Fetch passwords from CloudStack virtual router

Bug #1422388 reported by Dan Watkins
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cloud-init
Fix Released
Undecided
Dan Watkins
cloud-init (Ubuntu)
Fix Released
Medium
Unassigned
Precise
Fix Released
Undecided
Unassigned
Trusty
Fix Released
Undecided
Unassigned
Utopic
Fix Released
Undecided
Unassigned

Bug Description

=== Begin SRU Information ===

[Impact]
Currently, the CloudStack data source will only handle SSH keys. While SSH keys are the preferred method for authenticating against cloud instances, there are some CloudStack deployments that do not yet support adding SSH keys to instances when creating instances via their web interface. Ubuntu images are unusable through the web interface for users of these CloudStack deployments.

[Fix]
The CloudStack data source has been extended to interface with CloudStack's password server in order to fetch passwords. These passwords are applied to the ubuntu user.

[Test Case]
Create an instance through a CloudStack web interface, which will give you a password. Confirm that this password can be used to log in to the ubuntu user.

[Regression Potential]
The changes are limited to the CloudStack data source so only CloudStack users will be affected. They are designed so that if they fail, they won't stop the CloudStack data source from functioning as it currently does.

=== End SRU Information ===

CloudStack supports setting passwords in instances, which it would be helpful to support. See [0] for the documentation of this functionality, and [1] for their implementation of it.

[0] https://cloudstack.apache.org/docs/en-US/Apache_CloudStack/4.0.2/html/Admin_Guide/add-password-management-to-templates.html
[1] https://github.com/shankerbalan/cloudstack-scripts/blob/master/cloud-set-guest-password-ubuntu

Related branches

Revision history for this message
Dan Watkins (oddbloke) wrote :
Changed in cloud-init:
assignee: nobody → Daniel Watkins (daniel-thewatkins)
Revision history for this message
Dan Watkins (oddbloke) wrote :

The patch attached above isn't ready to be integrated, but demonstrates the direction of implementation.

One major issue we need to decide whether or not we want to integrate this in to the main CloudStack data source (as in my patch), or if it's divergent enough to merit its own (derivative) data source. Direction on this would be much appreciated.

Dan Watkins (oddbloke)
Changed in cloud-init:
status: New → Fix Committed
Changed in cloud-init (Ubuntu):
assignee: nobody → Daniel Watkins (daniel-thewatkins)
status: New → In Progress
Revision history for this message
Dan Watkins (oddbloke) wrote :

I've tested all of these on Interoute on amd64 and i386.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "debdiff for CloudStack passwords in precise" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Revision history for this message
Dan Watkins (oddbloke) wrote :

I'm expecting utlemming to sponsor these uploads, so ~ubuntu-sponsors don't need to worry about it. :)

Revision history for this message
Ben Howard (darkmuggle-deactivatedaccount) wrote :

There is currently a cloud-init SRU waiting acceptance, so we need to wait till those SRU's clear first.

Changed in cloud-init (Ubuntu):
assignee: Daniel Watkins (daniel-thewatkins) → Ben Howard (utlemming)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.7~bzr1067-0ubuntu1

---------------
cloud-init (0.7.7~bzr1067-0ubuntu1) vivid; urgency=medium

  * New upstream snapshot.
    * fix broken consumption of gzipped user-data (LP: #1424900)
    * functional user-data on Azure again (LP: #1423972)
    * CloudStack: support fetching password from virtual router (LP: #1422388)
 -- Scott Moser <email address hidden> Thu, 26 Feb 2015 14:19:16 -0500

Changed in cloud-init (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Dan Watkins (oddbloke) wrote :

Refreshed precise patch against latest in proposed.

Revision history for this message
Dan Watkins (oddbloke) wrote :

Refreshed trusty patch against latest in proposed.

Revision history for this message
Dan Watkins (oddbloke) wrote :

Refreshed utopic patch against latest in proposed.

Changed in cloud-init (Ubuntu):
importance: Undecided → Medium
milestone: none → precise-updates
Dan Watkins (oddbloke)
description: updated
Dan Watkins (oddbloke)
Changed in cloud-init (Ubuntu Precise):
status: New → In Progress
Changed in cloud-init (Ubuntu Trusty):
status: New → In Progress
Changed in cloud-init (Ubuntu Utopic):
status: New → In Progress
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Dan, or anyone else affected,

Accepted cloud-init into utopic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.7.6~bzr1022-0ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Utopic):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Brian Murray (brian-murray) wrote :

Hello Dan, or anyone else affected,

Accepted cloud-init into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.7.5-0ubuntu1.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Trusty):
status: In Progress → Fix Committed
Revision history for this message
Brian Murray (brian-murray) wrote :

Hello Dan, or anyone else affected,

Accepted cloud-init into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.6.3-0ubuntu1.17 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Precise):
status: In Progress → Fix Committed
Revision history for this message
Dan Watkins (oddbloke) wrote :

I've tested this version on all relevant versions on Interoute (which is an appropriate CloudStack cloud). I'll smoke test on another cloud, to ensure that we haven't regressed anything, and then mark this as verification-done.

Revision history for this message
Dan Watkins (oddbloke) wrote :

verification-done-*; I've tested this cloud-init on Interoute and EC2 successfully.

tags: added: verification-done-precise verification-done-trusty verification-done-utopic
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.6.3-0ubuntu1.17

---------------
cloud-init (0.6.3-0ubuntu1.17) precise; urgency=medium

  * Backport support for fetching passwords in CloudStack (LP: #1422388).
 -- Daniel Watkins <email address hidden> Wed, 11 Mar 2015 10:56:20 -0600

Changed in cloud-init (Ubuntu Precise):
status: Fix Committed → Fix Released
Revision history for this message
Adam Conrad (adconrad) wrote : Update Released

The verification of the Stable Release Update for cloud-init has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.5-0ubuntu1.5

---------------
cloud-init (0.7.5-0ubuntu1.5) trusty; urgency=medium

  * Backport support for fetching passwords in CloudStack (LP: #1422388).
  * Fix CloudStack metadata retrieval (LP: #1356855).
 -- Daniel Watkins <email address hidden> Wed, 11 Mar 2015 10:57:10 -0600

Changed in cloud-init (Ubuntu Trusty):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.6~bzr1022-0ubuntu3

---------------
cloud-init (0.7.6~bzr1022-0ubuntu3) utopic; urgency=medium

  * Backport support for fetching passwords in CloudStack (LP: #1422388).
 -- Daniel Watkins <email address hidden> Wed, 11 Mar 2015 10:57:57 -0600

Changed in cloud-init (Ubuntu Utopic):
status: Fix Committed → Fix Released
Dan Watkins (oddbloke)
Changed in cloud-init:
status: Fix Committed → Fix Released
Revision history for this message
Carlos (creategui) wrote :

Not sure how this was verified. Unless the fix for https://bugs.launchpad.net/cloud-init/+bug/1089989 is back ported to precise then any changes to DataSourceCloudStack.py are worthless as it will not be able to connect to the metadata server.

Revision history for this message
Carlos (creategui) wrote :

My comment above refers exclusively to the port of this that was applied to precise.

Revision history for this message
Dan Watkins (oddbloke) wrote :

Hi Carlos,

As I mentioned on bug 1089989, there are CloudStack environments that the current precise CloudStack data source does work against. So this fix was validated on one such environment, where it worked fine. :)

Thanks,

Dan

Revision history for this message
Swen Brueseke (s-brueseke) wrote :

It looks like there is a problem with resetting the password form CloudStack UI.
After the first boot of the vm I can log into the server as user debian using the password provided by CloudStack. But when I stop the vm and reset the password via CloudStack UI the new password is not working.

Revision history for this message
James Falcon (falcojr) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.