instance launched without key has incorrect metadata

Bug #845155 reported by Scott Moser
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Medium
Scott Moser
cloud-init
Won't Fix
Undecided
Unassigned
nova (Ubuntu)
Fix Released
Medium
Unassigned
Oneiric
Fix Released
Medium
Unassigned

Bug Description

Currently on openstack, if you did something like this:

$ cat my.userdata
#cloud-config
ssh_authorized_keys:
 - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3I7VUf2l5gSn5uavROsc5HRDpZdQueUq5ozemNSj8T7enqKHOEaFoU2VoPgGEWC9RyzSQVeyD6s7APMcE82EtmW4skVEgEGSbDc1pvxzxtchBj78hJP6Cf5TCMFSXw+Fz5rF1dR23QDbN1mkHs7adr8GW4kSWqU7Q7NDwfIrJJtO7Hi42GyXtvEONHbiRPOe8stqUly7MvUoN+5kfjBM8Qqpfl2+FNhTYWpMfYdPUnE7u536WqzFmsaqJctz3gBxH9Ex7dFtrxR4qiqEr9Qtlu3xGn7Bw07/+i1D+ey3ONkZLN+LQ714cgj8fRS4Hj29SCmXp5Kt5/82cD/VN3NtHw== smoser@brickies

runcmd:
 - [ sudo, -Hu, ubuntu, ssh-import-id, smoser ]

$ euca-run-instances --user-data-file my.userdata

you'd see a message to the console that says:
   2011-09-08 20:55:52,779 - cc_ssh.py[WARNING]: applying credentials failed!

because i also inserted the key via ssh-import-id i could get to the instanc,e, then the cloud-init lgo shows:

2011-09-08 20:55:52,778 - util.py[DEBUG]: Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/cloudinit/CloudConfig/cc_ssh.py", line 73, in handle
    keys = cloud.get_public_ssh_keys()
  File "/usr/lib/python2.7/dist-packages/cloudinit/__init__.py", line 437, in get_public_ssh_keys
    return(self.datasource.get_public_ssh_keys())
  File "/usr/lib/python2.7/dist-packages/cloudinit/DataSource.py", line 68, in get_public_ssh_keys
    for keyname, klist in self.metadata['public-keys'].items():
AttributeError: 'str' object has no attribute 'items'

2011-09-08 20:55:52,779 - cc_ssh.py[WARNING]: applying credentials failed!

The issue is that if no key is given, nova's metadata service will show an entry with an empty value. EC2's will not show the entry.

ie:
## nova with no key
$ wget http://169.254.169.254/2009-04-04/meta-data/ -O - -q | grep key
public-keys
$ wget http://169.254.169.254/2009-04-04/meta-data/public-keys -O - -q ; echo

$ wget http://169.254.169.254/2009-04-04/meta-data/ -O - -q | grep key
public-keys/
$ wget http://169.254.169.254/2009-04-04/meta-data/public-keys -O - -q ; echo
0=mykey

## ec2 with no key:

## nova with a key
$ wget http://169.254.169.254/2009-04-04/meta-data/ -O - -q | grep key

^ there is no 'public-keys' entry listed.

This could be fixed in any number of ways.
cloud-init could be more forgiving (and probably should), but the right place to fix it is in nova, otherwise to support this in Ubuntu images we'll have to SRU it to all releases.

Tags: server-o-rs

Related branches

Scott Moser (smoser)
Changed in nova (Ubuntu):
milestone: none → ubuntu-11.10-beta-2
Scott Moser (smoser)
tags: added: server-o-rs
Scott Moser (smoser)
Changed in nova:
assignee: nobody → Scott Moser (smoser)
status: New → In Progress
Thierry Carrez (ttx)
Changed in nova:
importance: Undecided → Medium
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Ran into this just today. Marking Ubuntu nova task as Triaged, since it has been sent upstream. Setting importance in Ubuntu to Medium as this only affects users who don't send a key *and* use cloud-init's keys.

Changed in nova (Ubuntu Oneiric):
importance: Undecided → Medium
status: New → Triaged
Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: none → 2011.3
Revision history for this message
Scott Moser (smoser) wrote :

Marking this as WONT_FIX as it has been fixed in nova.

Changed in cloud-init:
status: New → Won't Fix
Thierry Carrez (ttx)
Changed in nova:
status: Fix Committed → Fix Released
Dave Walker (davewalker)
Changed in nova (Ubuntu):
milestone: ubuntu-11.10-beta-2 → ubuntu-11.10
Changed in nova (Ubuntu Oneiric):
status: Triaged → Fix Released
Revision history for this message
James Falcon (falcojr) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.