-
Notifications
You must be signed in to change notification settings - Fork 248
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for IONOS Cloud #1957
Conversation
) | ||
|
||
const ( | ||
defaultFilename = "/var/lib/cloud/seed/nocloud/user-data" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm, do you have documentation for this, I am not having any luck finding the default user-data file location for IONOS
I thought cloud-init's default was something like "/var/lib/cloud/instance/user-data"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Additionally It might be good to add a reference to the in development metatdata service for this, so we can replace it when completed.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unfortunately, we don't have that documented publicly.
Its just a internal docs.
However this docs explains how can use Userdata.
https://docs.ionos.com/cloud/compute-services/compute-engine/how-tos/boot-cloud-init
The path is /var/lib/cloud/seed
So it could be detected by the NoCloud Datasource.
So, im 100% sure of that.
But the /var/lib/cloud/instance is the information about the cloud-init run.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@prestist I can back this up as well. We don't have this publicly documented. Unfortunately, as of yet we don't have a metadata server at IONOS and therefore rely on a legacy script that injects data into this file before a VM is booted for the first time.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, okay, yeah that makes sense. Ok, would it be okay to just add a comment to point to documentation?
Thank you both for answering my questions.
Okay so to help with the adding of this platform I highly recommend submitting a platform request issue to => https://github.com/coreos/fedora-coreos-tracker/issues/new/choose It will ask questions and give us a tracker so that we can monitor the adding support bit. then lets squash and update the first commit to be with a reference to the aforementioned tracker. |
6cbf57a
to
48c1e5e
Compare
48c1e5e
to
c2cdecd
Compare
c2cdecd
to
c269f14
Compare
This is really unusual. How is this supposed to work? This would mean that Ignition would have to mount to root/var partition first to read the config and then act on it? This feels really brittle.
Second this comment here. We need a clearer picture of how things work here. |
I'm afraid that's the only way, it work for now. However, we are adding information and defining how things work as much as we can, thanks |
Yes, indeed it is brittle and we would love to have a proper metadata server in the future. Unfortunately, this will not be implemented anytime soon and we would really love to already get support for ignition especially in Flatcar Linux. |
) | ||
|
||
const ( | ||
defaultFilename = "/var/lib/cloud/seed/nocloud/user-data" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This won't work. Ignition runs from the initramfs and the /var
there is different. You could inject it in what would become /var
in the real root, but you'd have to special-case code for CoreOS which feels really like a layering violation.
At least for FCOS, probably the simplest way to hack around this for now (until there's a proper metadata service) is to inject the Ignition config in the boot partition (GPT partition label boot
) at /ignition/config.ign
. I'm not sure if there's an equivalent on the Flatcar side. We wouldn't even need to touch Ignition for that; the QEMU qcow2 image we publish should work for now.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, we just had a chat and realized this fact as well. In case of Flatcar the root partition is mounted to /sysroot
and therefore the path is wrong anyway. I'll try to build a flatcar image using a patch version of ignition and we need to investigate how to make it work on other distributions and make the base path configurable
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@tormath1 am I right on this on? Regarding the /sysroot
being a mount point of the boot partition?
return types.Config{}, report.Report{}, err | ||
} | ||
|
||
if util.IsCloudConfig(rawConfig) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why should we tolerate non-Ignition configs here? The reason this is done in Proxmox VE is because the platform itself uses cloud-init to pass through platform values which is extremely unfortunate because it makes it harder for users to provide their own config and deteriorates the UX. Is that the case for this platform as well? How can we avoid it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Indeed this is ugly DX not going to deny that fact. But we cannot change that as of now because the IONOS Cloud fully builts on the premise that all images use cloud-init. Which is why our legacy pre-boot image injector scripts write this specific cloud-init seed file. Meanwhile our team wants to introduce ignition to support linux derivatives that use it instead of cloud-init. Therefore we need to re-purpose this seed file to get earlier support until the Compute department at IONOS introduces a proper metadata service. It is definitely on the roadmap but will take months or possibly a year. Therefore this intermediate implementation will unfortunately (as so often the case with these things) be a long living temporary solution.
9e2a8ff
to
488d302
Compare
return nil, err | ||
} | ||
|
||
if util.IsCloudConfig(contents) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we can get rid of this check, I believe.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
no we cannot, we want to ignore the file and do nothing if the config contains the #cloud-config
directive
7b7a434
to
3d4bb8d
Compare
Overall, I'm very wary of getting this in. I don't think the platform should touch the rootfs, nor that Ignition should try to mount it. I would prefer to wait until there is a metadata server available. If we really must rely on this "config injector" temporarily, then I would extend the hack on that side so that it knows if it's e.g. FCOS or Flatcar Linux and have it inject in a different place (e.g. for FCOS, as described in #1957 (comment)). |
Thanks for your review! One remark and maybe I just misunderstand how ignition works internally but doesn't ignition mount the rootfs anyways at Just for context regarding the config injector: It has been like that since the inception of the company a decade or so ago and is older than ignition itself. It is managed by another department responsible for the virtual machine management and unfortunately we cannot influence how quickly they will churn out the metadata server. The current estimation is it will take a couple of months and possibly up to a year. |
The rootfs is mounted by the OS, and the This also all happens quite late in the initrd process, not long before switching root. On the other hand, the fetch-offline stage happens quite early in the boot process. |
So for me to fully understand the phases and issue: Stage order: fetch-offline [-> fetch] [-> kargs] -> disks -> mount -> files.
So your concern is the fetching stage of ignition could be run before the sysroot mount is done and therefore potentially fail if the disk is yet ready? |
From my point of view: This means we will have to keep the patch files for ignition inside Flatcar for now and postpone the official addition to CoreOS and Ignition until IONOS has released a working metadata server. CC: @mcbenjemaa @tormath1 |
859b937
to
0d7109c
Compare
Hi @prestist, @jlebon, @travier, I've completely changed the implementation. We made some changes on our end and can now support user data injection on any partition or additional disk / drive. Please have a look at the updated code :) If you think this looks like an approach we can continue with, let me know and I'll update the documentation and finalise the PR with the help of your feedback. Best, CC: @mcbenjemaa @tormath1 |
903c5dc
to
531a6dc
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks more reasonable. Some comments.
// The IONOS Cloud provider fetches the ignition config from the user-data | ||
// available in an injected file at /var/lib/cloud/seed/nocloud/user-data. | ||
// This file is created by the IONOS Cloud VM handler before the first boot | ||
// through the cloud init user data handling. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think this is accurate anymore.
deviceLabelKernelFlag = "ignition.config.device" | ||
defaultDeviceLabel = "OEM" | ||
userDataKernelFlag = "ignition.config.path" | ||
defaultUserDataPath = "config.ign" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So this introduces two new kernel arguments just for that provider. What are the reason that would require those to be configurable?
Overall, those kernel arguments would have to be baked into the image so I don't think this brings any advantage versus fixed values in the code directly.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because users of our Cloud environment might build their own images that utilise ignition and can decide on which partition or device the user-data is supposed to be injected for better isolation of concerns.
For Flatcar we already need two different configurations. One used as the base image used for the kubernetes-sigs/image-builder project and one image used for general purpose VMs. Furthermore, we are working on some OpenShift related topics and want to allow for this flexibility.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't understand how that would work. Those values would have to be set in the image and the images are not customized for each deployment (which is the goal of Ignition) so those values will be fixed.
How would you be using this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Those values would have to be set in the image
Yes indeed most of the time you need to build customized images for the IONOS Cloud anyway at the moment.
As long as they are QEMU compatible images, our VM handler will create a VM for a customer. Unfortunately without some changes to the image, ignition or cloud-init won't work out of the box. I'm currently trying to get hold of the team responsible for publishing our documentation to get our official Cloud docs up to date on this topic.
I tried to summarize the important points
First some clarification regarding the image requirements:
The filesystem needs to be ext4
(some others are also supported but definitely not btrfs)
For cloud-init support, the file /etc/cloud/cloud.cfg
needs to exist.
Regarding the experimental support for ignition
With the current implementation we have the following options:
-
Add an
OEM
labelled drive containing a file calledUSER_DATA_INJECTION_RHCOS
orUSER_DATA_INJECTION_FLATCAR
to signalize to the IONOS VM handler to inject the user data in that location. If it is an additional drive to the VM boot drive, no changes necessary for RHCOS images. This essentially acts as a rudimentary config drive. -
Build a custom image with a dedicated partition, named either
OEM
or otherwise and create aUSER_DATA_INJECTION_RHCOS
file inside of it. If the partition is labelled differently, configure the kernel flags in your grub config.
For example for Flatcar CAPI we set the kernel flags in the grub config like so:
set linux_append="flatcar.autologin ignition.config.device=OEM ignition.config.path=config.ign"
I fully know that this is unusual (and ugly) and yes I told the responsible VM provisioning team that this is not up to standards. Me and my colleague just try to get RHCOS and Flatcar supported with what we have. All of this will be explained in more detail in a How-To guide in our official docs in the future:
https://docs.ionos.com/cloud/compute-services/compute-engine/how-tos
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Add an
OEM
labelled drive containing a file calledUSER_DATA_INJECTION_RHCOS
orUSER_DATA_INJECTION_FLATCAR
to signalize to the IONOS VM handler to inject the user data in that location. If it is an additional drive to the VM boot drive, no changes necessary for RHCOS images. This essentially acts as a rudimentary config drive.
Why not include the userdata/ignition config directly in this drive?
- Build a custom image with a dedicated partition, named either
OEM
or otherwise and create aUSER_DATA_INJECTION_RHCOS
file inside of it. If the partition is labelled differently, configure the kernel flags in your grub config.
If I understand correctly, this means that you need to upload a different image every time you want to change your ignition config?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is your concern about using kernel flags?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah ok you ment a built option for ignition itself. I don't think this would work for us and it would reduce flexibility.
Can you clarify why this would not work?
What is your concern about using kernel flags?
It introduces variability where there is no need for it. As far as I know, no other provider rely on kernel flags.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As far as I know, no other provider rely on kernel flags.
I got the idea from this: https://github.com/coreos/ignition/blob/main/internal/providers/cmdline/cmdline.go
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you clarify why this would not work?
It introduces variability where there is no need for it.
Because we don't control the whole ecosystem:
- The IONOS Cloud doesn't have a metadata server (I wish it would but it doesn't. Which is why we call this an experimental implementation). And a metadata server is how other providers enable flexibility.
- We want to give others the flexibility to decide how to use it. Either change the underlying OS image or just add another "config drive" labelled OEM.
- In case of CAPI support for Flatcar. Flatcar injects the ignition config for the packer build into
OEM/config.ign
(we don't control this part). And later when actually starting a new image from the newly created image. We require ignition to fetch the config fromOEM/config/user-data
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As far as I understand, what you mentioned here does not contradict what I'm suggesting above. With the build time variables, distributions can control where they want the config to be placed.
I got the idea from this:
main
/internal/providers/cmdline/cmdline.go
This is how you can tell Ignition to fetch a config from the kernel command line. This is mostly intended for bare metal use cases or cases where the user would be in front of the system and interactively entering the URL to the config.
docs/supported-platforms.md
Outdated
@@ -20,6 +20,7 @@ Ignition is currently supported for the following platforms: | |||
* [Hetzner Cloud] (`hetzner`) - Ignition will read its configuration from the instance userdata. Cloud SSH keys are handled separately. | |||
* [Microsoft Hyper-V] (`hyperv`) - Ignition will read its configuration from the `ignition.config` key in pool 0 of the Hyper-V Data Exchange Service (KVP). Values are limited to approximately 1 KiB of text, so Ignition can also read and concatenate multiple keys named `ignition.config.0`, `ignition.config.1`, and so on. | |||
* [IBM Cloud] (`ibmcloud`) - Ignition will read its configuration from the instance userdata. Cloud SSH keys are handled separately. | |||
* [IONOS Cloud] (`ionoscloud`) - Ignition will read its configuration from the instance user-data. Per default the user-data are injected on a disk or partition with the label `OEM` which can be customized using the environment variable `IGNITION_CONFIG_DEVICE_LABEL`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks outdated? See other comment.
Add support for IONOS Cloud Add check to ignore cloud-config Add mounting of root partition Add better documentation Signed-off-by: Jan Larwig <[email protected]>
…cessary if else block Signed-off-by: Jan Larwig <[email protected]>
Signed-off-by: Jan Larwig <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@travier I think what @tuunit is saying here is that for Flatcar, they need to support both config.ign
and config/user-data
for the path component, so it can't be done at compile-time.
What is your concern about using kernel flags?
Hmm, I think having an Ignition provider be parameterized this way is a tell that we might not be going about this the right way. Provider code should already have all the information it needs to correctly interface with that provider's APIs. If you can afford to edit kargs in disk images, then you're already doing something quite advanced. It'd be better I think in that case to provide generic mechanisms that aren't tied to a specific provider.
As you mentioned, there is the cmdline
provider, which today already knows to look at ignition.config.url
. So one path forward is to extend that to also support ignition.config.device
and ignition.config.path
. Note the cmdline
provider is always active regardless of the actual ignition.platform.id
value.
And if we have that, do we even even need an IONOS provider for now?
- In the CAPI flow where you're customizing disk images, you can inject the kargs and add the marker file wherever you'd like.
- Flatcar is free to provide an "IONOS Cloud" disk image, where it can add a marker and inject the appropriate kargs, but use the
metal
platform ID. - I'm not keen on having a disk image for FCOS doing the same, but the community may decide to. But regardless, a user would be free to customize our QEMU image similarly too (I guess this could fall under our "emerging platforms support" which already requires users to do work before they get a usable image).
Then, when IONOS Cloud actually has a proper metadata service, we can circle back and add a backend here.
if util.IsCloudConfig(contents) { | ||
logger.Debug("disk (%q) contains a cloud-config configuration, ignoring", device) | ||
return nil, nil | ||
} | ||
|
||
if util.IsShellScript(contents) { | ||
logger.Debug("disk (%q) contains a shell script, ignoring", device) | ||
return nil, nil | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you elaborate on why we need this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Backwards compatibility for the Flatcar CoreOS CloudInit fork. But to be honest we don't really need it and can get rid of it.
Hi @jlebon thanks for having another look at this as well :)
Yes and no, we should choose reasonable default values like the
Interesting I wasn't aware of that fact 🤔
Sounds like a plan to me. If you are open to the idea of extending the cmdline "provider" I can move my implementation over and remove all IONOS Cloud specifics for now.
Yes that is exactly what we do at the moment.
Fine for us as well, we are mainly interested in RHCOS & Flatcar for now but obviously would love to be able to support all distros that use Ignition. |
what is your first impression about: Should I open a PR using that solution instead and we drop this PR in favour of extending the cmdline "provider"? |
I have some comments I'll leave for review, but yes it looks sane overall.
Strong 👍 from me. Curious what @travier thinks. |
@mcbenjemaa please close the PR :) Will be replaced by #2018 |
PR closed in favor of #2018 |
This PR will add support for the IONOS Cloud provider.
IONOS Cloud doesn't officially have a metadata service, as it's currently in development.
However, the IONOS Cloud injects user-data into
/var/lib/cloud/seed/nocloud/user-data
directly into the volume.I just want help in how I can test this.