turns the script off; a configured vendorData travels beside it as a MIME multipart, declared text/plain so cloud-init re-sniffs it and this code never classifies user content. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
58 lines
3.0 KiB
YAML
58 lines
3.0 KiB
YAML
# Sample --providers-config file (not a Kubernetes manifest). In-cluster
|
|
# this content lives in the providers-config ConfigMap
|
|
# (config/manager/providers_config.yaml); for `make run-dev` a
|
|
# kubernetes-only variant is at hack/providers-dev.yaml.
|
|
#
|
|
# Named provider instances: "gcp-eu" and "gcp-us" are two configs of the
|
|
# same type. spec.provider on a Proxy refers to the name, not the type.
|
|
providers:
|
|
- name: kubernetes
|
|
type: kubernetes
|
|
# kubernetes:
|
|
# image: ubuntu/squid:6.6-24.04_edge # the default
|
|
- name: gcp-eu
|
|
type: gcp
|
|
gcp:
|
|
project: my-project
|
|
# network: default # VPC network name
|
|
# networkTag: proxy-operator # firewall tag on created instances
|
|
# diskSizeGb: 10
|
|
# auth: Application Default Credentials (workload identity
|
|
# in-cluster, gcloud ADC locally). No key-file plumbing.
|
|
- name: kvm-home
|
|
type: kvm
|
|
kvm:
|
|
# SSH to each host with the libvirt unix socket forwarded through the
|
|
# connection; nothing to open on the hypervisors beyond sshd. Both
|
|
# files come from the optional kvm-ssh Secret mounted by
|
|
# config/manager/manager.yaml — see docs/kvm-provider.md.
|
|
sshKeyFile: /etc/proxy-operator/kvm/id_ed25519
|
|
knownHostsFile: /etc/proxy-operator/kvm/known_hosts
|
|
# insecureIgnoreHostKey: true # skip host-key checks (not recommended)
|
|
# diskSizeGb: 10 # per-VM overlay; cloud-init grows the root fs into it
|
|
# installGuestAgent: false # skip the vendor-data script that installs qemu-guest-agent
|
|
# vendorData: | # extra vendor-data, carried beside the agent script as a
|
|
# #cloud-config # MIME multipart. The Proxy's own cloud-init is never rewritten.
|
|
# ...
|
|
images:
|
|
# placement.image names a key here (or is an https:// URL directly).
|
|
# Fetched into each host's pool on first use and cached there as
|
|
# base-<key>.qcow2; do not change an entry while Proxies use it.
|
|
debian-13:
|
|
url: https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2
|
|
# sha256: "<64 hex>" # optional; verified after download
|
|
# firmware: uefi # default; "bios" only for images with no EFI partition
|
|
# # (Debian 13 hangs in GRUB under BIOS headless: Debian bug #1111240)
|
|
ubuntu-24.04:
|
|
url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
|
|
machineTypes: # placement.machineType names a key here
|
|
small: {vcpus: 1, memoryMiB: 1024}
|
|
medium: {vcpus: 2, memoryMiB: 2048}
|
|
hosts: # placement.zone names a host; optional with one host
|
|
- name: nas1
|
|
address: nas1.home.lan:22
|
|
user: virt # must be in the libvirt group
|
|
bridge: br0 # to a LAN with DHCP; the VM's IP comes from there
|
|
# socket: /var/run/libvirt/libvirt-sock
|
|
# pool: default
|