import cloud-init-22.1-5.el8

import cloud-init-21.1-15.el8_6.3
import cloud-init-21.1-15.el8_6.1
2022-11-08 11:53:07 +00:00 · 2022-06-28 11:00:34 +00:00 · 2022-05-23 09:17:46 +00:00 · 2022-05-10 08:01:31 +00:00
33 changed files with 5957 additions and 6867 deletions
--- a/.cloud-init.metadata
+++ b/.cloud-init.metadata
@ -1 +1 @@
-2ae378aa2ae23b34b0ff123623ba5e2fbdc4928d SOURCES/cloud-init-21.1.tar.gz
+830185bb5ce87ad86e4d1c0c62329bb255ec1648 SOURCES/cloud-init-22.1.tar.gz
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/cloud-init-21.1.tar.gz
+SOURCES/cloud-init-22.1.tar.gz
--- a/SOURCES/0001-Add-initial-redhat-setup.patch
+++ b/SOURCES/0001-Add-initial-redhat-setup.patch
@ -1,8 +1,34 @@
-From 074cb9b011623849cfa95c1d7cc813bb28f03ff0 Mon Sep 17 00:00:00 2001
+From 5e1e568d7085fd4443b4e3ccc492f5e31747e270 Mon Sep 17 00:00:00 2001
-From: Eduardo Otubo <otubo@redhat.com>
+From: Amy Chen <xiachen@redhat.com>
-Date: Fri, 7 May 2021 13:36:03 +0200
+Date: Wed, 20 Apr 2022 10:59:48 +0800
 Subject: Add initial redhat setup
 Merged patches (22.1)
 - d18029bf Add netifaces package as a Requires in cloud-init.spec.template
 - 31adf961 Add gdisk and openssl as deps to fix UEFI / Azure initialization
 - f4a2905d Add dhcp-client as a dependency
 - 290e14cc cloud-init.spec.template: update %systemd_postun parameter
 - 9be4ae9b (tag: cloud-init-21.1-1.el8) Update to cloud-init-21.1-1.el8
 Conflicts:
 cloudinit/config/cc_chef.py  Using double quotes instead of single quotes
 cloudinit/settings.py
 - Using rhel settings
 - Using double quotes instead of single quotes
 setup.py
 - Following the changes of 21.1 rebase
 - Using double quotes instead of single quotes
 redhat/cloud-init.spec.template
 - Add the drop-in to the right cloud-init.spec used by our package builder, which is downstream-only part of the bz 2002492 fix.
 redhat/Makefile.common
 - Backport the build handling fixes from patch "Update to cloud-init-21.1-1.el8"
 Signed-off-by: Amy Chen <xiachen@redhat.com>
 Merged patches (21.1):
 - 915d30ad Change gating file to correct rhel version
 - 311f318d Removing net-tools dependency
@ -43,36 +69,36 @@ setup.py:
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 .gitignore                            |   1 +
- cloudinit/config/cc_chef.py           |  67 +++-
+ cloudinit/config/cc_chef.py           |  65 ++-
 cloudinit/settings.py                 |   7 +-
 redhat/.gitignore                     |   1 +
- redhat/Makefile                       |  71 ++++
+ redhat/Makefile                       |  71 +++
 redhat/Makefile.common                |  37 ++
 redhat/cloud-init-tmpfiles.conf       |   1 +
- redhat/cloud-init.spec.template       | 530 ++++++++++++++++++++++++++
+ redhat/cloud-init.spec.template       | 696 ++++++++++++++++++++++++++
 redhat/gating.yaml                    |   8 +
 redhat/rpmbuild/BUILD/.gitignore      |   3 +
 redhat/rpmbuild/RPMS/.gitignore       |   3 +
 redhat/rpmbuild/SOURCES/.gitignore    |   3 +
 redhat/rpmbuild/SPECS/.gitignore      |   3 +
 redhat/rpmbuild/SRPMS/.gitignore      |   3 +
- redhat/scripts/frh.py                 |  27 ++
+ redhat/scripts/frh.py                 |  25 +
- redhat/scripts/git-backport-diff      | 327 ++++++++++++++++
+ redhat/scripts/git-backport-diff      | 327 ++++++++++++
- redhat/scripts/git-compile-check      | 215 +++++++++++
+ redhat/scripts/git-compile-check      | 215 ++++++++
- redhat/scripts/process-patches.sh     |  77 ++++
+ redhat/scripts/process-patches.sh     |  92 ++++
 redhat/scripts/tarball_checksum.sh    |   3 +
 rhel/README.rhel                      |   5 +
 rhel/cloud-init-tmpfiles.conf         |   1 +
- rhel/cloud.cfg                        |  69 ++++
+ rhel/cloud.cfg                        |  69 +++
 rhel/systemd/cloud-config.service     |  18 +
 rhel/systemd/cloud-config.target      |  11 +
- rhel/systemd/cloud-final.service      |  24 ++
+ rhel/systemd/cloud-final.service      |  24 +
 rhel/systemd/cloud-init-local.service |  31 ++
- rhel/systemd/cloud-init.service       |  25 ++
+ rhel/systemd/cloud-init.service       |  25 +
 rhel/systemd/cloud-init.target        |   7 +
- setup.py                              |  23 +-
+ setup.py                              |  28 +-
 tools/read-version                    |  28 +-
- 30 files changed, 1579 insertions(+), 50 deletions(-)
+ 30 files changed, 1756 insertions(+), 55 deletions(-)
 create mode 100644 redhat/.gitignore
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
@ -100,7 +126,7 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 create mode 100644 rhel/systemd/cloud-init.target
 diff --git a/cloudinit/config/cc_chef.py b/cloudinit/config/cc_chef.py
-index aaf71366..97ef649a 100644
+index fdb3a6e3..d028c548 100644
 --- a/cloudinit/config/cc_chef.py
 +++ b/cloudinit/config/cc_chef.py
@@ -6,7 +6,70 @@
@ -175,38 +201,29 @@ index aaf71366..97ef649a 100644
 import itertools
 import json
@@ -31,7 +94,7 @@ CHEF_DIRS = tuple([
     '/var/lib/chef',
     '/var/cache/chef',
     '/var/backups/chef',
 -    '/var/run/chef',
 +    '/run/chef',
 ])
 REQUIRED_CHEF_DIRS = tuple([
     '/etc/chef',
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index 91e1bfe7..e690c0fd 100644
+index ecc1403b..39650a5b 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -47,13 +47,16 @@ CFG_BUILTIN = {
+@@ -50,13 +50,16 @@ CFG_BUILTIN = {
     ],
-     'def_log_file': '/var/log/cloud-init.log',
+     "def_log_file": "/var/log/cloud-init.log",
-     'log_cfgs': [],
+     "log_cfgs": [],
-    'syslog_fix_perms': ['syslog:adm', 'root:adm', 'root:wheel', 'root:root'],
+-    "syslog_fix_perms": ["syslog:adm", "root:adm", "root:wheel", "root:root"],
-+    'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
+    "mount_default_fields": [None, None, "auto", "defaults,nofail", "0", "2"],
-+    'ssh_deletekeys': False,
+    "ssh_deletekeys": False,
-+    'ssh_genkeytypes': [],
+    "ssh_genkeytypes": [],
-+    'syslog_fix_perms': [],
+    "syslog_fix_perms": [],
-     'system_info': {
+     "system_info": {
-         'paths': {
+         "paths": {
-             'cloud_dir': '/var/lib/cloud',
+             "cloud_dir": "/var/lib/cloud",
-             'templates_dir': '/etc/cloud/templates/',
+             "templates_dir": "/etc/cloud/templates/",
         },
-        'distro': 'ubuntu',
+-        "distro": "ubuntu",
-+        'distro': 'rhel',
+        "distro": "rhel",
-         'network': {'renderers': None},
+         "network": {"renderers": None},
     },
-     'vendor_data': {'enabled': True, 'prefix': []},
+     "vendor_data": {"enabled": True, "prefix": []},
 diff --git a/rhel/README.rhel b/rhel/README.rhel
 new file mode 100644
 index 00000000..aa29630d
@ -453,70 +470,78 @@ index 00000000..083c3b6f
 +Description=Cloud-init target
 +After=multi-user.target
 diff --git a/setup.py b/setup.py
-index cbacf48e..d5cd01a4 100755
+index a9132d2c..3c377eaa 100755
 --- a/setup.py
 +++ b/setup.py
-@@ -125,14 +125,6 @@ INITSYS_FILES = {
+@@ -139,21 +139,6 @@ INITSYS_FILES = {
-     'sysvinit_deb': [f for f in glob('sysvinit/debian/*') if is_f(f)],
+     "sysvinit_deb": [f for f in glob("sysvinit/debian/*") if is_f(f)],
-     'sysvinit_openrc': [f for f in glob('sysvinit/gentoo/*') if is_f(f)],
+     "sysvinit_openrc": [f for f in glob("sysvinit/gentoo/*") if is_f(f)],
-     'sysvinit_suse': [f for f in glob('sysvinit/suse/*') if is_f(f)],
+     "sysvinit_suse": [f for f in glob("sysvinit/suse/*") if is_f(f)],
-    'systemd': [render_tmpl(f)
+-    "systemd": [
-                for f in (glob('systemd/*.tmpl') +
+-        render_tmpl(f)
-                          glob('systemd/*.service') +
+-        for f in (
-                          glob('systemd/*.target'))
+-            glob("systemd/*.tmpl")
-                if (is_f(f) and not is_generator(f))],
+-            + glob("systemd/*.service")
-    'systemd.generators': [
+-            + glob("systemd/*.socket")
 -            + glob("systemd/*.target")
 -        )
 -        if (is_f(f) and not is_generator(f))
 -    ],
 -    "systemd.generators": [
 -        render_tmpl(f, mode=0o755)
-        for f in glob('systemd/*') if is_f(f) and is_generator(f)],
+-        for f in glob("systemd/*")
-     'upstart': [f for f in glob('upstart/*') if is_f(f)],
+-        if is_f(f) and is_generator(f)
 -    ],
     "upstart": [f for f in glob("upstart/*") if is_f(f)],
 }
 INITSYS_ROOTS = {
-@@ -142,9 +134,6 @@ INITSYS_ROOTS = {
+@@ -163,10 +148,6 @@ INITSYS_ROOTS = {
-     'sysvinit_deb': 'etc/init.d',
+     "sysvinit_deb": "etc/init.d",
-     'sysvinit_openrc': 'etc/init.d',
+     "sysvinit_openrc": "etc/init.d",
-     'sysvinit_suse': 'etc/init.d',
+     "sysvinit_suse": "etc/init.d",
-    'systemd': pkg_config_read('systemd', 'systemdsystemunitdir'),
+-    "systemd": pkg_config_read("systemd", "systemdsystemunitdir"),
-    'systemd.generators': pkg_config_read('systemd',
+-    "systemd.generators": pkg_config_read(
-                                          'systemdsystemgeneratordir'),
+-        "systemd", "systemdsystemgeneratordir"
-     'upstart': 'etc/init/',
+-    ),
     "upstart": "etc/init/",
 }
 INITSYS_TYPES = sorted([f.partition(".")[0] for f in INITSYS_ROOTS.keys()])
-@@ -245,14 +234,11 @@ if not in_virtualenv():
+@@ -281,15 +262,13 @@ data_files = [
-         INITSYS_ROOTS[k] = "/" + INITSYS_ROOTS[k]
+     (
- 
+         USR_LIB_EXEC + "/cloud-init",
- data_files = [
+         [
-    (ETC + '/cloud', [render_tmpl("config/cloud.cfg.tmpl")]),
+-            "tools/ds-identify",
-+    (ETC + '/bash_completion.d', ['bash_completion/cloud-init']),
+             "tools/hook-hotplug",
-     (ETC + '/cloud/cloud.cfg.d', glob('config/cloud.cfg.d/*')),
+             "tools/uncloud-init",
-     (ETC + '/cloud/templates', glob('templates/*')),
+             "tools/write-ssh-key-fingerprints",
-    (USR_LIB_EXEC + '/cloud-init', ['tools/ds-identify',
+         ],
-                                    'tools/uncloud-init',
+     ),
-+    (USR_LIB_EXEC + '/cloud-init', ['tools/uncloud-init',
+     (
-                                     'tools/write-ssh-key-fingerprints']),
+-        USR + "/share/bash-completion/completions",
-    (USR + '/share/bash-completion/completions',
+-        ["bash_completion/cloud-init"],
-     ['bash_completion/cloud-init']),
+        ETC + "/bash_completion.d", ["bash_completion/cloud-init"],
-     (USR + '/share/doc/cloud-init', [f for f in glob('doc/*') if is_f(f)]),
+     ),
-     (USR + '/share/doc/cloud-init/examples',
+     (USR + "/share/doc/cloud-init", [f for f in glob("doc/*") if is_f(f)]),
-         [f for f in glob('doc/examples/*') if is_f(f)]),
+     (
-@@ -263,8 +249,7 @@ if not platform.system().endswith('BSD'):
+@@ -308,8 +287,7 @@ if not platform.system().endswith("BSD"):
-     data_files.extend([
+                 ETC + "/NetworkManager/dispatcher.d/",
-         (ETC + '/NetworkManager/dispatcher.d/',
+                 ["tools/hook-network-manager"],
-          ['tools/hook-network-manager']),
+             ),
-        (ETC + '/dhcp/dhclient-exit-hooks.d/', ['tools/hook-dhclient']),
+-            (ETC + "/dhcp/dhclient-exit-hooks.d/", ["tools/hook-dhclient"]),
-        (LIB + '/udev/rules.d', [f for f in glob('udev/*.rules')])
+-            (LIB + "/udev/rules.d", [f for f in glob("udev/*.rules")]),
-+        ('/usr/lib/udev/rules.d', [f for f in glob('udev/*.rules')])
+            ("/usr/lib/udev/rules.d", [f for f in glob("udev/*.rules")]),
-     ])
+             (
- # Use a subclass for install that handles
+                 ETC + "/systemd/system/sshd-keygen@.service.d/",
- # adding on the right init system configuration files
+                 ["systemd/disable-sshd-keygen-if-cloud-init-active.conf"],
-@@ -286,8 +271,6 @@ setuptools.setup(
+@@ -339,8 +317,6 @@ setuptools.setup(
-     scripts=['tools/cloud-init-per'],
+     scripts=["tools/cloud-init-per"],
-     license='Dual-licensed under GPLv3 or Apache 2.0',
+     license="Dual-licensed under GPLv3 or Apache 2.0",
     data_files=data_files,
 -    install_requires=requirements,
 -    cmdclass=cmdclass,
     entry_points={
-         'console_scripts': [
+         "console_scripts": [
-             'cloud-init = cloudinit.cmd.main:main',
+             "cloud-init = cloudinit.cmd.main:main",
 diff --git a/tools/read-version b/tools/read-version
 index 02c90643..79755f78 100755
 --- a/tools/read-version
@ -557,5 +582,5 @@ index 02c90643..79755f78 100755
 # version is X.Y.Z[+xxx.gHASH]
 # version_long is None or X.Y.Z-xxx-gHASH
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0002-Do-not-write-NM_CONTROLLED-no-in-generated-interface.patch
+++ b/SOURCES/0002-Do-not-write-NM_CONTROLLED-no-in-generated-interface.patch
@ -1,4 +1,4 @@
-From 472c2b5d4342b6ab6ce1584dc39bed0e6c1ca2e7 Mon Sep 17 00:00:00 2001
+From e0dc628ac553072891fa6607dc91b652efd99be2 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:06 +0200
 Subject: Do not write NM_CONTROLLED=no in generated interface config  files
@ -12,28 +12,27 @@ X-downstream-only: true
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Signed-off-by: Ryan McCabe <rmccabe@redhat.com>
 ---
- cloudinit/net/sysconfig.py  |  2 +-
+ cloudinit/net/sysconfig.py  |  1 -
 tests/unittests/test_net.py | 28 ----------------------------
- 2 files changed, 1 insertion(+), 29 deletions(-)
+ 2 files changed, 29 deletions(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
-index 99a4bae4..3d276666 100644
+index ba85c4f6..e06ddee7 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
-@@ -289,7 +289,7 @@ class Renderer(renderer.Renderer):
+@@ -336,7 +336,6 @@ class Renderer(renderer.Renderer):
-     #                                         details about this)
+         "rhel": {
- 
+             "ONBOOT": True,
-     iface_defaults = {
+             "USERCTL": False,
-        'rhel': {'ONBOOT': True, 'USERCTL': False, 'NM_CONTROLLED': False,
+-            "NM_CONTROLLED": False,
-+        'rhel': {'ONBOOT': True, 'USERCTL': False,
+             "BOOTPROTO": "none",
-                  'BOOTPROTO': 'none'},
+         },
-         'suse': {'BOOTPROTO': 'static', 'STARTMODE': 'auto'},
+         "suse": {"BOOTPROTO": "static", "STARTMODE": "auto"},
     }
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
-index 38d934d4..c67b5fcc 100644
+index 47e4ba00..591241b3 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
-@@ -535,7 +535,6 @@ GATEWAY=172.19.3.254
+@@ -579,7 +579,6 @@ GATEWAY=172.19.3.254
 HWADDR=fa:16:3e:ed:9a:59
 IPADDR=172.19.1.34
 NETMASK=255.255.252.0
@ -41,7 +40,7 @@ index 38d934d4..c67b5fcc 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -633,7 +632,6 @@ IPADDR=172.19.1.34
+@@ -712,7 +711,6 @@ IPADDR=172.19.1.34
 IPADDR1=10.0.0.10
 NETMASK=255.255.252.0
 NETMASK1=255.255.255.0
@ -49,7 +48,7 @@ index 38d934d4..c67b5fcc 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -756,7 +754,6 @@ IPV6_AUTOCONF=no
+@@ -874,7 +872,6 @@ IPV6_AUTOCONF=no
 IPV6_DEFAULTGW=2001:DB8::1
 IPV6_FORCE_ACCEPT_RA=no
 NETMASK=255.255.252.0
@ -57,23 +56,23 @@ index 38d934d4..c67b5fcc 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -884,7 +881,6 @@ NETWORK_CONFIGS = {
+@@ -1053,7 +1050,6 @@ NETWORK_CONFIGS = {
                 BOOTPROTO=none
                 DEVICE=eth1
                 HWADDR=cf:d6:af:48:e8:80
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -901,7 +897,6 @@ NETWORK_CONFIGS = {
+@@ -1072,7 +1068,6 @@ NETWORK_CONFIGS = {
                 IPADDR=192.168.21.3
                 NETMASK=255.255.255.0
                 METRIC=10000
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -1032,7 +1027,6 @@ NETWORK_CONFIGS = {
+@@ -1244,7 +1239,6 @@ NETWORK_CONFIGS = {
                 IPV6_AUTOCONF=no
                 IPV6_FORCE_ACCEPT_RA=no
                 NETMASK=255.255.255.0
@ -81,15 +80,15 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
-@@ -1737,7 +1731,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2093,7 +2087,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DHCPV6C=yes
                 IPV6INIT=yes
                 MACADDR=aa:bb:cc:dd:ee:ff
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Bond
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -1745,7 +1738,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2103,7 +2096,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=dhcp
                 DEVICE=bond0.200
                 DHCLIENT_SET_DEFAULT_ROUTE=no
@ -97,7 +96,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 PHYSDEV=bond0
                 USERCTL=no
-@@ -1763,7 +1755,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2123,7 +2115,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 IPV6_DEFAULTGW=2001:4800:78ff:1b::1
                 MACADDR=bb:bb:bb:bb:bb:aa
                 NETMASK=255.255.255.0
@ -105,15 +104,15 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 PRIO=22
                 STP=no
-@@ -1773,7 +1764,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2135,7 +2126,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=eth0
                 HWADDR=c0:d6:9f:2c:e8:80
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -1790,7 +1780,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2154,7 +2144,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 MTU=1500
                 NETMASK=255.255.255.0
                 NETMASK1=255.255.255.0
@ -121,7 +120,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 PHYSDEV=eth0
                 USERCTL=no
-@@ -1800,7 +1789,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2166,7 +2155,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth1
                 HWADDR=aa:d6:9f:2c:e8:80
                 MASTER=bond0
@ -129,7 +128,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 SLAVE=yes
                 TYPE=Ethernet
-@@ -1810,7 +1798,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2178,7 +2166,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth2
                 HWADDR=c0:bb:9f:2c:e8:80
                 MASTER=bond0
@ -137,31 +136,31 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 SLAVE=yes
                 TYPE=Ethernet
-@@ -1820,7 +1807,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2190,7 +2177,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BRIDGE=br0
                 DEVICE=eth3
                 HWADDR=66:bb:9f:2c:e8:80
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -1829,7 +1815,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2201,7 +2187,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BRIDGE=br0
                 DEVICE=eth4
                 HWADDR=98:bb:9f:2c:e8:80
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -1838,7 +1823,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -2212,7 +2197,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth5
                 DHCLIENT_SET_DEFAULT_ROUTE=no
                 HWADDR=98:bb:9f:2c:e8:8a
 -                NM_CONTROLLED=no
                 ONBOOT=no
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -2294,7 +2278,6 @@ iface bond0 inet6 static
+@@ -2689,7 +2673,6 @@ iface bond0 inet6 static
         MTU=9000
         NETMASK=255.255.255.0
         NETMASK1=255.255.255.0
@ -169,7 +168,7 @@ index 38d934d4..c67b5fcc 100644
         ONBOOT=yes
         TYPE=Bond
         USERCTL=no
-@@ -2304,7 +2287,6 @@ iface bond0 inet6 static
+@@ -2701,7 +2684,6 @@ iface bond0 inet6 static
         DEVICE=bond0s0
         HWADDR=aa:bb:cc:dd:e8:00
         MASTER=bond0
@ -177,7 +176,7 @@ index 38d934d4..c67b5fcc 100644
         ONBOOT=yes
         SLAVE=yes
         TYPE=Ethernet
-@@ -2326,7 +2308,6 @@ iface bond0 inet6 static
+@@ -2729,7 +2711,6 @@ iface bond0 inet6 static
         DEVICE=bond0s1
         HWADDR=aa:bb:cc:dd:e8:01
         MASTER=bond0
@ -185,15 +184,15 @@ index 38d934d4..c67b5fcc 100644
         ONBOOT=yes
         SLAVE=yes
         TYPE=Ethernet
-@@ -2383,7 +2364,6 @@ iface bond0 inet6 static
+@@ -2794,7 +2775,6 @@ iface bond0 inet6 static
                 BOOTPROTO=none
                 DEVICE=en0
                 HWADDR=aa:bb:cc:dd:e8:00
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
-                 USERCTL=no"""),
+                 USERCTL=no"""
-@@ -2402,7 +2382,6 @@ iface bond0 inet6 static
+@@ -2815,7 +2795,6 @@ iface bond0 inet6 static
                 MTU=2222
                 NETMASK=255.255.255.0
                 NETMASK1=255.255.255.0
@ -201,7 +200,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 PHYSDEV=en0
                 USERCTL=no
-@@ -2467,7 +2446,6 @@ iface bond0 inet6 static
+@@ -2890,7 +2869,6 @@ iface bond0 inet6 static
                 DEVICE=br0
                 IPADDR=192.168.2.2
                 NETMASK=255.255.255.0
@ -209,7 +208,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 PRIO=22
                 STP=no
-@@ -2591,7 +2569,6 @@ iface bond0 inet6 static
+@@ -3032,7 +3010,6 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:00
                 IPADDR=192.168.1.2
                 NETMASK=255.255.255.0
@ -217,7 +216,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=no
                 TYPE=Ethernet
                 USERCTL=no
-@@ -2601,7 +2578,6 @@ iface bond0 inet6 static
+@@ -3044,7 +3021,6 @@ iface bond0 inet6 static
                 DEVICE=eth1
                 HWADDR=52:54:00:12:34:aa
                 MTU=1480
@ -225,7 +224,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
-@@ -2610,7 +2586,6 @@ iface bond0 inet6 static
+@@ -3055,7 +3031,6 @@ iface bond0 inet6 static
                 BOOTPROTO=none
                 DEVICE=eth2
                 HWADDR=52:54:00:12:34:ff
@ -233,7 +232,7 @@ index 38d934d4..c67b5fcc 100644
                 ONBOOT=no
                 TYPE=Ethernet
                 USERCTL=no
-@@ -3027,7 +3002,6 @@ class TestRhelSysConfigRendering(CiTestCase):
+@@ -3628,7 +3603,6 @@ class TestRhelSysConfigRendering(CiTestCase):
 BOOTPROTO=dhcp
 DEVICE=eth1000
 HWADDR=07-1c-c6-75-a4-be
@ -241,7 +240,7 @@ index 38d934d4..c67b5fcc 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -3148,7 +3122,6 @@ GATEWAY=10.0.2.2
+@@ -3840,7 +3814,6 @@ GATEWAY=10.0.2.2
 HWADDR=52:54:00:12:34:00
 IPADDR=10.0.2.15
 NETMASK=255.255.255.0
@ -249,7 +248,7 @@ index 38d934d4..c67b5fcc 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -3218,7 +3191,6 @@ USERCTL=no
+@@ -3910,7 +3883,6 @@ USERCTL=no
 #
 BOOTPROTO=dhcp
 DEVICE=eth0
@ -258,5 +257,5 @@ index 38d934d4..c67b5fcc 100644
 TYPE=Ethernet
 USERCTL=no
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0003-limit-permissions-on-def_log_file.patch
+++ b/SOURCES/0003-limit-permissions-on-def_log_file.patch
@ -1,4 +1,4 @@
-From 6134624f10ef56534e37624adc12f11b09910591 Mon Sep 17 00:00:00 2001
+From cb7b35ca10c82c9725c3527e3ec5fb8cb7c61bc0 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:08 +0200
 Subject: limit permissions on def_log_file
@ -22,31 +22,31 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 3 files changed, 6 insertions(+)
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index e690c0fd..43a1490c 100644
+index 39650a5b..3c2145e9 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -46,6 +46,7 @@ CFG_BUILTIN = {
+@@ -49,6 +49,7 @@ CFG_BUILTIN = {
-         'None',
+         "None",
     ],
-     'def_log_file': '/var/log/cloud-init.log',
+     "def_log_file": "/var/log/cloud-init.log",
-+    'def_log_file_mode': 0o600,
+    "def_log_file_mode": 0o600,
-     'log_cfgs': [],
+     "log_cfgs": [],
-     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
+     "mount_default_fields": [None, None, "auto", "defaults,nofail", "0", "2"],
-     'ssh_deletekeys': False,
+     "ssh_deletekeys": False,
 diff --git a/cloudinit/stages.py b/cloudinit/stages.py
-index 3ef4491c..83e25dd1 100644
+index 3f17294b..61db1dbd 100644
 --- a/cloudinit/stages.py
 +++ b/cloudinit/stages.py
-@@ -147,6 +147,7 @@ class Init(object):
+@@ -205,6 +205,7 @@ class Init(object):
     def _initialize_filesystem(self):
         util.ensure_dirs(self._initial_subdirs())
-         log_file = util.get_cfg_option_str(self.cfg, 'def_log_file')
+         log_file = util.get_cfg_option_str(self.cfg, "def_log_file")
-+        log_file_mode = util.get_cfg_option_int(self.cfg, 'def_log_file_mode')
+        log_file_mode = util.get_cfg_option_int(self.cfg, "def_log_file_mode")
         if log_file:
-             util.ensure_file(log_file, preserve_mode=True)
+             util.ensure_file(log_file, mode=0o640, preserve_mode=True)
-             perms = self.cfg.get('syslog_fix_perms')
+             perms = self.cfg.get("syslog_fix_perms")
 diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
-index de9a0f87..bb33ad45 100644
+index a2b4a3fa..0ccf3147 100644
 --- a/doc/examples/cloud-config.txt
 +++ b/doc/examples/cloud-config.txt
@@ -414,10 +414,14 @@ timezone: US/Eastern
@ -65,5 +65,5 @@ index de9a0f87..bb33ad45 100644
 # you can set passwords for a user or multiple users
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0004-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
+++ b/SOURCES/0004-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
@ -1,4 +1,4 @@
-From dfea0490b899804761fbd7aa23822783d7c36ec5 Mon Sep 17 00:00:00 2001
+From ffa647e83efd4293bd027e9e390274aad8a12d94 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:13 +0200
 Subject: include 'NOZEROCONF=yes' in /etc/sysconfig/network
@ -22,44 +22,31 @@ Resolves: rhbz#1653131
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- cloudinit/net/sysconfig.py  | 11 ++++++++++-
+ cloudinit/net/sysconfig.py | 11 ++++++++++-
- tests/unittests/test_net.py |  1 -
+ 1 file changed, 10 insertions(+), 1 deletion(-)
 2 files changed, 10 insertions(+), 2 deletions(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
-index 3d276666..d5440998 100644
+index e06ddee7..362e8d19 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
-@@ -925,7 +925,16 @@ class Renderer(renderer.Renderer):
+@@ -1038,7 +1038,16 @@ class Renderer(renderer.Renderer):
         # Distros configuring /etc/sysconfig/network as a file e.g. Centos
-         if sysconfig_path.endswith('network'):
+         if sysconfig_path.endswith("network"):
             util.ensure_dir(os.path.dirname(sysconfig_path))
-            netcfg = [_make_header(), 'NETWORKING=yes']
+-            netcfg = [_make_header(), "NETWORKING=yes"]
 +            netcfg = []
-+            for line in util.load_file(sysconfig_path, quiet=True).split('\n'):
+            for line in util.load_file(sysconfig_path, quiet=True).split("\n"):
-+                if 'cloud-init' in line:
+                if "cloud-init" in line:
 +                    break
-+                if not line.startswith(('NETWORKING=',
+                if not line.startswith(("NETWORKING=",
-+                                        'IPV6_AUTOCONF=',
+                                        "IPV6_AUTOCONF=",
-+                                        'NETWORKING_IPV6=')):
+                                        "NETWORKING_IPV6=")):
 +                    netcfg.append(line)
 +            # Now generate the cloud-init portion of sysconfig/network
-+            netcfg.extend([_make_header(), 'NETWORKING=yes'])
+            netcfg.extend([_make_header(), "NETWORKING=yes"])
             if network_state.use_ipv6:
-                 netcfg.append('NETWORKING_IPV6=yes')
+                 netcfg.append("NETWORKING_IPV6=yes")
-                 netcfg.append('IPV6_AUTOCONF=no')
+                 netcfg.append("IPV6_AUTOCONF=no")
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index 4ea0e597..c67b5fcc 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -1729,7 +1729,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=bond0
                 DHCPV6C=yes
 -                IPV6_AUTOCONF=no
                 IPV6INIT=yes
                 MACADDR=aa:bb:cc:dd:ee:ff
                 ONBOOT=yes
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
+++ b/SOURCES/0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
@ -1,36 +0,0 @@
 From 699d37a6ff3e343e214943794aac09e4156c2b2b Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:10 +0200
 Subject: sysconfig: Don't write BOOTPROTO=dhcp for ipv6 dhcp
 Don't write BOOTPROTO=dhcp for ipv6 dhcp, as BOOTPROTO applies
 only to ipv4. Explicitly write IPV6_AUTOCONF=no for dhcp on ipv6.
 X-downstream-only: yes
 Resolves: rhbz#1519271
 Signed-off-by: Ryan McCabe <rmccabe@redhat.com>
 Merged patches (19.4):
 - 6444df4 sysconfig: Don't disable IPV6_AUTOCONF
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 tests/unittests/test_net.py | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index c67b5fcc..4ea0e597 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -1729,6 +1729,7 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=bond0
                 DHCPV6C=yes
 +                IPV6_AUTOCONF=no
                 IPV6INIT=yes
                 MACADDR=aa:bb:cc:dd:ee:ff
                 ONBOOT=yes
 -- 
 2.27.0
--- a/SOURCES/0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
+++ b/SOURCES/0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
@ -1,57 +0,0 @@
 From ccc75c1be3ae08d813193071c798fc905b5c03e5 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:12 +0200
 Subject: DataSourceAzure.py: use hostnamectl to set hostname
 RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
 Message-id: <20180417130754.12918-3-vkuznets@redhat.com>
 Patchwork-id: 79659
 O-Subject: [RHEL7.6/7.5.z cloud-init PATCH 2/2] DataSourceAzure.py: use hostnamectl to set hostname
 Bugzilla: 1568717
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Mohammed Gamal <mgamal@redhat.com>
 RH-Acked-by: Cathy Avery <cavery@redhat.com>
 The right way to set hostname in RHEL7 is:
 $ hostnamectl set-hostname HOSTNAME
 DataSourceAzure, however, uses:
 $ hostname HOSTSNAME
 instead and this causes problems. We can't simply change
 'BUILTIN_DS_CONFIG' in DataSourceAzure.py as 'hostname' is being used
 for both getting and setting the hostname.
 Long term, this should be fixed in a different way. Cloud-init
 has distro-specific hostname setting/getting (see
 cloudinit/distros/rhel.py) and DataSourceAzure.py needs to be switched
 to use these.
 Resolves: rhbz#1434109
 X-downstream-only: yes
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 cloudinit/sources/DataSourceAzure.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
 index cee630f7..553b5a7e 100755
 --- a/cloudinit/sources/DataSourceAzure.py
 +++ b/cloudinit/sources/DataSourceAzure.py
@@ -296,7 +296,7 @@ def get_hostname(hostname_command='hostname'):
 def set_hostname(hostname, hostname_command='hostname'):
 -    subp.subp([hostname_command, hostname])
 +    util.subp(['hostnamectl', 'set-hostname', str(hostname)])
 @azure_ds_telemetry_reporter
 -- 
 2.27.0
--- a/SOURCES/0005-Remove-race-condition-between-cloud-init-and-Network.patch
+++ b/SOURCES/0005-Remove-race-condition-between-cloud-init-and-Network.patch
@ -1,4 +1,4 @@
-From 24894dcf45a307f44e29dc5d5b2d864b75fd982c Mon Sep 17 00:00:00 2001
+From 386f0a82bfdfd62e506bf4251c17263260d3250a Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Fri, 7 May 2021 13:36:14 +0200
 Subject: Remove race condition between cloud-init and NetworkManager
@ -144,5 +144,5 @@ index d0023a05..0b3d796d 100644
 Before=sshd-keygen.service
 Before=sshd.service
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0006-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
+++ b/SOURCES/0006-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
@ -1,8 +1,8 @@
-From abf1adeae8211f5acd87dc63b03b2ed995047efd Mon Sep 17 00:00:00 2001
+From b545a0cbabe8924d048b7172b30e7aad59ed32d5 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 20 May 2021 08:53:55 +0200
-Subject: [PATCH 1/2] rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and
+Subject: rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and set in
- set in cloud.cfg
+ cloud.cfg
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 10: rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and set in cloud.cfg
@ -35,18 +35,18 @@ Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 2 files changed, 1 insertion(+), 3 deletions(-)
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index 43a1490c..2acf2615 100644
+index 3c2145e9..71672e10 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -49,8 +49,6 @@ CFG_BUILTIN = {
+@@ -52,8 +52,6 @@ CFG_BUILTIN = {
-     'def_log_file_mode': 0o600,
+     "def_log_file_mode": 0o600,
-     'log_cfgs': [],
+     "log_cfgs": [],
-     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
+     "mount_default_fields": [None, None, "auto", "defaults,nofail", "0", "2"],
-    'ssh_deletekeys': False,
+-    "ssh_deletekeys": False,
-    'ssh_genkeytypes': [],
+-    "ssh_genkeytypes": [],
-     'syslog_fix_perms': [],
+     "syslog_fix_perms": [],
-     'system_info': {
+     "system_info": {
-         'paths': {
+         "paths": {
 diff --git a/rhel/cloud.cfg b/rhel/cloud.cfg
 index 9ecba215..cbee197a 100644
 --- a/rhel/cloud.cfg
@ -61,5 +61,5 @@ index 9ecba215..cbee197a 100644
 disable_vmware_customization: false
 -- 
-2.27.0
+2.31.1
--- a/SOURCES/0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
+++ b/SOURCES/0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
@ -1,496 +0,0 @@
 From b48dda73da94782d7ab0c455fa382d3a5ef3c419 Mon Sep 17 00:00:00 2001
 From: Daniel Watkins <oddbloke@ubuntu.com>
 Date: Mon, 8 Mar 2021 12:50:57 -0500
 Subject: net: exclude OVS internal interfaces in get_interfaces (#829)
 `get_interfaces` is used to in two ways, broadly: firstly, to determine
 the available interfaces when converting cloud network configuration
 formats to cloud-init's network configuration formats; and, secondly, to
 ensure that any interfaces which are specified in network configuration
 are (a) available, and (b) named correctly.  The first of these is
 unaffected by this commit, as no clouds support Open vSwitch
 configuration in their network configuration formats.
 For the second, we check that MAC addresses of physical devices are
 unique.  In some OVS configurations, there are OVS-created devices which
 have duplicate MAC addresses, either with each other or with physical
 devices.  As these interfaces are created by OVS, we can be confident
 that (a) they will be available when appropriate, and (b) that OVS will
 name them correctly.  As such, this commit excludes any OVS-internal
 interfaces from the set of interfaces returned by `get_interfaces`.
 LP: #1912844
 ---
 cloudinit/net/__init__.py                     |  62 +++++++++
 cloudinit/net/tests/test_init.py              | 119 ++++++++++++++++++
 .../sources/helpers/tests/test_openstack.py   |   5 +
 cloudinit/sources/tests/test_oracle.py        |   4 +
 .../integration_tests/bugs/test_lp1912844.py  | 103 +++++++++++++++
 .../test_datasource/test_configdrive.py       |   8 ++
 tests/unittests/test_net.py                   |  20 +++
 7 files changed, 321 insertions(+)
 create mode 100644 tests/integration_tests/bugs/test_lp1912844.py
 diff --git a/cloudinit/net/__init__.py b/cloudinit/net/__init__.py
 index de65e7af..385b7bcc 100644
 --- a/cloudinit/net/__init__.py
 +++ b/cloudinit/net/__init__.py
@@ -6,6 +6,7 @@
 # This file is part of cloud-init. See LICENSE file for license information.
 import errno
 +import functools
 import ipaddress
 import logging
 import os
@@ -19,6 +20,19 @@ from cloudinit.url_helper import UrlError, readurl
 LOG = logging.getLogger(__name__)
 SYS_CLASS_NET = "/sys/class/net/"
 DEFAULT_PRIMARY_INTERFACE = 'eth0'
 +OVS_INTERNAL_INTERFACE_LOOKUP_CMD = [
 +    "ovs-vsctl",
 +    "--format",
 +    "csv",
 +    "--no-headings",
 +    "--timeout",
 +    "10",
 +    "--columns",
 +    "name",
 +    "find",
 +    "interface",
 +    "type=internal",
 +]
 def natural_sort_key(s, _nsre=re.compile('([0-9]+)')):
@@ -133,6 +147,52 @@ def master_is_openvswitch(devname):
     return os.path.exists(ovs_path)
 +@functools.lru_cache(maxsize=None)
 +def openvswitch_is_installed() -> bool:
 +    """Return a bool indicating if Open vSwitch is installed in the system."""
 +    ret = bool(subp.which("ovs-vsctl"))
 +    if not ret:
 +        LOG.debug(
 +            "ovs-vsctl not in PATH; not detecting Open vSwitch interfaces"
 +        )
 +    return ret
 +
 +
 +@functools.lru_cache(maxsize=None)
 +def get_ovs_internal_interfaces() -> list:
 +    """Return a list of the names of OVS internal interfaces on the system.
 +
 +    These will all be strings, and are used to exclude OVS-specific interface
 +    from cloud-init's network configuration handling.
 +    """
 +    try:
 +        out, _err = subp.subp(OVS_INTERNAL_INTERFACE_LOOKUP_CMD)
 +    except subp.ProcessExecutionError as exc:
 +        if "database connection failed" in exc.stderr:
 +            LOG.info(
 +                "Open vSwitch is not yet up; no interfaces will be detected as"
 +                " OVS-internal"
 +            )
 +            return []
 +        raise
 +    else:
 +        return out.splitlines()
 +
 +
 +def is_openvswitch_internal_interface(devname: str) -> bool:
 +    """Returns True if this is an OVS internal interface.
 +
 +    If OVS is not installed or not yet running, this will return False.
 +    """
 +    if not openvswitch_is_installed():
 +        return False
 +    ovs_bridges = get_ovs_internal_interfaces()
 +    if devname in ovs_bridges:
 +        LOG.debug("Detected %s as an OVS interface", devname)
 +        return True
 +    return False
 +
 +
 def is_netfailover(devname, driver=None):
     """ netfailover driver uses 3 nics, master, primary and standby.
         this returns True if the device is either the primary or standby
@@ -884,6 +944,8 @@ def get_interfaces(blacklist_drivers=None) -> list:
         # skip nics that have no mac (00:00....)
         if name != 'lo' and mac == zero_mac[:len(mac)]:
             continue
 +        if is_openvswitch_internal_interface(name):
 +            continue
         # skip nics that have drivers blacklisted
         driver = device_driver(name)
         if driver in blacklist_drivers:
 diff --git a/cloudinit/net/tests/test_init.py b/cloudinit/net/tests/test_init.py
 index 0535387a..946f8ee2 100644
 --- a/cloudinit/net/tests/test_init.py
 +++ b/cloudinit/net/tests/test_init.py
@@ -391,6 +391,10 @@ class TestGetDeviceList(CiTestCase):
         self.assertCountEqual(['eth0', 'eth1'], net.get_devicelist())
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False),
 +)
 class TestGetInterfaceMAC(CiTestCase):
     def setUp(self):
@@ -1224,6 +1228,121 @@ class TestNetFailOver(CiTestCase):
         self.assertFalse(net.is_netfailover(devname, driver))
 +class TestOpenvswitchIsInstalled:
 +    """Test cloudinit.net.openvswitch_is_installed.
 +
 +    Uses the ``clear_lru_cache`` local autouse fixture to allow us to test
 +    despite the ``lru_cache`` decorator on the unit under test.
 +    """
 +
 +    @pytest.fixture(autouse=True)
 +    def clear_lru_cache(self):
 +        net.openvswitch_is_installed.cache_clear()
 +
 +    @pytest.mark.parametrize(
 +        "expected,which_return", [(True, "/some/path"), (False, None)]
 +    )
 +    @mock.patch("cloudinit.net.subp.which")
 +    def test_mirrors_which_result(self, m_which, expected, which_return):
 +        m_which.return_value = which_return
 +        assert expected == net.openvswitch_is_installed()
 +
 +    @mock.patch("cloudinit.net.subp.which")
 +    def test_only_calls_which_once(self, m_which):
 +        net.openvswitch_is_installed()
 +        net.openvswitch_is_installed()
 +        assert 1 == m_which.call_count
 +
 +
 +@mock.patch("cloudinit.net.subp.subp", return_value=("", ""))
 +class TestGetOVSInternalInterfaces:
 +    """Test cloudinit.net.get_ovs_internal_interfaces.
 +
 +    Uses the ``clear_lru_cache`` local autouse fixture to allow us to test
 +    despite the ``lru_cache`` decorator on the unit under test.
 +    """
 +    @pytest.fixture(autouse=True)
 +    def clear_lru_cache(self):
 +        net.get_ovs_internal_interfaces.cache_clear()
 +
 +    def test_command_used(self, m_subp):
 +        """Test we use the correct command when we call subp"""
 +        net.get_ovs_internal_interfaces()
 +
 +        assert [
 +            mock.call(net.OVS_INTERNAL_INTERFACE_LOOKUP_CMD)
 +        ] == m_subp.call_args_list
 +
 +    def test_subp_contents_split_and_returned(self, m_subp):
 +        """Test that the command output is appropriately mangled."""
 +        stdout = "iface1\niface2\niface3\n"
 +        m_subp.return_value = (stdout, "")
 +
 +        assert [
 +            "iface1",
 +            "iface2",
 +            "iface3",
 +        ] == net.get_ovs_internal_interfaces()
 +
 +    def test_database_connection_error_handled_gracefully(self, m_subp):
 +        """Test that the error indicating OVS is down is handled gracefully."""
 +        m_subp.side_effect = ProcessExecutionError(
 +            stderr="database connection failed"
 +        )
 +
 +        assert [] == net.get_ovs_internal_interfaces()
 +
 +    def test_other_errors_raised(self, m_subp):
 +        """Test that only database connection errors are handled."""
 +        m_subp.side_effect = ProcessExecutionError()
 +
 +        with pytest.raises(ProcessExecutionError):
 +            net.get_ovs_internal_interfaces()
 +
 +    def test_only_runs_once(self, m_subp):
 +        """Test that we cache the value."""
 +        net.get_ovs_internal_interfaces()
 +        net.get_ovs_internal_interfaces()
 +
 +        assert 1 == m_subp.call_count
 +
 +
 +@mock.patch("cloudinit.net.get_ovs_internal_interfaces")
 +@mock.patch("cloudinit.net.openvswitch_is_installed")
 +class TestIsOpenVSwitchInternalInterface:
 +    def test_false_if_ovs_not_installed(
 +        self, m_openvswitch_is_installed, _m_get_ovs_internal_interfaces
 +    ):
 +        """Test that OVS' absence returns False."""
 +        m_openvswitch_is_installed.return_value = False
 +
 +        assert not net.is_openvswitch_internal_interface("devname")
 +
 +    @pytest.mark.parametrize(
 +        "detected_interfaces,devname,expected_return",
 +        [
 +            ([], "devname", False),
 +            (["notdevname"], "devname", False),
 +            (["devname"], "devname", True),
 +            (["some", "other", "devices", "and", "ours"], "ours", True),
 +        ],
 +    )
 +    def test_return_value_based_on_detected_interfaces(
 +        self,
 +        m_openvswitch_is_installed,
 +        m_get_ovs_internal_interfaces,
 +        detected_interfaces,
 +        devname,
 +        expected_return,
 +    ):
 +        """Test that the detected interfaces are used correctly."""
 +        m_openvswitch_is_installed.return_value = True
 +        m_get_ovs_internal_interfaces.return_value = detected_interfaces
 +        assert expected_return == net.is_openvswitch_internal_interface(
 +            devname
 +        )
 +
 +
 class TestIsIpAddress:
     """Tests for net.is_ip_address.
 diff --git a/cloudinit/sources/helpers/tests/test_openstack.py b/cloudinit/sources/helpers/tests/test_openstack.py
 index 2bde1e3f..95fb9743 100644
 --- a/cloudinit/sources/helpers/tests/test_openstack.py
 +++ b/cloudinit/sources/helpers/tests/test_openstack.py
@@ -1,10 +1,15 @@
 # This file is part of cloud-init. See LICENSE file for license information.
 # ./cloudinit/sources/helpers/tests/test_openstack.py
 +from unittest import mock
 from cloudinit.sources.helpers import openstack
 from cloudinit.tests import helpers as test_helpers
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestConvertNetJson(test_helpers.CiTestCase):
     def test_phy_types(self):
 diff --git a/cloudinit/sources/tests/test_oracle.py b/cloudinit/sources/tests/test_oracle.py
 index a7bbdfd9..dcf33b9b 100644
 --- a/cloudinit/sources/tests/test_oracle.py
 +++ b/cloudinit/sources/tests/test_oracle.py
@@ -173,6 +173,10 @@ class TestIsPlatformViable(test_helpers.CiTestCase):
         m_read_dmi_data.assert_has_calls([mock.call('chassis-asset-tag')])
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestNetworkConfigFromOpcImds:
     def test_no_secondary_nics_does_not_mutate_input(self, oracle_ds):
         oracle_ds._vnics_data = [{}]
 diff --git a/tests/integration_tests/bugs/test_lp1912844.py b/tests/integration_tests/bugs/test_lp1912844.py
 new file mode 100644
 index 00000000..efafae50
 --- /dev/null
 +++ b/tests/integration_tests/bugs/test_lp1912844.py
@@ -0,0 +1,103 @@
 +"""Integration test for LP: #1912844
 +
 +cloud-init should ignore OVS-internal interfaces when performing its own
 +interface determination: these interfaces are handled fully by OVS, so
 +cloud-init should never need to touch them.
 +
 +This test is a semi-synthetic reproducer for the bug.  It uses a similar
 +network configuration, tweaked slightly to DHCP in a way that will succeed even
 +on "failed" boots.  The exact bug doesn't reproduce with the NoCloud
 +datasource, because it runs at init-local time (whereas the MAAS datasource,
 +from the report, runs only at init (network) time): this means that the
 +networking code runs before OVS creates its interfaces (which happens after
 +init-local but, of course, before networking is up), and so doesn't generate
 +the traceback that they cause.  We work around this by calling
 +``get_interfaces_by_mac` directly in the test code.
 +"""
 +import pytest
 +
 +from tests.integration_tests import random_mac_address
 +
 +MAC_ADDRESS = random_mac_address()
 +
 +NETWORK_CONFIG = """\
 +bonds:
 +    bond0:
 +        interfaces:
 +            - enp5s0
 +        macaddress: {0}
 +        mtu: 1500
 +bridges:
 +        ovs-br:
 +            interfaces:
 +            - bond0
 +            macaddress: {0}
 +            mtu: 1500
 +            openvswitch: {{}}
 +            dhcp4: true
 +ethernets:
 +    enp5s0:
 +      mtu: 1500
 +      set-name: enp5s0
 +      match:
 +          macaddress: {0}
 +version: 2
 +vlans:
 +  ovs-br.100:
 +    id: 100
 +    link: ovs-br
 +    mtu: 1500
 +  ovs-br.200:
 +    id: 200
 +    link: ovs-br
 +    mtu: 1500
 +""".format(MAC_ADDRESS)
 +
 +
 +SETUP_USER_DATA = """\
 +#cloud-config
 +packages:
 +- openvswitch-switch
 +"""
 +
 +
 +@pytest.fixture
 +def ovs_enabled_session_cloud(session_cloud):
 +    """A session_cloud wrapper, to use an OVS-enabled image for tests.
 +
 +    This implementation is complicated by wanting to use ``session_cloud``s
 +    snapshot cleanup/retention logic, to avoid having to reimplement that here.
 +    """
 +    old_snapshot_id = session_cloud.snapshot_id
 +    with session_cloud.launch(
 +        user_data=SETUP_USER_DATA,
 +    ) as instance:
 +        instance.instance.clean()
 +        session_cloud.snapshot_id = instance.snapshot()
 +
 +    yield session_cloud
 +
 +    try:
 +        session_cloud.delete_snapshot()
 +    finally:
 +        session_cloud.snapshot_id = old_snapshot_id
 +
 +
 +@pytest.mark.lxd_vm
 +def test_get_interfaces_by_mac_doesnt_traceback(ovs_enabled_session_cloud):
 +    """Launch our OVS-enabled image and confirm the bug doesn't reproduce."""
 +    launch_kwargs = {
 +        "config_dict": {
 +            "user.network-config": NETWORK_CONFIG,
 +            "volatile.eth0.hwaddr": MAC_ADDRESS,
 +        },
 +    }
 +    with ovs_enabled_session_cloud.launch(
 +        launch_kwargs=launch_kwargs,
 +    ) as client:
 +        result = client.execute(
 +            "python3 -c"
 +            "'from cloudinit.net import get_interfaces_by_mac;"
 +            "get_interfaces_by_mac()'"
 +        )
 +        assert result.ok
 diff --git a/tests/unittests/test_datasource/test_configdrive.py b/tests/unittests/test_datasource/test_configdrive.py
 index 6f830cc6..2e2b7847 100644
 --- a/tests/unittests/test_datasource/test_configdrive.py
 +++ b/tests/unittests/test_datasource/test_configdrive.py
@@ -494,6 +494,10 @@ class TestConfigDriveDataSource(CiTestCase):
         self.assertEqual('config-disk (/dev/anything)', cfg_ds.subplatform)
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestNetJson(CiTestCase):
     def setUp(self):
         super(TestNetJson, self).setUp()
@@ -654,6 +658,10 @@ class TestNetJson(CiTestCase):
             self.assertEqual(out_data, conv_data)
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestConvertNetworkData(CiTestCase):
     with_logs = True
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index c67b5fcc..14d3462f 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -2908,6 +2908,10 @@ iface eth1 inet dhcp
         self.assertEqual(0, mock_settle.call_count)
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestRhelSysConfigRendering(CiTestCase):
     with_logs = True
@@ -3592,6 +3596,10 @@ USERCTL=no
                 expected, self._render_and_read(network_config=v2data))
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestOpenSuseSysConfigRendering(CiTestCase):
     with_logs = True
@@ -5009,6 +5017,10 @@ class TestNetRenderers(CiTestCase):
             self.assertTrue(result)
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestGetInterfaces(CiTestCase):
     _data = {'bonds': ['bond1'],
              'bridges': ['bridge1'],
@@ -5158,6 +5170,10 @@ class TestInterfaceHasOwnMac(CiTestCase):
         self.assertFalse(interface_has_own_mac("eth0"))
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestGetInterfacesByMac(CiTestCase):
     _data = {'bonds': ['bond1'],
              'bridges': ['bridge1'],
@@ -5314,6 +5330,10 @@ class TestInterfacesSorting(CiTestCase):
             ['enp0s3', 'enp0s8', 'enp0s13', 'enp1s2', 'enp2s0', 'enp2s3'])
 +@mock.patch(
 +    "cloudinit.net.is_openvswitch_internal_interface",
 +    mock.Mock(return_value=False)
 +)
 class TestGetIBHwaddrsByInterface(CiTestCase):
     _ib_addr = '80:00:00:28:fe:80:00:00:00:00:00:00:00:11:22:03:00:33:44:56'
 -- 
 2.27.0
--- a/SOURCES/0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
+++ b/SOURCES/0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
@ -1,87 +0,0 @@
 From bec5fb60ffae3d1137c7261e5571c2751c5dda25 Mon Sep 17 00:00:00 2001
 From: James Falcon <TheRealFalcon@users.noreply.github.com>
 Date: Mon, 8 Mar 2021 14:09:47 -0600
 Subject: Fix requiring device-number on EC2 derivatives (#836)
 #342 (70dbccbb) introduced the ability to determine route-metrics based on
 the `device-number` provided by the EC2 IMDS. Not all datasources that
 subclass EC2 will have this attribute, so allow the old behavior if
 `device-number` is not present.
 LP: #1917875
 ---
 cloudinit/sources/DataSourceEc2.py            |  3 +-
 .../unittests/test_datasource/test_aliyun.py  | 30 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 diff --git a/cloudinit/sources/DataSourceEc2.py b/cloudinit/sources/DataSourceEc2.py
 index 1930a509..a2105dc7 100644
 --- a/cloudinit/sources/DataSourceEc2.py
 +++ b/cloudinit/sources/DataSourceEc2.py
@@ -765,13 +765,14 @@ def convert_ec2_metadata_network_config(
         netcfg['ethernets'][nic_name] = dev_config
         return netcfg
     # Apply network config for all nics and any secondary IPv4/v6 addresses
 +    nic_idx = 0
     for mac, nic_name in sorted(macs_to_nics.items()):
         nic_metadata = macs_metadata.get(mac)
         if not nic_metadata:
             continue  # Not a physical nic represented in metadata
         # device-number is zero-indexed, we want it 1-indexed for the
         # multiplication on the following line
 -        nic_idx = int(nic_metadata['device-number']) + 1
 +        nic_idx = int(nic_metadata.get('device-number', nic_idx)) + 1
         dhcp_override = {'route-metric': nic_idx * 100}
         dev_config = {'dhcp4': True, 'dhcp4-overrides': dhcp_override,
                       'dhcp6': False,
 diff --git a/tests/unittests/test_datasource/test_aliyun.py b/tests/unittests/test_datasource/test_aliyun.py
 index eb2828d5..cab1ac2b 100644
 --- a/tests/unittests/test_datasource/test_aliyun.py
 +++ b/tests/unittests/test_datasource/test_aliyun.py
@@ -7,6 +7,7 @@ from unittest import mock
 from cloudinit import helpers
 from cloudinit.sources import DataSourceAliYun as ay
 +from cloudinit.sources.DataSourceEc2 import convert_ec2_metadata_network_config
 from cloudinit.tests import helpers as test_helpers
 DEFAULT_METADATA = {
@@ -183,6 +184,35 @@ class TestAliYunDatasource(test_helpers.HttprettyTestCase):
         self.assertEqual(ay.parse_public_keys(public_keys),
                          public_keys['key-pair-0']['openssh-key'])
 +    def test_route_metric_calculated_without_device_number(self):
 +        """Test that route-metric code works without `device-number`
 +
 +        `device-number` is part of EC2 metadata, but not supported on aliyun.
 +        Attempting to access it will raise a KeyError.
 +
 +        LP: #1917875
 +        """
 +        netcfg = convert_ec2_metadata_network_config(
 +            {"interfaces": {"macs": {
 +                "06:17:04:d7:26:09": {
 +                    "interface-id": "eni-e44ef49e",
 +                },
 +                "06:17:04:d7:26:08": {
 +                    "interface-id": "eni-e44ef49f",
 +                }
 +            }}},
 +            macs_to_nics={
 +                '06:17:04:d7:26:09': 'eth0',
 +                '06:17:04:d7:26:08': 'eth1',
 +            }
 +        )
 +
 +        met0 = netcfg['ethernets']['eth0']['dhcp4-overrides']['route-metric']
 +        met1 = netcfg['ethernets']['eth1']['dhcp4-overrides']['route-metric']
 +
 +        # route-metric numbers should be 100 apart
 +        assert 100 == abs(met0 - met1)
 +
 class TestIsAliYun(test_helpers.CiTestCase):
     ALIYUN_PRODUCT = 'Alibaba Cloud ECS'
 -- 
 2.27.0
--- a/SOURCES/ci-Add-native-NetworkManager-support-1224.patch
+++ b/SOURCES/ci-Add-native-NetworkManager-support-1224.patch
--- a/SOURCES/ci-Align-rhel-custom-files-with-upstream-1431.patch
+++ b/SOURCES/ci-Align-rhel-custom-files-with-upstream-1431.patch
@ -0,0 +1,257 @@
 From 5c99ba05086b1ec83ce7e0c64edb4add4b47d923 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 19 May 2022 11:14:39 +0200
 Subject: [PATCH 3/4] Align rhel custom files with upstream (#1431)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 65: Align rhel custom files with upstream (#1431)
 RH-Commit: [1/2] 5d9067175688b1006472a477b0916b81c73d5e07
 RH-Bugzilla: 2082071
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 commit 9624758f91b61f4711e8d7b5c83075b5d23e0c43
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Wed May 18 15:18:04 2022 +0200
    Align rhel custom files with upstream (#1431)
    So far RHEL had its own custom .service and cloud.cfg files,
    that diverged from upstream. We always replaced the generated files
    with the ones we had.
    This caused only confusion and made it harder to rebase and backport
    patches targeting these files.
    At the same time, we are going to delete our custom downstream-only files
    and use the ones generated by .tmpl.
    The mapping is:
    config/cloud.cfg.tmpl -> rhel/cloud.cfg
    systemd/* -> rhel/systemd/*
    Such rhel-specific files are open and available in the Centos repo:
    https://gitlab.com/redhat/centos-stream/src/cloud-init
    With this commit, we are also introducing modules in cloud.cfg that
    were not in the default rhel cfg file, even though they should already
    have been there with previous rebases and releases.
    Anyways such modules support rhel as distro, and
    therefore should cause no harm.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    RHBZ: 2082071
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 config/cloud.cfg.tmpl                   | 23 +++++++++++++++++++++++
 systemd/cloud-config.service.tmpl       |  4 ++++
 systemd/cloud-final.service.tmpl        | 13 +++++++++++++
 systemd/cloud-init-local.service.tmpl   | 22 +++++++++++++++++++++-
 systemd/cloud-init.service.tmpl         |  6 +++++-
 tests/unittests/test_render_cloudcfg.py |  1 +
 6 files changed, 67 insertions(+), 2 deletions(-)
 diff --git a/config/cloud.cfg.tmpl b/config/cloud.cfg.tmpl
 index 86beee3c..f4d2fd14 100644
 --- a/config/cloud.cfg.tmpl
 +++ b/config/cloud.cfg.tmpl
@@ -34,7 +34,11 @@ disable_root: true
 {% if variant in ["almalinux", "alpine", "amazon", "centos", "cloudlinux", "eurolinux",
                   "fedora", "miraclelinux", "openEuler", "rhel", "rocky", "virtuozzo"] %}
 +{% if variant == "rhel" %}
 +mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service,_netdev', '0', '2']
 +{% else %}
 mount_default_fields: [~, ~, 'auto', 'defaults,nofail', '0', '2']
 +{% endif %}
 {% if variant == "amazon" %}
 resize_rootfs: noblock
 {% endif %}
@@ -66,6 +70,14 @@ network:
   config: disabled
 {% endif %}
 +{% if variant == "rhel" %}
 +# Default redhat settings:
 +ssh_deletekeys:   true
 +ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
 +syslog_fix_perms: ~
 +disable_vmware_customization: false
 +{% endif %}
 +
 # The modules that run in the 'init' stage
 cloud_init_modules:
  - migrator
@@ -107,10 +119,15 @@ cloud_config_modules:
 {% endif %}
 {% if variant not in ["photon"] %}
  - ssh-import-id
 +{% if variant not in ["rhel"] %}
  - keyboard
 +{% endif %}
  - locale
 {% endif %}
  - set-passwords
 +{% if variant in ["rhel"] %}
 + - rh_subscription
 +{% endif %}
 {% if variant in ["rhel", "fedora", "photon"] %}
 {% if variant not in ["photon"] %}
  - spacewalk
@@ -239,6 +256,10 @@ system_info:
      name: ec2-user
      lock_passwd: True
      gecos: EC2 Default User
 +{% elif variant == "rhel" %}
 +     name: cloud-user
 +     lock_passwd: true
 +     gecos: Cloud User
 {% else %}
      name: {{ variant }}
      lock_passwd: True
@@ -254,6 +275,8 @@ system_info:
      groups: [adm, sudo]
 {% elif variant == "arch" %}
      groups: [wheel, users]
 +{% elif variant == "rhel" %}
 +     groups: [adm, systemd-journal]
 {% else %}
      groups: [wheel, adm, systemd-journal]
 {% endif %}
 diff --git a/systemd/cloud-config.service.tmpl b/systemd/cloud-config.service.tmpl
 index 9d928ca2..d5568a6e 100644
 --- a/systemd/cloud-config.service.tmpl
 +++ b/systemd/cloud-config.service.tmpl
@@ -4,6 +4,10 @@ Description=Apply the settings specified in cloud-config
 After=network-online.target cloud-config.target
 After=snapd.seeded.service
 Wants=network-online.target cloud-config.target
 +{% if variant == "rhel" %}
 +ConditionPathExists=!/etc/cloud/cloud-init.disabled
 +ConditionKernelCommandLine=!cloud-init=disabled
 +{% endif %}
 [Service]
 Type=oneshot
 diff --git a/systemd/cloud-final.service.tmpl b/systemd/cloud-final.service.tmpl
 index 8207b18c..85f423ac 100644
 --- a/systemd/cloud-final.service.tmpl
 +++ b/systemd/cloud-final.service.tmpl
@@ -7,6 +7,10 @@ After=multi-user.target
 Before=apt-daily.service
 {% endif %}
 Wants=network-online.target cloud-config.service
 +{% if variant == "rhel" %}
 +ConditionPathExists=!/etc/cloud/cloud-init.disabled
 +ConditionKernelCommandLine=!cloud-init=disabled
 +{% endif %}
 [Service]
@@ -15,7 +19,16 @@ ExecStart=/usr/bin/cloud-init modules --mode=final
 RemainAfterExit=yes
 TimeoutSec=0
 KillMode=process
 +{% if variant == "rhel" %}
 +# Restart NetworkManager if it is present and running.
 +ExecStartPost=/bin/sh -c 'u=NetworkManager.service; \
 + out=$(systemctl show --property=SubState $u) || exit; \
 + [ "$out" = "SubState=running" ] || exit 0; \
 + systemctl reload-or-try-restart $u'
 +{% else %}
 TasksMax=infinity
 +{% endif %}
 +
 # Output needs to appear in instance console output
 StandardOutput=journal+console
 diff --git a/systemd/cloud-init-local.service.tmpl b/systemd/cloud-init-local.service.tmpl
 index 7166f640..a6b82650 100644
 --- a/systemd/cloud-init-local.service.tmpl
 +++ b/systemd/cloud-init-local.service.tmpl
@@ -1,23 +1,43 @@
 ## template:jinja
 [Unit]
 Description=Initial cloud-init job (pre-networking)
 -{% if variant in ["ubuntu", "unknown", "debian"] %}
 +{% if variant in ["ubuntu", "unknown", "debian", "rhel" ] %}
 DefaultDependencies=no
 {% endif %}
 Wants=network-pre.target
 After=hv_kvp_daemon.service
 After=systemd-remount-fs.service
 +{% if variant == "rhel" %}
 +Requires=dbus.socket
 +After=dbus.socket
 +{% endif %}
 Before=NetworkManager.service
 +{% if variant == "rhel" %}
 +Before=network.service
 +{% endif %}
 Before=network-pre.target
 Before=shutdown.target
 +{% if variant == "rhel" %}
 +Before=firewalld.target
 +Conflicts=shutdown.target
 +{% endif %}
 {% if variant in ["ubuntu", "unknown", "debian"] %}
 Before=sysinit.target
 Conflicts=shutdown.target
 {% endif %}
 RequiresMountsFor=/var/lib/cloud
 +{% if variant == "rhel" %}
 +ConditionPathExists=!/etc/cloud/cloud-init.disabled
 +ConditionKernelCommandLine=!cloud-init=disabled
 +{% endif %}
 [Service]
 Type=oneshot
 +{% if variant == "rhel" %}
 +ExecStartPre=/bin/mkdir -p /run/cloud-init
 +ExecStartPre=/sbin/restorecon /run/cloud-init
 +ExecStartPre=/usr/bin/touch /run/cloud-init/enabled
 +{% endif %}
 ExecStart=/usr/bin/cloud-init init --local
 ExecStart=/bin/touch /run/cloud-init/network-config-ready
 RemainAfterExit=yes
 diff --git a/systemd/cloud-init.service.tmpl b/systemd/cloud-init.service.tmpl
 index e71e5679..c170aef7 100644
 --- a/systemd/cloud-init.service.tmpl
 +++ b/systemd/cloud-init.service.tmpl
@@ -1,7 +1,7 @@
 ## template:jinja
 [Unit]
 Description=Initial cloud-init job (metadata service crawler)
 -{% if variant not in ["photon"] %}
 +{% if variant not in ["photon", "rhel"] %}
 DefaultDependencies=no
 {% endif %}
 Wants=cloud-init-local.service
@@ -36,6 +36,10 @@ Before=shutdown.target
 Conflicts=shutdown.target
 {% endif %}
 Before=systemd-user-sessions.service
 +{% if variant == "rhel" %}
 +ConditionPathExists=!/etc/cloud/cloud-init.disabled
 +ConditionKernelCommandLine=!cloud-init=disabled
 +{% endif %}
 [Service]
 Type=oneshot
 diff --git a/tests/unittests/test_render_cloudcfg.py b/tests/unittests/test_render_cloudcfg.py
 index 30fbd1a4..9f95d448 100644
 --- a/tests/unittests/test_render_cloudcfg.py
 +++ b/tests/unittests/test_render_cloudcfg.py
@@ -68,6 +68,7 @@ class TestRenderCloudCfg:
         default_user_exceptions = {
             "amazon": "ec2-user",
             "debian": "ubuntu",
 +            "rhel": "cloud-user",
             "unknown": "ubuntu",
         }
         default_user = system_cfg["system_info"]["default_user"]["name"]
 -- 
 2.35.3
--- a/SOURCES/ci-Change-netifaces-dependency-to-0.10.4-965.patch
+++ b/SOURCES/ci-Change-netifaces-dependency-to-0.10.4-965.patch
@ -1,47 +0,0 @@
 From 67d62f2c0df1fcb5cd86be73cba6064075aa61e3 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Fri, 14 Jan 2022 16:39:46 +0100
 Subject: [PATCH 3/6] Change netifaces dependency to 0.10.4 (#965)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 43: Datasource for VMware
 RH-Commit: [3/6] 81f0638e62841bab09b423d9cb5d340026ee87c2
 RH-Bugzilla: 2040704
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit b9d308b4d61d22bacc05bcae59819755975631f8
 Author: Andrew Kutz <101085+akutz@users.noreply.github.com>
 Date:   Tue Aug 10 15:10:44 2021 -0500
    Change netifaces dependency to 0.10.4 (#965)
    Change netifaces dependency to 0.10.4
    Currently versions Ubuntu <=20.10 use netifaces 0.10.4 By requiring
    netifaces 0.10.9, the VMware datasource omitted itself from cloud-init
    on Ubuntu <=20.10.
    This patch changes the netifaces dependency to 0.10.4. While it is true
    there are patches to netifaces post 0.10.4 that are desirable, testing
    against the most common network configuration was performed to verify
    the VMware datasource will still function with netifaces 0.10.4.
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/requirements.txt b/requirements.txt
 index 41d01d62..c4adc455 100644
 --- a/requirements.txt
 +++ b/requirements.txt
@@ -40,4 +40,4 @@ jsonschema
 # and still participate in instance-data by gathering the network in detail at
 # runtime and merge that information into the metadata and repersist that to
 # disk.
 -netifaces>=0.10.9
 +netifaces>=0.10.4
 -- 
 2.27.0
--- a/SOURCES/ci-Datasource-for-VMware-953.patch
+++ b/SOURCES/ci-Datasource-for-VMware-953.patch
--- a/SOURCES/ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch
+++ b/SOURCES/ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch
@ -1,484 +0,0 @@
 From e38ff212eb35943961b79f0d30cdceffc1bc0905 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Wed, 2 Mar 2022 10:18:02 +0100
 Subject: [PATCH] Fix IPv6 netmask format for sysconfig (#1215)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 49: Fix IPv6 netmask format for sysconfig (#1215)
 RH-Commit: [1/1] 7a97580791fc03f6ae878a699cf92f620f58a237
 RH-Bugzilla: 2060026
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 commit b97a30f0a05c1dea918c46ca9c05c869d15fe2d5
 Author: Harald <hjensas@redhat.com>
 Date:   Tue Feb 8 15:49:00 2022 +0100
    Fix IPv6 netmask format for sysconfig (#1215)
    This change converts the IPv6 netmask from the network_data.json[1]
    format to the CIDR style, <IPv6_addr>/<prefix>.
    Using an IPv6 address like ffff:ffff:ffff:ffff:: does not work with
    NetworkManager, nor networkscripts.
    NetworkManager will ignore the route, logging:
      ifcfg-rh: ignoring invalid route at \
        "::/:: via fd00:fd00:fd00:2::fffe dev $DEV" \
        (/etc/sysconfig/network-scripts/route6-$DEV:3): \
        Argument for "::/::" is not ADDR/PREFIX format
    Similarly if using networkscripts, ip route fail with error:
      Error: inet6 prefix is expected rather than \
        "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::".
    Also a bit of refactoring ...
    cloudinit.net.sysconfig.Route.to_string:
    * Move a couple of lines around to reduce repeated code.
    * if "ADDRESS" not in key -> continute, so that the
      code block following it can be de-indented.
    cloudinit.net.network_state:
    * Refactors the ipv4_mask_to_net_prefix, ipv6_mask_to_net_prefix
      removes mask_to_net_prefix methods. Utilize ipaddress library to
      do some of the heavy lifting.
    LP: #1959148
 Conflicts (most related to different format style):
        cloudinit/net/__init__.py
        cloudinit/net/network_state.py
        cloudinit/net/sysconfig.py
        cloudinit/sources/DataSourceOpenNebula.py
        cloudinit/sources/helpers/vmware/imc/config_nic.py
        tests/unittests/net/test_init.py (file not backported)
        tests/unittests/net/test_network_state.py (file not backported)
        tests/unittests/test_net.py
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/net/__init__.py                     |   7 +-
 cloudinit/net/network_state.py                | 103 +++++++-----------
 cloudinit/net/sysconfig.py                    |  91 ++++++++++------
 cloudinit/sources/DataSourceOpenNebula.py     |   2 +-
 .../sources/helpers/vmware/imc/config_nic.py  |   4 +-
 tests/unittests/test_net.py                   |  78 ++++++++++++-
 6 files changed, 176 insertions(+), 109 deletions(-)
 diff --git a/cloudinit/net/__init__.py b/cloudinit/net/__init__.py
 index 003efa2a..12bf64de 100644
 --- a/cloudinit/net/__init__.py
 +++ b/cloudinit/net/__init__.py
@@ -14,7 +14,7 @@ import re
 from cloudinit import subp
 from cloudinit import util
 -from cloudinit.net.network_state import mask_to_net_prefix
 +from cloudinit.net.network_state import ipv4_mask_to_net_prefix
 from cloudinit.url_helper import UrlError, readurl
 LOG = logging.getLogger(__name__)
@@ -1048,10 +1048,11 @@ class EphemeralIPv4Network(object):
                 'Cannot init network on {0} with {1}/{2} and bcast {3}'.format(
                     interface, ip, prefix_or_mask, broadcast))
         try:
 -            self.prefix = mask_to_net_prefix(prefix_or_mask)
 +            self.prefix = ipv4_mask_to_net_prefix(prefix_or_mask)
         except ValueError as e:
             raise ValueError(
 -                'Cannot setup network: {0}'.format(e)
 +                "Cannot setup network, invalid prefix or "
 +                "netmask: {0}".format(e)
             ) from e
         self.connectivity_url = connectivity_url
 diff --git a/cloudinit/net/network_state.py b/cloudinit/net/network_state.py
 index e8bf9e39..2768ef94 100644
 --- a/cloudinit/net/network_state.py
 +++ b/cloudinit/net/network_state.py
@@ -6,6 +6,7 @@
 import copy
 import functools
 +import ipaddress
 import logging
 import socket
 import struct
@@ -872,12 +873,18 @@ def _normalize_net_keys(network, address_keys=()):
         try:
             prefix = int(maybe_prefix)
         except ValueError:
 -            # this supports input of <address>/255.255.255.0
 -            prefix = mask_to_net_prefix(maybe_prefix)
 -    elif netmask:
 -        prefix = mask_to_net_prefix(netmask)
 -    elif 'prefix' in net:
 -        prefix = int(net['prefix'])
 +            if ipv6:
 +                # this supports input of ffff:ffff:ffff::
 +                prefix = ipv6_mask_to_net_prefix(maybe_prefix)
 +            else:
 +                # this supports input of 255.255.255.0
 +                prefix = ipv4_mask_to_net_prefix(maybe_prefix)
 +    elif netmask and not ipv6:
 +        prefix = ipv4_mask_to_net_prefix(netmask)
 +    elif netmask and ipv6:
 +        prefix = ipv6_mask_to_net_prefix(netmask)
 +    elif "prefix" in net:
 +        prefix = int(net["prefix"])
     else:
         prefix = 64 if ipv6 else 24
@@ -972,72 +979,42 @@ def ipv4_mask_to_net_prefix(mask):
        str(24)         => 24
        "24"            => 24
     """
 -    if isinstance(mask, int):
 -        return mask
 -    if isinstance(mask, str):
 -        try:
 -            return int(mask)
 -        except ValueError:
 -            pass
 -    else:
 -        raise TypeError("mask '%s' is not a string or int")
 -
 -    if '.' not in mask:
 -        raise ValueError("netmask '%s' does not contain a '.'" % mask)
 -
 -    toks = mask.split(".")
 -    if len(toks) != 4:
 -        raise ValueError("netmask '%s' had only %d parts" % (mask, len(toks)))
 -
 -    return sum([bin(int(x)).count('1') for x in toks])
 +    return ipaddress.ip_network(f"0.0.0.0/{mask}").prefixlen
 def ipv6_mask_to_net_prefix(mask):
     """Convert an ipv6 netmask (very uncommon) or prefix (64) to prefix.
 -    If 'mask' is an integer or string representation of one then
 -    int(mask) will be returned.
 +    If the input is already an integer or a string representation of
 +    an integer, then int(mask) will be returned.
 +       "ffff:ffff:ffff::"  => 48
 +       "48"                => 48
     """
 -
 -    if isinstance(mask, int):
 -        return mask
 -    if isinstance(mask, str):
 -        try:
 -            return int(mask)
 -        except ValueError:
 -            pass
 -    else:
 -        raise TypeError("mask '%s' is not a string or int")
 -
 -    if ':' not in mask:
 -        raise ValueError("mask '%s' does not have a ':'")
 -
 -    bitCount = [0, 0x8000, 0xc000, 0xe000, 0xf000, 0xf800, 0xfc00, 0xfe00,
 -                0xff00, 0xff80, 0xffc0, 0xffe0, 0xfff0, 0xfff8, 0xfffc,
 -                0xfffe, 0xffff]
 -    prefix = 0
 -    for word in mask.split(':'):
 -        if not word or int(word, 16) == 0:
 -            break
 -        prefix += bitCount.index(int(word, 16))
 -
 -    return prefix
 -
 -
 -def mask_to_net_prefix(mask):
 -    """Return the network prefix for the netmask provided.
 -
 -    Supports ipv4 or ipv6 netmasks."""
     try:
 -        # if 'mask' is a prefix that is an integer.
 -        # then just return it.
 -        return int(mask)
 +        # In the case the mask is already a prefix
 +        prefixlen = ipaddress.ip_network(f"::/{mask}").prefixlen
 +        return prefixlen
     except ValueError:
 +        # ValueError means mask is an IPv6 address representation and need
 +        # conversion.
         pass
 -    if is_ipv6_addr(mask):
 -        return ipv6_mask_to_net_prefix(mask)
 -    else:
 -        return ipv4_mask_to_net_prefix(mask)
 +
 +    netmask = ipaddress.ip_address(mask)
 +    mask_int = int(netmask)
 +    # If the mask is all zeroes, just return it
 +    if mask_int == 0:
 +        return mask_int
 +
 +    trailing_zeroes = min(
 +        ipaddress.IPV6LENGTH, (~mask_int & (mask_int - 1)).bit_length()
 +    )
 +    leading_ones = mask_int >> trailing_zeroes
 +    prefixlen = ipaddress.IPV6LENGTH - trailing_zeroes
 +    all_ones = (1 << prefixlen) - 1
 +    if leading_ones != all_ones:
 +        raise ValueError("Invalid network mask '%s'" % mask)
 +
 +    return prefixlen
 def mask_and_ipv4_to_bcast_addr(mask, ip):
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
 index d5440998..7ecbe1c3 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
@@ -12,6 +12,7 @@ from cloudinit import util
 from cloudinit import subp
 from cloudinit.distros.parsers import networkmanager_conf
 from cloudinit.distros.parsers import resolv_conf
 +from cloudinit.net import network_state
 from . import renderer
 from .network_state import (
@@ -171,43 +172,61 @@ class Route(ConfigMap):
         # (because Route can contain a mix of IPv4 and IPv6)
         reindex = -1
         for key in sorted(self._conf.keys()):
 -            if 'ADDRESS' in key:
 -                index = key.replace('ADDRESS', '')
 -                address_value = str(self._conf[key])
 -                # only accept combinations:
 -                # if proto ipv6 only display ipv6 routes
 -                # if proto ipv4 only display ipv4 routes
 -                # do not add ipv6 routes if proto is ipv4
 -                # do not add ipv4 routes if proto is ipv6
 -                # (this array will contain a mix of ipv4 and ipv6)
 -                if proto == "ipv4" and not self.is_ipv6_route(address_value):
 -                    netmask_value = str(self._conf['NETMASK' + index])
 -                    gateway_value = str(self._conf['GATEWAY' + index])
 -                    # increase IPv4 index
 -                    reindex = reindex + 1
 -                    buf.write("%s=%s\n" % ('ADDRESS' + str(reindex),
 -                                           _quote_value(address_value)))
 -                    buf.write("%s=%s\n" % ('GATEWAY' + str(reindex),
 -                                           _quote_value(gateway_value)))
 -                    buf.write("%s=%s\n" % ('NETMASK' + str(reindex),
 -                                           _quote_value(netmask_value)))
 -                    metric_key = 'METRIC' + index
 -                    if metric_key in self._conf:
 -                        metric_value = str(self._conf['METRIC' + index])
 -                        buf.write("%s=%s\n" % ('METRIC' + str(reindex),
 -                                               _quote_value(metric_value)))
 -                elif proto == "ipv6" and self.is_ipv6_route(address_value):
 -                    netmask_value = str(self._conf['NETMASK' + index])
 -                    gateway_value = str(self._conf['GATEWAY' + index])
 -                    metric_value = (
 -                        'metric ' + str(self._conf['METRIC' + index])
 -                        if 'METRIC' + index in self._conf else '')
 +            if "ADDRESS" not in key:
 +                continue
 +
 +            index = key.replace("ADDRESS", "")
 +            address_value = str(self._conf[key])
 +            netmask_value = str(self._conf["NETMASK" + index])
 +            gateway_value = str(self._conf["GATEWAY" + index])
 +
 +            # only accept combinations:
 +            # if proto ipv6 only display ipv6 routes
 +            # if proto ipv4 only display ipv4 routes
 +            # do not add ipv6 routes if proto is ipv4
 +            # do not add ipv4 routes if proto is ipv6
 +            # (this array will contain a mix of ipv4 and ipv6)
 +            if proto == "ipv4" and not self.is_ipv6_route(address_value):
 +                # increase IPv4 index
 +                reindex = reindex + 1
 +                buf.write(
 +                    "%s=%s\n"
 +                    % ("ADDRESS" + str(reindex), _quote_value(address_value))
 +                )
 +                buf.write(
 +                    "%s=%s\n"
 +                    % ("GATEWAY" + str(reindex), _quote_value(gateway_value))
 +                )
 +                buf.write(
 +                    "%s=%s\n"
 +                    % ("NETMASK" + str(reindex), _quote_value(netmask_value))
 +                )
 +                metric_key = "METRIC" + index
 +                if metric_key in self._conf:
 +                    metric_value = str(self._conf["METRIC" + index])
                     buf.write(
 -                        "%s/%s via %s %s dev %s\n" % (address_value,
 -                                                      netmask_value,
 -                                                      gateway_value,
 -                                                      metric_value,
 -                                                      self._route_name))
 +                        "%s=%s\n"
 +                        % ("METRIC" + str(reindex), _quote_value(metric_value))
 +                    )
 +            elif proto == "ipv6" and self.is_ipv6_route(address_value):
 +                prefix_value = network_state.ipv6_mask_to_net_prefix(
 +                    netmask_value
 +                )
 +                metric_value = (
 +                    "metric " + str(self._conf["METRIC" + index])
 +                    if "METRIC" + index in self._conf
 +                    else ""
 +                )
 +                buf.write(
 +                    "%s/%s via %s %s dev %s\n"
 +                    % (
 +                        address_value,
 +                        prefix_value,
 +                        gateway_value,
 +                        metric_value,
 +                        self._route_name,
 +                    )
 +                )
         return buf.getvalue()
 diff --git a/cloudinit/sources/DataSourceOpenNebula.py b/cloudinit/sources/DataSourceOpenNebula.py
 index 730ec586..e7980ab1 100644
 --- a/cloudinit/sources/DataSourceOpenNebula.py
 +++ b/cloudinit/sources/DataSourceOpenNebula.py
@@ -233,7 +233,7 @@ class OpenNebulaNetwork(object):
             # Set IPv4 address
             devconf['addresses'] = []
             mask = self.get_mask(c_dev)
 -            prefix = str(net.mask_to_net_prefix(mask))
 +            prefix = str(net.ipv4_mask_to_net_prefix(mask))
             devconf['addresses'].append(
                 self.get_ip(c_dev, mac) + '/' + prefix)
 diff --git a/cloudinit/sources/helpers/vmware/imc/config_nic.py b/cloudinit/sources/helpers/vmware/imc/config_nic.py
 index 9cd2c0c0..3a45c67e 100644
 --- a/cloudinit/sources/helpers/vmware/imc/config_nic.py
 +++ b/cloudinit/sources/helpers/vmware/imc/config_nic.py
@@ -9,7 +9,7 @@ import logging
 import os
 import re
 -from cloudinit.net.network_state import mask_to_net_prefix
 +from cloudinit.net.network_state import ipv4_mask_to_net_prefix
 from cloudinit import subp
 from cloudinit import util
@@ -180,7 +180,7 @@ class NicConfigurator(object):
         """
         route_list = []
 -        cidr = mask_to_net_prefix(netmask)
 +        cidr = ipv4_mask_to_net_prefix(netmask)
         for gateway in gateways:
             destination = "%s/%d" % (gen_subnet(gateway, netmask), cidr)
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index 14d3462f..a7f6a1f7 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -2025,10 +2025,10 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                     routes:
                         - gateway: 2001:67c:1562:1
                           network: 2001:67c:1
 -                          netmask: ffff:ffff:0
 +                          netmask: "ffff:ffff::"
                         - gateway: 3001:67c:1562:1
                           network: 3001:67c:1
 -                          netmask: ffff:ffff:0
 +                          netmask: "ffff:ffff::"
                           metric: 10000
             """),
         'expected_netplan': textwrap.dedent("""
@@ -2295,8 +2295,8 @@ iface bond0 inet6 static
             'route6-bond0': textwrap.dedent("""\
         # Created by cloud-init on instance boot automatically, do not edit.
         #
 -        2001:67c:1/ffff:ffff:0 via 2001:67c:1562:1  dev bond0
 -        3001:67c:1/ffff:ffff:0 via 3001:67c:1562:1 metric 10000 dev bond0
 +        2001:67c:1/32 via 2001:67c:1562:1  dev bond0
 +        3001:67c:1/32 via 3001:67c:1562:1 metric 10000 dev bond0
             """),
             'route-bond0': textwrap.dedent("""\
         ADDRESS0=10.1.3.0
@@ -3088,6 +3088,76 @@ USERCTL=no
             renderer.render_network_state(ns, target=render_dir)
         self.assertEqual([], os.listdir(render_dir))
 +    def test_invalid_network_mask_ipv6(self):
 +        net_json = {
 +            "services": [{"type": "dns", "address": "172.19.0.12"}],
 +            "networks": [
 +                {
 +                    "network_id": "public-ipv6",
 +                    "type": "ipv6",
 +                    "netmask": "",
 +                    "link": "tap1a81968a-79",
 +                    "routes": [
 +                        {
 +                            "gateway": "2001:DB8::1",
 +                            "netmask": "ff:ff:ff:ff::",
 +                            "network": "2001:DB8:1::1",
 +                        },
 +                    ],
 +                    "ip_address": "2001:DB8::10",
 +                    "id": "network1",
 +                }
 +            ],
 +            "links": [
 +                {
 +                    "ethernet_mac_address": "fa:16:3e:ed:9a:59",
 +                    "mtu": None,
 +                    "type": "bridge",
 +                    "id": "tap1a81968a-79",
 +                    "vif_id": "1a81968a-797a-400f-8a80-567f997eb93f",
 +                },
 +            ],
 +        }
 +        macs = {"fa:16:3e:ed:9a:59": "eth0"}
 +        network_cfg = openstack.convert_net_json(net_json, known_macs=macs)
 +        with self.assertRaises(ValueError):
 +            network_state.parse_net_config_data(network_cfg, skip_broken=False)
 +
 +    def test_invalid_network_mask_ipv4(self):
 +        net_json = {
 +            "services": [{"type": "dns", "address": "172.19.0.12"}],
 +            "networks": [
 +                {
 +                    "network_id": "public-ipv4",
 +                    "type": "ipv4",
 +                    "netmask": "",
 +                    "link": "tap1a81968a-79",
 +                    "routes": [
 +                        {
 +                            "gateway": "172.20.0.1",
 +                            "netmask": "255.234.255.0",
 +                            "network": "172.19.0.0",
 +                        },
 +                    ],
 +                    "ip_address": "172.20.0.10",
 +                    "id": "network1",
 +                }
 +            ],
 +            "links": [
 +                {
 +                    "ethernet_mac_address": "fa:16:3e:ed:9a:59",
 +                    "mtu": None,
 +                    "type": "bridge",
 +                    "id": "tap1a81968a-79",
 +                    "vif_id": "1a81968a-797a-400f-8a80-567f997eb93f",
 +                },
 +            ],
 +        }
 +        macs = {"fa:16:3e:ed:9a:59": "eth0"}
 +        network_cfg = openstack.convert_net_json(net_json, known_macs=macs)
 +        with self.assertRaises(ValueError):
 +            network_state.parse_net_config_data(network_cfg, skip_broken=False)
 +
     def test_openstack_rendering_samples(self):
         for os_sample in OS_SAMPLES:
             render_dir = self.tmp_dir()
 -- 
 2.27.0
--- a/SOURCES/ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
+++ b/SOURCES/ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
@ -1,262 +0,0 @@
 From 71989367e7a634fdd2af8ef58473975e0ef60464 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Sat, 21 Aug 2021 13:53:27 +0200
 Subject: [PATCH] Fix home permissions modified by ssh module (SC-338) (#984)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 29: Fix home permissions modified by ssh module (SC-338) (#984)
 RH-Commit: [1/1] c409f2609b1d7e024eba77b55a196a4cafadd1d7 (eesposit/cloud-init)
 RH-Bugzilla: 1995840
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 TESTED: By me and QA
 BREW: 39178090
 Fix home permissions modified by ssh module (SC-338) (#984)
 commit 7d3f5d750f6111c2716143364ea33486df67c927
 Author: James Falcon <therealfalcon@gmail.com>
 Date:   Fri Aug 20 17:09:49 2021 -0500
    Fix home permissions modified by ssh module (SC-338) (#984)
    Fix home permissions modified by ssh module
    In #956, we updated the file and directory permissions for keys not in
    the user's home directory. We also unintentionally modified the
    permissions within the home directory as well. These should not change,
    and this commit changes that back.
    LP: #1940233
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/ssh_util.py                         |  35 ++++-
 .../modules/test_ssh_keysfile.py              | 132 +++++++++++++++---
 2 files changed, 146 insertions(+), 21 deletions(-)
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index b8a3c8f7..9ccadf09 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -321,23 +321,48 @@ def check_create_path(username, filename, strictmodes):
         home_folder = os.path.dirname(user_pwent.pw_dir)
         for directory in directories:
             parent_folder += "/" + directory
 -            if home_folder.startswith(parent_folder):
 +
 +            # security check, disallow symlinks in the AuthorizedKeysFile path.
 +            if os.path.islink(parent_folder):
 +                LOG.debug(
 +                    "Invalid directory. Symlink exists in path: %s",
 +                    parent_folder)
 +                return False
 +
 +            if os.path.isfile(parent_folder):
 +                LOG.debug(
 +                    "Invalid directory. File exists in path: %s",
 +                    parent_folder)
 +                return False
 +
 +            if (home_folder.startswith(parent_folder) or
 +                    parent_folder == user_pwent.pw_dir):
                 continue
 -            if not os.path.isdir(parent_folder):
 +            if not os.path.exists(parent_folder):
                 # directory does not exist, and permission so far are good:
                 # create the directory, and make it accessible by everyone
                 # but owned by root, as it might be used by many users.
                 with util.SeLinuxGuard(parent_folder):
 -                    os.makedirs(parent_folder, mode=0o755, exist_ok=True)
 -                    util.chownbyid(parent_folder, root_pwent.pw_uid,
 -                                   root_pwent.pw_gid)
 +                    mode = 0o755
 +                    uid = root_pwent.pw_uid
 +                    gid = root_pwent.pw_gid
 +                    if parent_folder.startswith(user_pwent.pw_dir):
 +                        mode = 0o700
 +                        uid = user_pwent.pw_uid
 +                        gid = user_pwent.pw_gid
 +                    os.makedirs(parent_folder, mode=mode, exist_ok=True)
 +                    util.chownbyid(parent_folder, uid, gid)
             permissions = check_permissions(username, parent_folder,
                                             filename, False, strictmodes)
             if not permissions:
                 return False
 +        if os.path.islink(filename) or os.path.isdir(filename):
 +            LOG.debug("%s is not a file!", filename)
 +            return False
 +
         # check the file
         if not os.path.exists(filename):
             # if file does not exist: we need to create it, since the
 diff --git a/tests/integration_tests/modules/test_ssh_keysfile.py b/tests/integration_tests/modules/test_ssh_keysfile.py
 index f82d7649..3159feb9 100644
 --- a/tests/integration_tests/modules/test_ssh_keysfile.py
 +++ b/tests/integration_tests/modules/test_ssh_keysfile.py
@@ -10,10 +10,10 @@ TEST_USER1_KEYS = get_test_rsa_keypair('test1')
 TEST_USER2_KEYS = get_test_rsa_keypair('test2')
 TEST_DEFAULT_KEYS = get_test_rsa_keypair('test3')
 -USERDATA = """\
 +_USERDATA = """\
 #cloud-config
 bootcmd:
 - - sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile /etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' /etc/ssh/sshd_config
 + - {bootcmd}
 ssh_authorized_keys:
  - {default}
 users:
@@ -24,27 +24,17 @@ users:
 - name: test_user2
   ssh_authorized_keys:
     - {user2}
 -""".format(  # noqa: E501
 +""".format(
 +    bootcmd='{bootcmd}',
     default=TEST_DEFAULT_KEYS.public_key,
     user1=TEST_USER1_KEYS.public_key,
     user2=TEST_USER2_KEYS.public_key,
 )
 -@pytest.mark.ubuntu
 -@pytest.mark.user_data(USERDATA)
 -def test_authorized_keys(client: IntegrationInstance):
 -    expected_keys = [
 -        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 -         TEST_USER1_KEYS),
 -        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 -         TEST_USER2_KEYS),
 -        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 -         TEST_DEFAULT_KEYS),
 -        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 -    ]
 -
 +def common_verify(client, expected_keys):
     for user, filename, keys in expected_keys:
 +        # Ensure key is in the key file
         contents = client.read_from_file(filename)
         if user in ['ubuntu', 'root']:
             # Our personal public key gets added by pycloudlib
@@ -83,3 +73,113 @@ def test_authorized_keys(client: IntegrationInstance):
                     look_for_keys=False,
                     allow_agent=False,
                 )
 +
 +        # Ensure we haven't messed with any /home permissions
 +        # See LP: #1940233
 +        home_dir = '/home/{}'.format(user)
 +        home_perms = '755'
 +        if user == 'root':
 +            home_dir = '/root'
 +            home_perms = '700'
 +        assert '{} {}'.format(user, home_perms) == client.execute(
 +            'stat -c "%U %a" {}'.format(home_dir)
 +        )
 +        if client.execute("test -d {}/.ssh".format(home_dir)).ok:
 +            assert '{} 700'.format(user) == client.execute(
 +                'stat -c "%U %a" {}/.ssh'.format(home_dir)
 +            )
 +        assert '{} 600'.format(user) == client.execute(
 +            'stat -c "%U %a" {}'.format(filename)
 +        )
 +
 +        # Also ensure ssh-keygen works as expected
 +        client.execute('mkdir {}/.ssh'.format(home_dir))
 +        assert client.execute(
 +            "ssh-keygen -b 2048 -t rsa -f {}/.ssh/id_rsa -q -N ''".format(
 +                home_dir)
 +        ).ok
 +        assert client.execute('test -f {}/.ssh/id_rsa'.format(home_dir))
 +        assert client.execute('test -f {}/.ssh/id_rsa.pub'.format(home_dir))
 +
 +    assert 'root 755' == client.execute('stat -c "%U %a" /home')
 +
 +
 +DEFAULT_KEYS_USERDATA = _USERDATA.format(bootcmd='""')
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(DEFAULT_KEYS_USERDATA)
 +def test_authorized_keys_default(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +AUTHORIZED_KEYS2_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(AUTHORIZED_KEYS2_USERDATA)
 +def test_authorized_keys2(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +NESTED_KEYS_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys %h/foo/bar/ssh/keys;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(NESTED_KEYS_USERDATA)
 +def test_nested_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/foo/bar/ssh/keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/foo/bar/ssh/keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/foo/bar/ssh/keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/foo/bar/ssh/keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +EXTERNAL_KEYS_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys /etc/ssh/authorized_keys/%u/keys;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(EXTERNAL_KEYS_USERDATA)
 +def test_external_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/etc/ssh/authorized_keys/test_user1/keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/etc/ssh/authorized_keys/test_user2/keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/etc/ssh/authorized_keys/ubuntu/keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/etc/ssh/authorized_keys/root/keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 -- 
 2.27.0
--- a/SOURCES/ci-Remove-rhel-specific-files.patch
+++ b/SOURCES/ci-Remove-rhel-specific-files.patch
@ -0,0 +1,373 @@
 From d43f0d93386f123892451d923c2b3c6fe7130c39 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 19 May 2022 11:38:22 +0200
 Subject: [PATCH 4/4] Remove rhel specific files
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 65: Align rhel custom files with upstream (#1431)
 RH-Commit: [2/2] 5e31f0bcb500682e7746ccbd2e628c2ef339d6c6
 RH-Bugzilla: 2082071
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Remove all files in rhel/ directory and related commands that copy
 and replace them with the generated ones.
 Also adjust setup.py, align it with upstream:
 - by default, after rhel 8.3 ds-identify is in /usr/libexec, so no need to move it manually
 - bash-completions work also in /usr/share, as upstream
 - udev also works in /lib/udev
 Also remove rhel/README since it is outdated (chef is used in cloud.cfg) and cloud-init-tmpfiles.conf,
 as it exists also in .distro.
 X-downstream-only: yes
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 redhat/cloud-init.spec.template       | 21 ++------
 rhel/README.rhel                      |  5 --
 rhel/cloud-init-tmpfiles.conf         |  1 -
 rhel/cloud.cfg                        | 69 ---------------------------
 rhel/systemd/cloud-config.service     | 18 -------
 rhel/systemd/cloud-config.target      | 11 -----
 rhel/systemd/cloud-final.service      | 24 ----------
 rhel/systemd/cloud-init-local.service | 31 ------------
 rhel/systemd/cloud-init.service       | 26 ----------
 rhel/systemd/cloud-init.target        |  7 ---
 setup.py                              | 28 ++++++++++-
 11 files changed, 31 insertions(+), 210 deletions(-)
 delete mode 100644 rhel/README.rhel
 delete mode 100644 rhel/cloud-init-tmpfiles.conf
 delete mode 100644 rhel/cloud.cfg
 delete mode 100644 rhel/systemd/cloud-config.service
 delete mode 100644 rhel/systemd/cloud-config.target
 delete mode 100644 rhel/systemd/cloud-final.service
 delete mode 100644 rhel/systemd/cloud-init-local.service
 delete mode 100644 rhel/systemd/cloud-init.service
 delete mode 100644 rhel/systemd/cloud-init.target
 diff --git a/rhel/README.rhel b/rhel/README.rhel
 deleted file mode 100644
 index aa29630d..00000000
 --- a/rhel/README.rhel
 +++ /dev/null
@@ -1,5 +0,0 @@
 -The following cloud-init modules are currently unsupported on this OS:
 - - apt_update_upgrade ('apt_update', 'apt_upgrade', 'apt_mirror', 'apt_preserve_sources_list', 'apt_old_mirror', 'apt_sources', 'debconf_selections', 'packages' options)
 - - byobu ('byobu_by_default' option)
 - - chef
 - - grub_dpkg
 diff --git a/rhel/cloud-init-tmpfiles.conf b/rhel/cloud-init-tmpfiles.conf
 deleted file mode 100644
 index 0c6d2a3b..00000000
 --- a/rhel/cloud-init-tmpfiles.conf
 +++ /dev/null
@@ -1 +0,0 @@
 -d /run/cloud-init 0700 root root - -
 diff --git a/rhel/cloud.cfg b/rhel/cloud.cfg
 deleted file mode 100644
 index cbee197a..00000000
 --- a/rhel/cloud.cfg
 +++ /dev/null
@@ -1,69 +0,0 @@
 -users:
 - - default
 -
 -disable_root: 1
 -ssh_pwauth:   0
 -
 -mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service', '0', '2']
 -resize_rootfs_tmp: /dev
 -ssh_deletekeys:   1
 -ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
 -syslog_fix_perms: ~
 -disable_vmware_customization: false
 -
 -cloud_init_modules:
 - - disk_setup
 - - migrator
 - - bootcmd
 - - write-files
 - - growpart
 - - resizefs
 - - set_hostname
 - - update_hostname
 - - update_etc_hosts
 - - rsyslog
 - - users-groups
 - - ssh
 -
 -cloud_config_modules:
 - - mounts
 - - locale
 - - set-passwords
 - - rh_subscription
 - - yum-add-repo
 - - package-update-upgrade-install
 - - timezone
 - - puppet
 - - chef
 - - salt-minion
 - - mcollective
 - - disable-ec2-metadata
 - - runcmd
 -
 -cloud_final_modules:
 - - rightscale_userdata
 - - scripts-per-once
 - - scripts-per-boot
 - - scripts-per-instance
 - - scripts-user
 - - ssh-authkey-fingerprints
 - - keys-to-console
 - - phone-home
 - - final-message
 - - power-state-change
 -
 -system_info:
 -  default_user:
 -    name: cloud-user
 -    lock_passwd: true
 -    gecos: Cloud User
 -    groups: [adm, systemd-journal]
 -    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
 -    shell: /bin/bash
 -  distro: rhel
 -  paths:
 -    cloud_dir: /var/lib/cloud
 -    templates_dir: /etc/cloud/templates
 -  ssh_svcname: sshd
 -
 -# vim:syntax=yaml
 diff --git a/rhel/systemd/cloud-config.service b/rhel/systemd/cloud-config.service
 deleted file mode 100644
 index f3dcd4be..00000000
 --- a/rhel/systemd/cloud-config.service
 +++ /dev/null
@@ -1,18 +0,0 @@
 -[Unit]
 -Description=Apply the settings specified in cloud-config
 -After=network-online.target cloud-config.target
 -Wants=network-online.target cloud-config.target
 -ConditionPathExists=!/etc/cloud/cloud-init.disabled
 -ConditionKernelCommandLine=!cloud-init=disabled
 -
 -[Service]
 -Type=oneshot
 -ExecStart=/usr/bin/cloud-init modules --mode=config
 -RemainAfterExit=yes
 -TimeoutSec=0
 -
 -# Output needs to appear in instance console output
 -StandardOutput=journal+console
 -
 -[Install]
 -WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-config.target b/rhel/systemd/cloud-config.target
 deleted file mode 100644
 index ae9b7d02..00000000
 --- a/rhel/systemd/cloud-config.target
 +++ /dev/null
@@ -1,11 +0,0 @@
 -# cloud-init normally emits a "cloud-config" upstart event to inform third
 -# parties that cloud-config is available, which does us no good when we're
 -# using systemd.  cloud-config.target serves as this synchronization point
 -# instead.  Services that would "start on cloud-config" with upstart can
 -# instead use "After=cloud-config.target" and "Wants=cloud-config.target"
 -# as appropriate.
 -
 -[Unit]
 -Description=Cloud-config availability
 -Wants=cloud-init-local.service cloud-init.service
 -After=cloud-init-local.service cloud-init.service
 diff --git a/rhel/systemd/cloud-final.service b/rhel/systemd/cloud-final.service
 deleted file mode 100644
 index e281c0cf..00000000
 --- a/rhel/systemd/cloud-final.service
 +++ /dev/null
@@ -1,24 +0,0 @@
 -[Unit]
 -Description=Execute cloud user/final scripts
 -After=network-online.target cloud-config.service rc-local.service
 -Wants=network-online.target cloud-config.service
 -ConditionPathExists=!/etc/cloud/cloud-init.disabled
 -ConditionKernelCommandLine=!cloud-init=disabled
 -
 -[Service]
 -Type=oneshot
 -ExecStart=/usr/bin/cloud-init modules --mode=final
 -RemainAfterExit=yes
 -TimeoutSec=0
 -KillMode=process
 -# Restart NetworkManager if it is present and running.
 -ExecStartPost=/bin/sh -c 'u=NetworkManager.service; \
 - out=$(systemctl show --property=SubState $u) || exit; \
 - [ "$out" = "SubState=running" ] || exit 0; \
 - systemctl reload-or-try-restart $u'
 -
 -# Output needs to appear in instance console output
 -StandardOutput=journal+console
 -
 -[Install]
 -WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init-local.service b/rhel/systemd/cloud-init-local.service
 deleted file mode 100644
 index 8f9f6c9f..00000000
 --- a/rhel/systemd/cloud-init-local.service
 +++ /dev/null
@@ -1,31 +0,0 @@
 -[Unit]
 -Description=Initial cloud-init job (pre-networking)
 -DefaultDependencies=no
 -Wants=network-pre.target
 -After=systemd-remount-fs.service
 -Requires=dbus.socket
 -After=dbus.socket
 -Before=NetworkManager.service network.service
 -Before=network-pre.target
 -Before=shutdown.target
 -Before=firewalld.target
 -Conflicts=shutdown.target
 -RequiresMountsFor=/var/lib/cloud
 -ConditionPathExists=!/etc/cloud/cloud-init.disabled
 -ConditionKernelCommandLine=!cloud-init=disabled
 -
 -[Service]
 -Type=oneshot
 -ExecStartPre=/bin/mkdir -p /run/cloud-init
 -ExecStartPre=/sbin/restorecon /run/cloud-init
 -ExecStartPre=/usr/bin/touch /run/cloud-init/enabled
 -ExecStart=/usr/bin/cloud-init init --local
 -ExecStart=/bin/touch /run/cloud-init/network-config-ready
 -RemainAfterExit=yes
 -TimeoutSec=0
 -
 -# Output needs to appear in instance console output
 -StandardOutput=journal+console
 -
 -[Install]
 -WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init.service b/rhel/systemd/cloud-init.service
 deleted file mode 100644
 index 0b3d796d..00000000
 --- a/rhel/systemd/cloud-init.service
 +++ /dev/null
@@ -1,26 +0,0 @@
 -[Unit]
 -Description=Initial cloud-init job (metadata service crawler)
 -Wants=cloud-init-local.service
 -Wants=sshd-keygen.service
 -Wants=sshd.service
 -After=cloud-init-local.service
 -After=NetworkManager.service network.service
 -After=NetworkManager-wait-online.service
 -Before=network-online.target
 -Before=sshd-keygen.service
 -Before=sshd.service
 -Before=systemd-user-sessions.service
 -ConditionPathExists=!/etc/cloud/cloud-init.disabled
 -ConditionKernelCommandLine=!cloud-init=disabled
 -
 -[Service]
 -Type=oneshot
 -ExecStart=/usr/bin/cloud-init init
 -RemainAfterExit=yes
 -TimeoutSec=0
 -
 -# Output needs to appear in instance console output
 -StandardOutput=journal+console
 -
 -[Install]
 -WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init.target b/rhel/systemd/cloud-init.target
 deleted file mode 100644
 index 083c3b6f..00000000
 --- a/rhel/systemd/cloud-init.target
 +++ /dev/null
@@ -1,7 +0,0 @@
 -# cloud-init target is enabled by cloud-init-generator
 -# To disable it you can either:
 -#  a.) boot with kernel cmdline of 'cloud-init=disabled'
 -#  b.) touch a file /etc/cloud/cloud-init.disabled
 -[Unit]
 -Description=Cloud-init target
 -After=multi-user.target
 diff --git a/setup.py b/setup.py
 index 3c377eaa..a9132d2c 100755
 --- a/setup.py
 +++ b/setup.py
@@ -139,6 +139,21 @@ INITSYS_FILES = {
     "sysvinit_deb": [f for f in glob("sysvinit/debian/*") if is_f(f)],
     "sysvinit_openrc": [f for f in glob("sysvinit/gentoo/*") if is_f(f)],
     "sysvinit_suse": [f for f in glob("sysvinit/suse/*") if is_f(f)],
 +    "systemd": [
 +        render_tmpl(f)
 +        for f in (
 +            glob("systemd/*.tmpl")
 +            + glob("systemd/*.service")
 +            + glob("systemd/*.socket")
 +            + glob("systemd/*.target")
 +        )
 +        if (is_f(f) and not is_generator(f))
 +    ],
 +    "systemd.generators": [
 +        render_tmpl(f, mode=0o755)
 +        for f in glob("systemd/*")
 +        if is_f(f) and is_generator(f)
 +    ],
     "upstart": [f for f in glob("upstart/*") if is_f(f)],
 }
 INITSYS_ROOTS = {
@@ -148,6 +163,10 @@ INITSYS_ROOTS = {
     "sysvinit_deb": "etc/init.d",
     "sysvinit_openrc": "etc/init.d",
     "sysvinit_suse": "etc/init.d",
 +    "systemd": pkg_config_read("systemd", "systemdsystemunitdir"),
 +    "systemd.generators": pkg_config_read(
 +        "systemd", "systemdsystemgeneratordir"
 +    ),
     "upstart": "etc/init/",
 }
 INITSYS_TYPES = sorted([f.partition(".")[0] for f in INITSYS_ROOTS.keys()])
@@ -262,13 +281,15 @@ data_files = [
     (
         USR_LIB_EXEC + "/cloud-init",
         [
 +            "tools/ds-identify",
             "tools/hook-hotplug",
             "tools/uncloud-init",
             "tools/write-ssh-key-fingerprints",
         ],
     ),
     (
 -        ETC + "/bash_completion.d", ["bash_completion/cloud-init"],
 +        USR + "/share/bash-completion/completions",
 +        ["bash_completion/cloud-init"],
     ),
     (USR + "/share/doc/cloud-init", [f for f in glob("doc/*") if is_f(f)]),
     (
@@ -287,7 +308,8 @@ if not platform.system().endswith("BSD"):
                 ETC + "/NetworkManager/dispatcher.d/",
                 ["tools/hook-network-manager"],
             ),
 -            ("/usr/lib/udev/rules.d", [f for f in glob("udev/*.rules")]),
 +            (ETC + "/dhcp/dhclient-exit-hooks.d/", ["tools/hook-dhclient"]),
 +            (LIB + "/udev/rules.d", [f for f in glob("udev/*.rules")]),
             (
                 ETC + "/systemd/system/sshd-keygen@.service.d/",
                 ["systemd/disable-sshd-keygen-if-cloud-init-active.conf"],
@@ -317,6 +339,8 @@ setuptools.setup(
     scripts=["tools/cloud-init-per"],
     license="Dual-licensed under GPLv3 or Apache 2.0",
     data_files=data_files,
 +    install_requires=requirements,
 +    cmdclass=cmdclass,
     entry_points={
         "console_scripts": [
             "cloud-init = cloudinit.cmd.main:main",
 -- 
 2.35.3
--- a/SOURCES/ci-Revert-Add-native-NetworkManager-support-1224.patch
+++ b/SOURCES/ci-Revert-Add-native-NetworkManager-support-1224.patch
--- a/SOURCES/ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch
+++ b/SOURCES/ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch
@ -0,0 +1,75 @@
 From 02e7b89c157f8c3243f0d91cf5652cf27db44b72 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 8 Aug 2022 10:10:26 +0200
 Subject: [PATCH 2/2] Revert "Use Network-Manager and Netplan as default
 renderers for RHEL and Fedora (#1465)"
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 81: Revert "Use Network-Manager and Netplan as default renderers for RHEL and Fedora (#1465)"
 RH-Commit: [2/2] 746b2e33356376e250b799261031676174e8ccc9
 RH-Bugzilla: 2107464 2110066 2117526 2104393 2098624
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 As NM is reverted, remove also documentation and any trace of it.
 This reverts commit 13ded463a6a0b1b0bf0dffc0a997f006dd25c4f3.
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 config/cloud.cfg.tmpl             |  3 ---
 doc/rtd/topics/network-config.rst | 12 +-----------
 2 files changed, 1 insertion(+), 14 deletions(-)
 diff --git a/config/cloud.cfg.tmpl b/config/cloud.cfg.tmpl
 index f4d2fd14..80ab4f96 100644
 --- a/config/cloud.cfg.tmpl
 +++ b/config/cloud.cfg.tmpl
@@ -353,7 +353,4 @@ system_info:
 {% elif variant in ["dragonfly"] %}
    network:
       renderers: ['freebsd']
 -{% elif variant in ["rhel", "fedora"] %}
 -   network:
 -      renderers: ['netplan', 'network-manager', 'networkd', 'sysconfig', 'eni']
 {% endif %}
 diff --git a/doc/rtd/topics/network-config.rst b/doc/rtd/topics/network-config.rst
 index f503caab..c461a3fe 100644
 --- a/doc/rtd/topics/network-config.rst
 +++ b/doc/rtd/topics/network-config.rst
@@ -188,15 +188,6 @@ generated configuration into an internal network configuration state. From
 this state `Cloud-init`_ delegates rendering of the configuration to Distro
 supported formats.  The following ``renderers`` are supported in cloud-init:
 -- **NetworkManager**
 -
 -`NetworkManager <https://networkmanager.dev>`_ is the standard Linux network
 -configuration tool suite. It supports a wide range of networking setups.
 -Configuration is typically stored in ``/etc/NetworkManager``.
 -
 -It is the default for a number of Linux distributions, notably Fedora;
 -CentOS/RHEL; and derivatives.
 -
 - **ENI**
 /etc/network/interfaces or ``ENI`` is supported by the ``ifupdown`` package
@@ -224,7 +215,6 @@ is as follows:
 - ENI
 - Sysconfig
 - Netplan
 -- NetworkManager
 When applying the policy, `Cloud-init`_ checks if the current instance has the
 correct binaries and paths to support the renderer.  The first renderer that
@@ -233,7 +223,7 @@ supplying an updated configuration in cloud-config. ::
   system_info:
     network:
 -      renderers: ['netplan', 'network-manager', 'eni', 'sysconfig', 'freebsd', 'netbsd', 'openbsd']
 +      renderers: ['netplan', 'eni', 'sysconfig', 'freebsd', 'netbsd', 'openbsd']
 Network Configuration Tools
 -- 
 2.27.0
--- a/SOURCES/ci-Revert-unnecesary-lcase-in-ds-identify-978.patch
+++ b/SOURCES/ci-Revert-unnecesary-lcase-in-ds-identify-978.patch
@ -1,47 +0,0 @@
 From 532a36edf0dea2b98835bd08e285bec9c50eb0f9 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Fri, 14 Jan 2022 16:42:41 +0100
 Subject: [PATCH 5/6] Revert unnecesary lcase in ds-identify (#978)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 43: Datasource for VMware
 RH-Commit: [5/6] 95634e4b42e3abfb91182b090c312eef29c63e54
 RH-Bugzilla: 2040704
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit f516a7d37c1654addc02485e681b4358d7e7c0db
 Author: Andrew Kutz <101085+akutz@users.noreply.github.com>
 Date:   Fri Aug 13 14:30:55 2021 -0500
    Revert unnecesary lcase in ds-identify (#978)
    This patch reverts an unnecessary lcase optimization in the
    ds-identify script. SystemD documents the values produced by
    the systemd-detect-virt command are lower case, and the mapping
    table used by the FreeBSD check is also lower-case.
    The optimization added two new forked processes, needlessly
    causing overhead.
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 tools/ds-identify | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tools/ds-identify b/tools/ds-identify
 index 0e12298f..7b782462 100755
 --- a/tools/ds-identify
 +++ b/tools/ds-identify
@@ -449,7 +449,7 @@ detect_virt() {
 read_virt() {
     cached "$DI_VIRT" && return 0
     detect_virt
 -    DI_VIRT="$(echo "${_RET}" | tr '[:upper:]' '[:lower:]')"
 +    DI_VIRT="${_RET}"
 }
 is_container() {
 -- 
 2.27.0
--- a/SOURCES/ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
+++ b/SOURCES/ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
--- a/SOURCES/ci-Support-EC2-tags-in-instance-metadata-1309.patch
+++ b/SOURCES/ci-Support-EC2-tags-in-instance-metadata-1309.patch
@ -0,0 +1,164 @@
 From fbec3008305845072a787f46008bbb82d89dec53 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 30 May 2022 16:46:41 +0200
 Subject: [PATCH] Support EC2 tags in instance metadata (#1309)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 70: Support EC2 tags in instance metadata (#1309)
 RH-Commit: [1/1] 2497547016173a4c6e7d3c900f80de390d445c44
 RH-Bugzilla: 2082686
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 commit 40c52ce1f4049449b04f93226721f63af874c5c7
 Author: Eduardo Dobay <edudobay@users.noreply.github.com>
 Date:   Wed Apr 6 01:28:01 2022 -0300
    Support EC2 tags in instance metadata (#1309)
    Add support for newer EC2 metadata versions (up to 2021-03-23), so that
    tags can be retrieved from the `ds.meta_data.tags` field, as well as
    with any new fields that might have been added since the 2018-09-24
    version.
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/sources/DataSourceEc2.py  |  5 +++--
 doc/rtd/topics/datasources/ec2.rst  | 28 ++++++++++++++++++++++------
 tests/unittests/sources/test_ec2.py | 26 +++++++++++++++++++++++++-
 tools/.github-cla-signers           |  1 +
 4 files changed, 51 insertions(+), 9 deletions(-)
 diff --git a/cloudinit/sources/DataSourceEc2.py b/cloudinit/sources/DataSourceEc2.py
 index 03b3870c..a030b498 100644
 --- a/cloudinit/sources/DataSourceEc2.py
 +++ b/cloudinit/sources/DataSourceEc2.py
@@ -61,8 +61,9 @@ class DataSourceEc2(sources.DataSource):
     min_metadata_version = "2009-04-04"
     # Priority ordered list of additional metadata versions which will be tried
 -    # for extended metadata content. IPv6 support comes in 2016-09-02
 -    extended_metadata_versions = ["2018-09-24", "2016-09-02"]
 +    # for extended metadata content. IPv6 support comes in 2016-09-02.
 +    # Tags support comes in 2021-03-23.
 +    extended_metadata_versions = ["2021-03-23", "2018-09-24", "2016-09-02"]
     # Setup read_url parameters per get_url_params.
     url_max_wait = 120
 diff --git a/doc/rtd/topics/datasources/ec2.rst b/doc/rtd/topics/datasources/ec2.rst
 index 94e4158d..77232269 100644
 --- a/doc/rtd/topics/datasources/ec2.rst
 +++ b/doc/rtd/topics/datasources/ec2.rst
@@ -38,11 +38,26 @@ Userdata is accessible via the following URL:
     GET http://169.254.169.254/2009-04-04/user-data
     1234,fred,reboot,true | 4512,jimbo, | 173,,,
 -Note that there are multiple versions of this data provided, cloud-init
 -by default uses **2009-04-04** but newer versions can be supported with
 -relative ease (newer versions have more data exposed, while maintaining
 -backward compatibility with the previous versions).
 -Version **2016-09-02** is required for secondary IP address support.
 +Note that there are multiple EC2 Metadata versions of this data provided
 +to instances. cloud-init will attempt to use the most recent API version it
 +supports in order to get latest API features and instance-data. If a given
 +API version is not exposed to the instance, those API features will be
 +unavailable to the instance.
 +
 +
 ++----------------+----------------------------------------------------------+
 ++ EC2 version    | supported instance-data/feature                          |
 ++================+==========================================================+
 ++ **2021-03-23** | Required for Instance tag support. This feature must be  |
 +|                | enabled individually on each instance.  See the          |
 +|                | `EC2 tags user guide`_.                                  |
 ++----------------+----------------------------------------------------------+
 +| **2016-09-02** | Required for secondary IP address support.               |
 ++----------------+----------------------------------------------------------+
 +| **2009-04-04** | Minimum supports EC2 API version for meta-data and       |
 +|                | user-data.                                               |
 ++----------------+----------------------------------------------------------+
 +
 To see which versions are supported from your cloud provider use the following
 URL:
@@ -71,7 +86,7 @@ configuration (in `/etc/cloud/cloud.cfg` or `/etc/cloud/cloud.cfg.d/`).
 The settings that may be configured are:
 - * **metadata_urls**: This list of urls will be searched for an Ec2
 + * **metadata_urls**: This list of urls will be searched for an EC2
    metadata service. The first entry that successfully returns a 200 response
    for <url>/<version>/meta-data/instance-id will be selected.
    (default: ['http://169.254.169.254', 'http://instance-data:8773']).
@@ -121,4 +136,5 @@ Notes
    For example: the primary NIC will have a DHCP route-metric of 100,
    the next NIC will be 200.
 +.. _EC2 tags user guide: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS
 .. vi: textwidth=79
 diff --git a/tests/unittests/sources/test_ec2.py b/tests/unittests/sources/test_ec2.py
 index b376660d..7c8a5ea5 100644
 --- a/tests/unittests/sources/test_ec2.py
 +++ b/tests/unittests/sources/test_ec2.py
@@ -210,6 +210,17 @@ SECONDARY_IP_METADATA_2018_09_24 = {
 M_PATH_NET = "cloudinit.sources.DataSourceEc2.net."
 +TAGS_METADATA_2021_03_23 = {
 +    **DEFAULT_METADATA,
 +    "tags": {
 +        "instance": {
 +            "Environment": "production",
 +            "Application": "test",
 +            "TagWithoutValue": "",
 +        }
 +    },
 +}
 +
 def _register_ssh_keys(rfunc, base_url, keys_data):
     """handle ssh key inconsistencies.
@@ -670,7 +681,7 @@ class TestEc2(test_helpers.HttprettyTestCase):
         logs_with_redacted = [log for log in all_logs if REDACT_TOK in log]
         logs_with_token = [log for log in all_logs if "API-TOKEN" in log]
         self.assertEqual(1, len(logs_with_redacted_ttl))
 -        self.assertEqual(81, len(logs_with_redacted))
 +        self.assertEqual(83, len(logs_with_redacted))
         self.assertEqual(0, len(logs_with_token))
     @mock.patch("cloudinit.net.dhcp.maybe_perform_dhcp_discovery")
@@ -811,6 +822,19 @@ class TestEc2(test_helpers.HttprettyTestCase):
         )
         self.assertIn("Crawl of metadata service took", self.logs.getvalue())
 +    def test_get_instance_tags(self):
 +        ds = self._setup_ds(
 +            platform_data=self.valid_platform_data,
 +            sys_cfg={"datasource": {"Ec2": {"strict_id": False}}},
 +            md={"md": TAGS_METADATA_2021_03_23},
 +        )
 +        self.assertTrue(ds.get_data())
 +        self.assertIn("tags", ds.metadata)
 +        self.assertIn("instance", ds.metadata["tags"])
 +        instance_tags = ds.metadata["tags"]["instance"]
 +        self.assertEqual(instance_tags["Application"], "test")
 +        self.assertEqual(instance_tags["Environment"], "production")
 +
 class TestGetSecondaryAddresses(test_helpers.CiTestCase):
 diff --git a/tools/.github-cla-signers b/tools/.github-cla-signers
 index ac157a2f..9f71ea0c 100644
 --- a/tools/.github-cla-signers
 +++ b/tools/.github-cla-signers
@@ -26,6 +26,7 @@ dermotbradley
 dhensby
 eandersson
 eb3095
 +edudobay
 emmanuelthome
 eslerm
 esposem
 -- 
 2.27.0
--- a/SOURCES/ci-Update-dscheck_VMware-s-rpctool-check-970.patch
+++ b/SOURCES/ci-Update-dscheck_VMware-s-rpctool-check-970.patch
@ -1,97 +0,0 @@
 From cc79cb3958b943b755a9b11b3e87ce820058ccaa Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Fri, 14 Jan 2022 16:41:47 +0100
 Subject: [PATCH 4/6] Update dscheck_VMware's rpctool check (#970)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 43: Datasource for VMware
 RH-Commit: [4/6] 6f4d732c55c521869210d8aeedfa1150ea5a92f8
 RH-Bugzilla: 2040704
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit 7781dec3306e9467f216cfcb36b7e10a8b38547a
 Author: Shreenidhi Shedi <53473811+sshedi@users.noreply.github.com>
 Date:   Fri Aug 13 00:40:39 2021 +0530
    Update dscheck_VMware's rpctool check (#970)
    This patch updates the dscheck_VMware function's use of "vmware-rpctool".
    When checking to see if a "guestinfo" property is set.
    Because a successful exit code can occur even if there is an empty
    string returned, it is possible that the VMware datasource will be
    loaded as a false-positive. This patch ensures that in addition to
    validating the exit code, the emitted output is also examined to ensure
    a non-empty value is returned by rpctool before returning "${DS_FOUND}"
    from "dscheck_VMware()".
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 tools/ds-identify | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)
 diff --git a/tools/ds-identify b/tools/ds-identify
 index c01eae3d..0e12298f 100755
 --- a/tools/ds-identify
 +++ b/tools/ds-identify
@@ -141,6 +141,7 @@ error() {
     debug 0 "$@"
     stderr "$@"
 }
 +
 warn() {
     set -- "WARN:" "$@"
     debug 0 "$@"
@@ -344,7 +345,6 @@ geom_label_status_as() {
     return $ret
 }
 -
 read_fs_info_freebsd() {
     local oifs="$IFS" line="" delim=","
     local ret=0 labels="" dev="" label="" ftype="" isodevs=""
@@ -404,7 +404,6 @@ cached() {
     [ -n "$1" ] && _RET="$1" && return || return 1
 }
 -
 detect_virt() {
     local virt="${UNAVAILABLE}" r="" out=""
     if [ -d /run/systemd ]; then
@@ -450,7 +449,7 @@ detect_virt() {
 read_virt() {
     cached "$DI_VIRT" && return 0
     detect_virt
 -    DI_VIRT=${_RET}
 +    DI_VIRT="$(echo "${_RET}" | tr '[:upper:]' '[:lower:]')"
 }
 is_container() {
@@ -1370,16 +1369,20 @@ vmware_has_rpctool() {
     command -v vmware-rpctool >/dev/null 2>&1
 }
 +vmware_rpctool_guestinfo() {
 +    vmware-rpctool "info-get guestinfo.${1}" 2>/dev/null | grep "[[:alnum:]]"
 +}
 +
 vmware_rpctool_guestinfo_metadata() {
 -    vmware-rpctool "info-get guestinfo.metadata"
 +    vmware_rpctool_guestinfo "metadata"
 }
 vmware_rpctool_guestinfo_userdata() {
 -    vmware-rpctool "info-get guestinfo.userdata"
 +    vmware_rpctool_guestinfo "userdata"
 }
 vmware_rpctool_guestinfo_vendordata() {
 -    vmware-rpctool "info-get guestinfo.vendordata"
 +    vmware_rpctool_guestinfo "vendordata"
 }
 dscheck_VMware() {
 -- 
 2.27.0
--- a/SOURCES/ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch
+++ b/SOURCES/ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch
@ -0,0 +1,110 @@
 From 13ded463a6a0b1b0bf0dffc0a997f006dd25c4f3 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 19 May 2022 15:51:27 +0200
 Subject: [PATCH 2/4] Use Network-Manager and Netplan as default renderers for
 RHEL and Fedora (#1465)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 57: Add native NetworkManager support (#1224)
 RH-Commit: [2/2] f2f977564bea496b0d76c0cef242959d03c2c73e
 RH-Bugzilla: 2059872
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit 7703aa98b89c8daba207c28a0422268ead10019a
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Thu May 19 15:05:01 2022 +0200
    Use Network-Manager and Netplan as default renderers for RHEL and Fedora (#1465)
    This is adapted from Neal Gompa's PR:
    https://github.com/canonical/cloud-init/pull/1435
    The only difference is that we are not modifying renderers.py (thus
    modifying the priority of all distros), but just tweaking cloud.cfg to
    apply this change to Fedora and RHEL. Other distros can optionally
    add themselves afterwards.
            net: Prefer Netplan and NetworkManager renderers by default
            NetworkManager is used by default on a variety of Linux distributions,
            and exists as a cross-distribution network management service.
            Additionally, add information about the NetworkManager renderer to
            the cloud-init documentation.
            Because Netplan can be explicitly used to manage NetworkManager,
            it needs to be preferred before NetworkManager.
            This change is a follow-up to #1224, which added the native
            NetworkManager renderer.
            This patch has been deployed on Fedora's cloud-init package throughout
            the development of Fedora Linux 36 to verify that it works.
            This should also make it tremendously easier for Linux distributions
            to use cloud-init because now a standard configuration is supported
            by default.
            Signed-off-by: Neal Gompa <ngompa13@gmail.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 config/cloud.cfg.tmpl             |  3 +++
 doc/rtd/topics/network-config.rst | 12 +++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)
 diff --git a/config/cloud.cfg.tmpl b/config/cloud.cfg.tmpl
 index fb4b456c..86beee3c 100644
 --- a/config/cloud.cfg.tmpl
 +++ b/config/cloud.cfg.tmpl
@@ -330,4 +330,7 @@ system_info:
 {% elif variant in ["dragonfly"] %}
    network:
       renderers: ['freebsd']
 +{% elif variant in ["rhel", "fedora"] %}
 +   network:
 +      renderers: ['netplan', 'network-manager', 'networkd', 'sysconfig', 'eni']
 {% endif %}
 diff --git a/doc/rtd/topics/network-config.rst b/doc/rtd/topics/network-config.rst
 index c461a3fe..f503caab 100644
 --- a/doc/rtd/topics/network-config.rst
 +++ b/doc/rtd/topics/network-config.rst
@@ -188,6 +188,15 @@ generated configuration into an internal network configuration state. From
 this state `Cloud-init`_ delegates rendering of the configuration to Distro
 supported formats.  The following ``renderers`` are supported in cloud-init:
 +- **NetworkManager**
 +
 +`NetworkManager <https://networkmanager.dev>`_ is the standard Linux network
 +configuration tool suite. It supports a wide range of networking setups.
 +Configuration is typically stored in ``/etc/NetworkManager``.
 +
 +It is the default for a number of Linux distributions, notably Fedora;
 +CentOS/RHEL; and derivatives.
 +
 - **ENI**
 /etc/network/interfaces or ``ENI`` is supported by the ``ifupdown`` package
@@ -215,6 +224,7 @@ is as follows:
 - ENI
 - Sysconfig
 - Netplan
 +- NetworkManager
 When applying the policy, `Cloud-init`_ checks if the current instance has the
 correct binaries and paths to support the renderer.  The first renderer that
@@ -223,7 +233,7 @@ supplying an updated configuration in cloud-config. ::
   system_info:
     network:
 -      renderers: ['netplan', 'eni', 'sysconfig', 'freebsd', 'netbsd', 'openbsd']
 +      renderers: ['netplan', 'network-manager', 'eni', 'sysconfig', 'freebsd', 'netbsd', 'openbsd']
 Network Configuration Tools
 -- 
 2.35.3
--- a/SOURCES/ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch
+++ b/SOURCES/ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch
@ -1,97 +0,0 @@
 From 8dc357c036e393ae7d869d3074377f5447fa9b77 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Tue, 26 Oct 2021 22:18:06 +0200
 Subject: [PATCH] cc_ssh.py: fix private key group owner and permissions
 (#1070)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 34: cc_ssh.py: fix private key group owner and permissions (#1070)
 RH-Commit: [1/1] 6dfd47416dd2cb7ed3822199c43cbd2fdada7aa1 (eesposit/cloud-init)
 RH-Bugzilla: 2017697
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 commit ee296ced9c0a61b1484d850b807c601bcd670ec1
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Tue Oct 19 21:32:10 2021 +0200
    cc_ssh.py: fix private key group owner and permissions (#1070)
    When default host keys are created by sshd-keygen (/etc/ssh/ssh_host_*_key)
    in RHEL/CentOS/Fedora, openssh it performs the following:
    # create new keys
    if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then
            exit 1
    fi
    # sanitize permissions
    /usr/bin/chgrp ssh_keys $KEY
    /usr/bin/chmod 640 $KEY
    /usr/bin/chmod 644 $KEY.pub
    Note that the group ssh_keys exists only in RHEL/CentOS/Fedora.
    Now that we disable sshd-keygen to allow only cloud-init to create
    them, we miss the "sanitize permissions" part, where we set the group
    owner as ssh_keys and the private key mode to 640.
    According to https://bugzilla.redhat.com/show_bug.cgi?id=2013644#c8, failing
    to set group ownership and permissions like openssh does makes the RHEL openscap
    tool generate an error.
    Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com
    RHBZ: 2013644
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/config/cc_ssh.py |  7 +++++++
 cloudinit/util.py          | 14 ++++++++++++++
 2 files changed, 21 insertions(+)
 diff --git a/cloudinit/config/cc_ssh.py b/cloudinit/config/cc_ssh.py
 index 05a16dbc..4e986c55 100755
 --- a/cloudinit/config/cc_ssh.py
 +++ b/cloudinit/config/cc_ssh.py
@@ -240,6 +240,13 @@ def handle(_name, cfg, cloud, log, _args):
                 try:
                     out, err = subp.subp(cmd, capture=True, env=lang_c)
                     sys.stdout.write(util.decode_binary(out))
 +
 +                    gid = util.get_group_id("ssh_keys")
 +                    if gid != -1:
 +                        # perform same "sanitize permissions" as sshd-keygen
 +                        os.chown(keyfile, -1, gid)
 +                        os.chmod(keyfile, 0o640)
 +                        os.chmod(keyfile + ".pub", 0o644)
                 except subp.ProcessExecutionError as e:
                     err = util.decode_binary(e.stderr).lower()
                     if (e.exit_code == 1 and
 diff --git a/cloudinit/util.py b/cloudinit/util.py
 index 343976ad..fe37ae89 100644
 --- a/cloudinit/util.py
 +++ b/cloudinit/util.py
@@ -1831,6 +1831,20 @@ def chmod(path, mode):
             os.chmod(path, real_mode)
 +def get_group_id(grp_name: str) -> int:
 +    """
 +    Returns the group id of a group name, or -1 if no group exists
 +
 +    @param grp_name: the name of the group
 +    """
 +    gid = -1
 +    try:
 +        gid = grp.getgrnam(grp_name).gr_gid
 +    except KeyError:
 +        LOG.debug("Group %s is not a valid group name", grp_name)
 +    return gid
 +
 +
 def get_permissions(path: str) -> int:
     """
     Returns the octal permissions of the file/folder pointed by the path,
 -- 
 2.27.0
--- a/SOURCES/ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch
+++ b/SOURCES/ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch
@ -1,87 +0,0 @@
 From 0a6a89e6b243e587daf8ce356fccb5d6a6acf089 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Tue, 7 Dec 2021 09:56:58 +0100
 Subject: [PATCH] cloudinit/net: handle two different routes for the same ip
 (#1124)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 37: cloudinit/net: handle two different routes for the same ip (#1124)
 RH-Commit: [1/1] 9cd9c38606bfe2395d808a48ac986dce7624e147
 RH-Bugzilla: 2028756
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit 0e25076b34fa995161b83996e866c0974cee431f
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Mon Dec 6 18:34:26 2021 +0100
    cloudinit/net: handle two different routes for the same ip (#1124)
    If we set a dhcp server side like this:
    $ cat /var/tmp/cloud-init/cloud-init-dhcp-f0rie5tm/dhcp.leases
    lease {
    ...
    option classless-static-routes 31.169.254.169.254 0.0.0.0,31.169.254.169.254
        10.112.143.127,22.10.112.140 0.0.0.0,0 10.112.140.1;
    ...
    }
    cloud-init fails to configure the routes via 'ip route add' because to there are
    two different routes for 169.254.169.254:
    $ ip -4 route add 192.168.1.1/32 via 0.0.0.0 dev eth0
    $ ip -4 route add 192.168.1.1/32 via 10.112.140.248 dev eth0
    But NetworkManager can handle such scenario successfully as it uses "ip route append".
    So change cloud-init to also use "ip route append" to fix the issue:
    $ ip -4 route append 192.168.1.1/32 via 0.0.0.0 dev eth0
    $ ip -4 route append 192.168.1.1/32 via 10.112.140.248 dev eth0
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    RHBZ: #2003231
 Conflicts:
    cloudinit/net/tests/test_init.py: a mock call in
    test_ephemeral_ipv4_network_with_rfc3442_static_routes is not
    present downstream.
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/net/__init__.py        | 2 +-
 cloudinit/net/tests/test_init.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/cloudinit/net/__init__.py b/cloudinit/net/__init__.py
 index 385b7bcc..003efa2a 100644
 --- a/cloudinit/net/__init__.py
 +++ b/cloudinit/net/__init__.py
@@ -1138,7 +1138,7 @@ class EphemeralIPv4Network(object):
             if gateway != "0.0.0.0/0":
                 via_arg = ['via', gateway]
             subp.subp(
 -                ['ip', '-4', 'route', 'add', net_address] + via_arg +
 +                ['ip', '-4', 'route', 'append', net_address] + via_arg +
                 ['dev', self.interface], capture=True)
             self.cleanup_cmds.insert(
                 0, ['ip', '-4', 'route', 'del', net_address] + via_arg +
 diff --git a/cloudinit/net/tests/test_init.py b/cloudinit/net/tests/test_init.py
 index 946f8ee2..2350837b 100644
 --- a/cloudinit/net/tests/test_init.py
 +++ b/cloudinit/net/tests/test_init.py
@@ -719,10 +719,10 @@ class TestEphemeralIPV4Network(CiTestCase):
                 ['ip', '-family', 'inet', 'link', 'set', 'dev', 'eth0', 'up'],
                 capture=True),
             mock.call(
 -                ['ip', '-4', 'route', 'add', '169.254.169.254/32',
 +                ['ip', '-4', 'route', 'append', '169.254.169.254/32',
                  'via', '192.168.2.1', 'dev', 'eth0'], capture=True),
             mock.call(
 -                ['ip', '-4', 'route', 'add', '0.0.0.0/0',
 +                ['ip', '-4', 'route', 'append', '0.0.0.0/0',
                  'via', '192.168.2.1', 'dev', 'eth0'], capture=True)]
         expected_teardown_calls = [
             mock.call(
 -- 
 2.27.0
--- a/SOURCES/ci-fix-error-on-upgrade-caused-by-new-vendordata2-attri.patch
+++ b/SOURCES/ci-fix-error-on-upgrade-caused-by-new-vendordata2-attri.patch
@ -1,173 +0,0 @@
 From 3636c2284132dbcd1cc505fb9f81ab722f4f99f0 Mon Sep 17 00:00:00 2001
 From: Amy Chen <xiachen@redhat.com>
 Date: Fri, 3 Dec 2021 14:38:16 +0800
 Subject: [PATCH] fix error on upgrade caused by new vendordata2 attributes
 RH-Author: xiachen <None>
 RH-MergeRequest: 36: fix error on upgrade caused by new vendordata2 attributes
 RH-Commit: [1/1] c16351924d4220a719380f12c2e8c03185f53c01
 RH-Bugzilla: 2028738
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 commit d132356cc361abef2d90d4073438f3ab759d5964
 Author: James Falcon <TheRealFalcon@users.noreply.github.com>
 Date:   Mon Apr 19 11:31:28 2021 -0500
    fix error on upgrade caused by new vendordata2 attributes (#869)
    In #777, we added 'vendordata2' and 'vendordata2_raw' attributes to
    the DataSource class, but didn't use the upgrade framework to deal
    with an unpickle after upgrade. This commit adds the necessary
    upgrade code.
    Additionally, added a smaller-scope upgrade test to our integration
    tests that will be run on every CI run so we catch these issues
    immediately in the future.
    LP: #1922739
 Signed-off-by: Amy Chen <xiachen@redhat.com>
 ---
 cloudinit/sources/__init__.py           | 12 +++++++++++-
 cloudinit/tests/test_upgrade.py         |  4 ++++
 tests/integration_tests/clouds.py       |  4 ++--
 tests/integration_tests/test_upgrade.py | 25 ++++++++++++++++++++++++-
 4 files changed, 41 insertions(+), 4 deletions(-)
 diff --git a/cloudinit/sources/__init__.py b/cloudinit/sources/__init__.py
 index 1ad1880d..7d74f8d9 100644
 --- a/cloudinit/sources/__init__.py
 +++ b/cloudinit/sources/__init__.py
@@ -24,6 +24,7 @@ from cloudinit import util
 from cloudinit.atomic_helper import write_json
 from cloudinit.event import EventType
 from cloudinit.filters import launch_index
 +from cloudinit.persistence import CloudInitPickleMixin
 from cloudinit.reporting import events
 DSMODE_DISABLED = "disabled"
@@ -134,7 +135,7 @@ URLParams = namedtuple(
     'URLParms', ['max_wait_seconds', 'timeout_seconds', 'num_retries'])
 -class DataSource(metaclass=abc.ABCMeta):
 +class DataSource(CloudInitPickleMixin, metaclass=abc.ABCMeta):
     dsmode = DSMODE_NETWORK
     default_locale = 'en_US.UTF-8'
@@ -196,6 +197,8 @@ class DataSource(metaclass=abc.ABCMeta):
     # non-root users
     sensitive_metadata_keys = ('merged_cfg', 'security-credentials',)
 +    _ci_pkl_version = 1
 +
     def __init__(self, sys_cfg, distro, paths, ud_proc=None):
         self.sys_cfg = sys_cfg
         self.distro = distro
@@ -218,6 +221,13 @@ class DataSource(metaclass=abc.ABCMeta):
         else:
             self.ud_proc = ud_proc
 +    def _unpickle(self, ci_pkl_version: int) -> None:
 +        """Perform deserialization fixes for Paths."""
 +        if not hasattr(self, 'vendordata2'):
 +            self.vendordata2 = None
 +        if not hasattr(self, 'vendordata2_raw'):
 +            self.vendordata2_raw = None
 +
     def __str__(self):
         return type_utils.obj_name(self)
 diff --git a/cloudinit/tests/test_upgrade.py b/cloudinit/tests/test_upgrade.py
 index f79a2536..fd3c5812 100644
 --- a/cloudinit/tests/test_upgrade.py
 +++ b/cloudinit/tests/test_upgrade.py
@@ -43,3 +43,7 @@ class TestUpgrade:
     def test_blacklist_drivers_set_on_networking(self, previous_obj_pkl):
         """We always expect Networking.blacklist_drivers to be initialised."""
         assert previous_obj_pkl.distro.networking.blacklist_drivers is None
 +
 +    def test_vendordata_exists(self, previous_obj_pkl):
 +        assert previous_obj_pkl.vendordata2 is None
 +        assert previous_obj_pkl.vendordata2_raw is None
 diff --git a/tests/integration_tests/clouds.py b/tests/integration_tests/clouds.py
 index 9527a413..1d0b9d83 100644
 --- a/tests/integration_tests/clouds.py
 +++ b/tests/integration_tests/clouds.py
@@ -100,14 +100,14 @@ class IntegrationCloud(ABC):
             # Even if we're using the default key, it may still have a
             # different name in the clouds, so we need to set it separately.
             self.cloud_instance.key_pair.name = settings.KEYPAIR_NAME
 -        self._released_image_id = self._get_initial_image()
 +        self.released_image_id = self._get_initial_image()
         self.snapshot_id = None
     @property
     def image_id(self):
         if self.snapshot_id:
             return self.snapshot_id
 -        return self._released_image_id
 +        return self.released_image_id
     def emit_settings_to_log(self) -> None:
         log.info(
 diff --git a/tests/integration_tests/test_upgrade.py b/tests/integration_tests/test_upgrade.py
 index c20cb3c1..48e0691b 100644
 --- a/tests/integration_tests/test_upgrade.py
 +++ b/tests/integration_tests/test_upgrade.py
@@ -1,4 +1,5 @@
 import logging
 +import os
 import pytest
 import time
 from pathlib import Path
@@ -8,6 +9,8 @@ from tests.integration_tests.conftest import (
     get_validated_source,
     session_start_time,
 )
 +from tests.integration_tests.instances import CloudInitSource
 +
 log = logging.getLogger('integration_testing')
@@ -63,7 +66,7 @@ def test_upgrade(session_cloud: IntegrationCloud):
         return  # type checking doesn't understand that skip raises
     launch_kwargs = {
 -        'image_id': session_cloud._get_initial_image(),
 +        'image_id': session_cloud.released_image_id,
     }
     image = ImageSpecification.from_os_image()
@@ -93,6 +96,26 @@ def test_upgrade(session_cloud: IntegrationCloud):
         instance.install_new_cloud_init(source, take_snapshot=False)
         instance.execute('hostname something-else')
         _restart(instance)
 +        assert instance.execute('cloud-init status --wait --long').ok
         _output_to_compare(instance, after_path, netcfg_path)
     log.info('Wrote upgrade test logs to %s and %s', before_path, after_path)
 +
 +
 +@pytest.mark.ci
 +@pytest.mark.ubuntu
 +def test_upgrade_package(session_cloud: IntegrationCloud):
 +    if get_validated_source(session_cloud) != CloudInitSource.DEB_PACKAGE:
 +        not_run_message = 'Test only supports upgrading to build deb'
 +        if os.environ.get('TRAVIS'):
 +            # If this isn't running on CI, we should know
 +            pytest.fail(not_run_message)
 +        else:
 +            pytest.skip(not_run_message)
 +
 +    launch_kwargs = {'image_id': session_cloud.released_image_id}
 +
 +    with session_cloud.launch(launch_kwargs=launch_kwargs) as instance:
 +        instance.install_deb()
 +        instance.restart()
 +        assert instance.execute('cloud-init status --wait --long').ok
 -- 
 2.27.0
--- a/SOURCES/ci-setup.py-adjust-udev-rules-default-path-1513.patch
+++ b/SOURCES/ci-setup.py-adjust-udev-rules-default-path-1513.patch
@ -0,0 +1,57 @@
 From ed7060ac1d5003f70fc3da4d6006a1a958a47b04 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 20 Jun 2022 10:31:14 +0200
 Subject: [PATCH 2/2] setup.py: adjust udev/rules default path (#1513)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 80: setup.py: adjust udev/rules default path (#1513)
 RH-Commit: [2/2] 2cb64b004acbe1b6a30f943b0da51d2d1f2f0d50 (eesposit/cloud-init)
 RH-Bugzilla: 2096269
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 commit 70715125f3af118ae242770e61064c24f41e9a02
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Thu Jun 16 20:39:42 2022 +0200
    setup.py: adjust udev/rules default path (#1513)
    RHEL must put cloudinit .rules files in /usr/lib/udev/rules.d
    This place is a rhel standard and since it is used by all packages
    cannot be modified.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 setup.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/setup.py b/setup.py
 index a9132d2c..fdf27cd7 100755
 --- a/setup.py
 +++ b/setup.py
@@ -302,6 +302,11 @@ data_files = [
     ),
 ]
 if not platform.system().endswith("BSD"):
 +
 +    RULES_PATH = LIB
 +    if os.path.isfile("/etc/redhat-release"):
 +        RULES_PATH = "/usr/lib"
 +
     data_files.extend(
         [
             (
@@ -309,7 +314,7 @@ if not platform.system().endswith("BSD"):
                 ["tools/hook-network-manager"],
             ),
             (ETC + "/dhcp/dhclient-exit-hooks.d/", ["tools/hook-dhclient"]),
 -            (LIB + "/udev/rules.d", [f for f in glob("udev/*.rules")]),
 +            (RULES_PATH + "/udev/rules.d", [f for f in glob("udev/*.rules")]),
             (
                 ETC + "/systemd/system/sshd-keygen@.service.d/",
                 ["systemd/disable-sshd-keygen-if-cloud-init-active.conf"],
 -- 
 2.31.1
--- a/SOURCES/ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
+++ b/SOURCES/ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
@ -1,653 +0,0 @@
 From aeab67600eb2d5e483812620b56ce5fb031a57d6 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 12 Jul 2021 21:47:37 +0200
 Subject: [PATCH] ssh-util: allow cloudinit to merge all ssh keys into a custom
 user file, defined in AuthorizedKeysFile (#937)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 25: ssh-util: allow cloudinit to merge all ssh keys into a custom user file, defined in AuthorizedKeysFile (#937)
 RH-Commit: [1/1] 27bbe94f3b9dd8734865766bd30b06cff83383ab (eesposit/cloud-init)
 RH-Bugzilla: 1862967
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 TESTED: By me and QA
 BREW: 38030830
 Conflicts: upstream patch modifies tests/integration_tests/util.py, that is
 not present in RHEL.
 commit 9b52405c6f0de5e00d5ee9c1d13540425d8f6bf5
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Mon Jul 12 20:21:02 2021 +0200
    ssh-util: allow cloudinit to merge all ssh keys into a custom user file, defined in AuthorizedKeysFile (#937)
    This patch aims to fix LP1911680, by analyzing the files provided
    in sshd_config and merge all keys into an user-specific file. Also
    introduces additional tests to cover this specific case.
    The file is picked by analyzing the path given in AuthorizedKeysFile.
    If it points inside the current user folder (path is /home/user/*), it
    means it is an user-specific file, so we can copy all user-keys there.
    If it contains a %u or %h, it means that there will be a specific
    authorized_keys file for each user, so we can copy all user-keys there.
    If no path points to an user-specific file, for example when only
    /etc/ssh/authorized_keys is given, default to ~/.ssh/authorized_keys.
    Note that if there are more than a single user-specific file, the last
    one will be picked.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Co-authored-by: James Falcon <therealfalcon@gmail.com>
    LP: #1911680
    RHBZ:1862967
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/ssh_util.py                         |  22 +-
 .../assets/keys/id_rsa.test1                  |  38 +++
 .../assets/keys/id_rsa.test1.pub              |   1 +
 .../assets/keys/id_rsa.test2                  |  38 +++
 .../assets/keys/id_rsa.test2.pub              |   1 +
 .../assets/keys/id_rsa.test3                  |  38 +++
 .../assets/keys/id_rsa.test3.pub              |   1 +
 .../modules/test_ssh_keysfile.py              |  85 ++++++
 tests/unittests/test_sshutil.py               | 246 +++++++++++++++++-
 9 files changed, 456 insertions(+), 14 deletions(-)
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test1
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test1.pub
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test2
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test2.pub
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test3
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test3.pub
 create mode 100644 tests/integration_tests/modules/test_ssh_keysfile.py
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index c08042d6..89057262 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -252,13 +252,15 @@ def render_authorizedkeysfile_paths(value, homedir, username):
 def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
     (ssh_dir, pw_ent) = users_ssh_info(username)
     default_authorizedkeys_file = os.path.join(ssh_dir, 'authorized_keys')
 +    user_authorizedkeys_file = default_authorizedkeys_file
     auth_key_fns = []
     with util.SeLinuxGuard(ssh_dir, recursive=True):
         try:
             ssh_cfg = parse_ssh_config_map(sshd_cfg_file)
 +            key_paths = ssh_cfg.get("authorizedkeysfile",
 +                                    "%h/.ssh/authorized_keys")
             auth_key_fns = render_authorizedkeysfile_paths(
 -                ssh_cfg.get("authorizedkeysfile", "%h/.ssh/authorized_keys"),
 -                pw_ent.pw_dir, username)
 +                key_paths, pw_ent.pw_dir, username)
         except (IOError, OSError):
             # Give up and use a default key filename
@@ -267,8 +269,22 @@ def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
                         "config from %r, using 'AuthorizedKeysFile' file "
                         "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
 +    # check if one of the keys is the user's one
 +    for key_path, auth_key_fn in zip(key_paths.split(), auth_key_fns):
 +        if any([
 +            '%u' in key_path,
 +            '%h' in key_path,
 +            auth_key_fn.startswith('{}/'.format(pw_ent.pw_dir))
 +        ]):
 +            user_authorizedkeys_file = auth_key_fn
 +
 +    if user_authorizedkeys_file != default_authorizedkeys_file:
 +        LOG.debug(
 +            "AuthorizedKeysFile has an user-specific authorized_keys, "
 +            "using %s", user_authorizedkeys_file)
 +
     # always store all the keys in the user's private file
 -    return (default_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 +    return (user_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 def setup_user_keys(keys, username, options=None):
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test1 b/tests/integration_tests/assets/keys/id_rsa.test1
 new file mode 100644
 index 00000000..bd4c822e
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test1
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEAtRlG96aJ23URvAgO/bBsuLl+lquc350aSwV98/i8vlvOn5GVcHye
 +t/rXQg4lZ4s0owG3kWyQFY8nvTk+G+UNU8fN0anAzBDi+4MzsejkF9scjTMFmXVrIpICqV
 +3bYQNjPv6r+ubQdkD01du3eB9t5/zl84gtshp0hBdofyz8u1/A25s7fVU67GyI7PdKvaS+
 +yvJSInZnb2e9VQzfJC+qAnN7gUZatBKjdgUtJeiUUeDaVnaS17b0aoT9iBO0sIcQtOTBlY
 +lCjFt1TAMLZ64Hj3SfGZB7Yj0Z+LzFB2IWX1zzsjI68YkYPKOSL/NYhQU9e55kJQ7WnngN
 +HY/2n/A7dNKSFDmgM5c9IWgeZ7fjpsfIYAoJ/CAxFIND+PEHd1gCS6xoEhaUVyh5WH/Xkw
 +Kv1nx4AiZ2BFCE+75kySRLZUJ+5y0r3DU5ktMXeURzVIP7pu0R8DCul+GU+M/+THyWtAEO
 +geaNJ6fYpo2ipDhbmTYt3kk2lMIapRxGBFs+37sdAAAFgGGJssNhibLDAAAAB3NzaC1yc2
 +EAAAGBALUZRvemidt1EbwIDv2wbLi5fparnN+dGksFffP4vL5bzp+RlXB8nrf610IOJWeL
 +NKMBt5FskBWPJ705PhvlDVPHzdGpwMwQ4vuDM7Ho5BfbHI0zBZl1ayKSAqld22EDYz7+q/
 +rm0HZA9NXbt3gfbef85fOILbIadIQXaH8s/LtfwNubO31VOuxsiOz3Sr2kvsryUiJ2Z29n
 +vVUM3yQvqgJze4FGWrQSo3YFLSXolFHg2lZ2kte29GqE/YgTtLCHELTkwZWJQoxbdUwDC2
 +euB490nxmQe2I9Gfi8xQdiFl9c87IyOvGJGDyjki/zWIUFPXueZCUO1p54DR2P9p/wO3TS
 +khQ5oDOXPSFoHme346bHyGAKCfwgMRSDQ/jxB3dYAkusaBIWlFcoeVh/15MCr9Z8eAImdg
 +RQhPu+ZMkkS2VCfuctK9w1OZLTF3lEc1SD+6btEfAwrpfhlPjP/kx8lrQBDoHmjSen2KaN
 +oqQ4W5k2Ld5JNpTCGqUcRgRbPt+7HQAAAAMBAAEAAAGBAJJCTOd70AC2ptEGbR0EHHqADT
 +Wgefy7A94tHFEqxTy0JscGq/uCGimaY7kMdbcPXT59B4VieWeAC2cuUPP0ZHQSfS5ke7oT
 +tU3N47U+0uBVbNS4rUAH7bOo2o9wptnOA5x/z+O+AARRZ6tEXQOd1oSy4gByLf2Wkh2QTi
 +vP6Hln1vlFgKEzcXg6G8fN3MYWxKRhWmZM3DLERMvorlqqSBLcs5VvfZfLKcsKWTExioAq
 +KgwEjYm8T9+rcpsw1xBus3j9k7wCI1Sus6PCDjq0pcYKLMYM7p8ygnU2tRYrOztdIxgWRA
 +w/1oenm1Mqq2tV5xJcBCwCLOGe6SFwkIRywOYc57j5McH98Xhhg9cViyyBdXy/baF0mro+
 +qPhOsWDxqwD4VKZ9UmQ6O8kPNKcc7QcIpFJhcO0g9zbp/MT0KueaWYrTKs8y4lUkTT7Xz6
 ++MzlR122/JwlAbBo6Y2kWtB+y+XwBZ0BfyJsm2czDhKm7OI5KfuBNhq0tFfKwOlYBq4QAA
 +AMAyvUof1R8LLISkdO3EFTKn5RGNkPPoBJmGs6LwvU7NSjjLj/wPQe4jsIBc585tvbrddp
 +60h72HgkZ5tqOfdeBYOKqX0qQQBHUEvI6M+NeQTQRev8bCHMLXQ21vzpClnrwNzlja359E
 +uTRfiPRwIlyPLhOUiClBDSAnBI9h82Hkk3zzsQ/xGfsPB7iOjRbW69bMRSVCRpeweCVmWC
 +77DTsEOq69V2TdljhQNIXE5OcOWonIlfgPiI74cdd+dLhzc/AAAADBAO1/JXd2kYiRyNkZ
 +aXTLcwiSgBQIYbobqVP3OEtTclr0P1JAvby3Y4cCaEhkenx+fBqgXAku5lKM+U1Q9AEsMk
 +cjIhaDpb43rU7GPjMn4zHwgGsEKd5pC1yIQ2PlK+cHanAdsDjIg+6RR+fuvid/mBeBOYXb
 +Py0sa3HyekLJmCdx4UEyNASoiNaGFLQVAqo+RACsXy6VMxFH5dqDYlvwrfUQLwxJmse9Vb
 +GEuuPAsklNugZqssC2XOIujFVUpslduQAAAMEAwzVHQVtsc3icCSzEAARpDTUdTbI29OhB
 +/FMBnjzS9/3SWfLuBOSm9heNCHs2jdGNb8cPdKZuY7S9Fx6KuVUPyTbSSYkjj0F4fTeC9g
 +0ym4p4UWYdF67WSWwLORkaG8K0d+G/CXkz8hvKUg6gcZWKBHAE1ROrHu1nsc8v7mkiKq4I
 +bnTw5Q9TgjbWcQWtgPq0wXyyl/K8S1SFdkMCTOHDD0RQ+jTV2WNGVwFTodIRHenX+Rw2g4
 +CHbTWbsFrHR1qFAAAACmphbWVzQG5ld3Q=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test1.pub b/tests/integration_tests/assets/keys/id_rsa.test1.pub
 new file mode 100644
 index 00000000..3d2e26e1
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test1.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC1GUb3ponbdRG8CA79sGy4uX6Wq5zfnRpLBX3z+Ly+W86fkZVwfJ63+tdCDiVnizSjAbeRbJAVjye9OT4b5Q1Tx83RqcDMEOL7gzOx6OQX2xyNMwWZdWsikgKpXdthA2M+/qv65tB2QPTV27d4H23n/OXziC2yGnSEF2h/LPy7X8Dbmzt9VTrsbIjs90q9pL7K8lIidmdvZ71VDN8kL6oCc3uBRlq0EqN2BS0l6JRR4NpWdpLXtvRqhP2IE7SwhxC05MGViUKMW3VMAwtnrgePdJ8ZkHtiPRn4vMUHYhZfXPOyMjrxiRg8o5Iv81iFBT17nmQlDtaeeA0dj/af8Dt00pIUOaAzlz0haB5nt+Omx8hgCgn8IDEUg0P48Qd3WAJLrGgSFpRXKHlYf9eTAq/WfHgCJnYEUIT7vmTJJEtlQn7nLSvcNTmS0xd5RHNUg/um7RHwMK6X4ZT4z/5MfJa0AQ6B5o0np9imjaKkOFuZNi3eSTaUwhqlHEYEWz7fux0= test1@host
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test2 b/tests/integration_tests/assets/keys/id_rsa.test2
 new file mode 100644
 index 00000000..5854d901
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test2
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEAvK50D2PWOc4ikyHVRJS6tDhqzjL5cKiivID4p1X8BYCVw83XAEGO
 +LnItUyVXHNADlh6fpVq1NY6A2JVtygoPF6ZFx8ph7IWMmnhDdnxLLyGsbhd1M1tiXJD/R+
 +3WnGHRJ4PKrQavMLgqHRrieV3QVVfjFSeo6jX/4TruP6ZmvITMZWJrXaGphxJ/pPykEdkO
 +i8AmKU9FNviojyPS2nNtj9B/635IdgWvrd7Vf5Ycsw9MR55LWSidwa856RH62Yl6LpEGTH
 +m1lJiMk1u88JPSqvohhaUkLKkFpcQwcB0m76W1KOyllJsmX8bNXrlZsI+WiiYI7Xl5vQm2
 +17DEuNeavtPAtDMxu8HmTg2UJ55Naxehbfe2lx2k5kYGGw3i1O1OVN2pZ2/OB71LucYd/5
 +qxPaz03wswcGOJYGPkNc40vdES/Scc7Yt8HsnZuzqkyOgzn0HiUCzoYUYLYTpLf+yGmwxS
 +yAEY056aOfkCsboKHOKiOmlJxNaZZFQkX1evep4DAAAFgC7HMbUuxzG1AAAAB3NzaC1yc2
 +EAAAGBALyudA9j1jnOIpMh1USUurQ4as4y+XCooryA+KdV/AWAlcPN1wBBji5yLVMlVxzQ
 +A5Yen6VatTWOgNiVbcoKDxemRcfKYeyFjJp4Q3Z8Sy8hrG4XdTNbYlyQ/0ft1pxh0SeDyq
 +0GrzC4Kh0a4nld0FVX4xUnqOo1/+E67j+mZryEzGVia12hqYcSf6T8pBHZDovAJilPRTb4
 +qI8j0tpzbY/Qf+t+SHYFr63e1X+WHLMPTEeeS1koncGvOekR+tmJei6RBkx5tZSYjJNbvP
 +CT0qr6IYWlJCypBaXEMHAdJu+ltSjspZSbJl/GzV65WbCPloomCO15eb0JttewxLjXmr7T
 +wLQzMbvB5k4NlCeeTWsXoW33tpcdpOZGBhsN4tTtTlTdqWdvzge9S7nGHf+asT2s9N8LMH
 +BjiWBj5DXONL3REv0nHO2LfB7J2bs6pMjoM59B4lAs6GFGC2E6S3/shpsMUsgBGNOemjn5
 +ArG6ChziojppScTWmWRUJF9Xr3qeAwAAAAMBAAEAAAGASj/kkEHbhbfmxzujL2/P4Sfqb+
 +aDXqAeGkwujbs6h/fH99vC5ejmSMTJrVSeaUo6fxLiBDIj6UWA0rpLEBzRP59BCpRL4MXV
 +RNxav/+9nniD4Hb+ug0WMhMlQmsH71ZW9lPYqCpfOq7ec8GmqdgPKeaCCEspH7HMVhfYtd
 +eHylwAC02lrpz1l5/h900sS5G9NaWR3uPA+xbzThDs4uZVkSidjlCNt1QZhDSSk7jA5n34
 +qJ5UTGu9WQDZqyxWKND+RIyQuFAPGQyoyCC1FayHO2sEhT5qHuumL14Mn81XpzoXFoKyql
 +rhBDe+pHhKArBYt92Evch0k1ABKblFxtxLXcvk4Fs7pHi+8k4+Cnazej2kcsu1kURlMZJB
 +w2QT/8BV4uImbH05LtyscQuwGzpIoxqrnHrvg5VbohStmhoOjYybzqqW3/M0qhkn5JgTiy
 +dJcHRJisRnAcmbmEchYtLDi6RW1e022H4I9AFXQqyr5HylBq6ugtWcFCsrcX8ibZ8xAAAA
 +wQCAOPgwae6yZLkrYzRfbxZtGKNmhpI0EtNSDCHYuQQapFZJe7EFENs/VAaIiiut0yajGj
 +c3aoKcwGIoT8TUM8E3GSNW6+WidUOC7H6W+/6N2OYZHRBACGz820xO+UBCl2oSk+dLBlfr
 +IQzBGUWn5uVYCs0/2nxfCdFyHtMK8dMF/ypbdG+o1rXz5y9b7PVG6Mn+o1Rjsdkq7VERmy
 +Pukd8hwATOIJqoKl3TuFyBeYFLqe+0e7uTeswQFw17PF31VjAAAADBAOpJRQb8c6qWqsvv
 +vkve0uMuL0DfWW0G6+SxjPLcV6aTWL5xu0Grd8uBxDkkHU/CDrAwpchXyuLsvbw21Eje/u
 +U5k9nLEscWZwcX7odxlK+EfAY2Bf5+Hd9bH5HMzTRJH8KkWK1EppOLPyiDxz4LZGzPLVyv
 +/1PgSuvXkSWk1KIE4SvSemyxGX2tPVI6uO+URqevfnPOS1tMB7BMQlgkR6eh4bugx9UYx9
 +mwlXonNa4dN0iQxZ7N4rKFBbT/uyB2bQAAAMEAzisnkD8k9Tn8uyhxpWLHwb03X4ZUUHDV
 +zu15e4a8dZ+mM8nHO986913Xz5JujlJKkGwFTvgWkIiR2zqTEauZHARH7gANpaweTm6lPd
 +E4p2S0M3ulY7xtp9lCFIrDhMPPkGq8SFZB6qhgucHcZSRLq6ZDou3S2IdNOzDTpBtkhRCS
 +0zFcdTLh3zZweoy8HGbW36bwB6s1CIL76Pd4F64i0Ms9CCCU6b+E5ArFhYQIsXiDbgHWbD
 +tZRSm2GEgnDGAvAAAACmphbWVzQG5ld3Q=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test2.pub b/tests/integration_tests/assets/keys/id_rsa.test2.pub
 new file mode 100644
 index 00000000..f3831a57
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test2.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8rnQPY9Y5ziKTIdVElLq0OGrOMvlwqKK8gPinVfwFgJXDzdcAQY4uci1TJVcc0AOWHp+lWrU1joDYlW3KCg8XpkXHymHshYyaeEN2fEsvIaxuF3UzW2JckP9H7dacYdEng8qtBq8wuCodGuJ5XdBVV+MVJ6jqNf/hOu4/pma8hMxlYmtdoamHEn+k/KQR2Q6LwCYpT0U2+KiPI9Lac22P0H/rfkh2Ba+t3tV/lhyzD0xHnktZKJ3BrznpEfrZiXoukQZMebWUmIyTW7zwk9Kq+iGFpSQsqQWlxDBwHSbvpbUo7KWUmyZfxs1euVmwj5aKJgjteXm9CbbXsMS415q+08C0MzG7weZODZQnnk1rF6Ft97aXHaTmRgYbDeLU7U5U3alnb84HvUu5xh3/mrE9rPTfCzBwY4lgY+Q1zjS90RL9Jxzti3weydm7OqTI6DOfQeJQLOhhRgthOkt/7IabDFLIARjTnpo5+QKxugoc4qI6aUnE1plkVCRfV696ngM= test2@host
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test3 b/tests/integration_tests/assets/keys/id_rsa.test3
 new file mode 100644
 index 00000000..2596c762
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test3
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEApPG4MdkYQKD57/qreFrh9GRC22y66qZOWZWRjC887rrbvBzO69hV
 +yJpTIXleJEvpWiHYcjMR5G6NNFsnNtZ4fxDqmSc4vcFj53JsE/XNqLKq6psXadCb5vkNpG
 +bxA+Z5bJlzJ969PgJIIEbgc86sei4kgR2MuPWqtZbY5GkpNCTqWuLYeFK+14oFruA2nyWH
 +9MOIRDHK/d597psHy+LTMtymO7ZPhO571abKw6jvvwiSeDxVE9kV7KAQIuM9/S3gftvgQQ
 +ron3GL34pgmIabdSGdbfHqGDooryJhlbquJZELBN236KgRNTCAjVvUzjjQr1eRP3xssGwV
 +O6ECBGCQLl/aYogAgtwnwj9iXqtfiLK3EwlgjquU4+JQ0CVtLhG3gIZB+qoMThco0pmHTr
 +jtfQCwrztsBBFunSa2/CstuV1mQ5O5ZrZ6ACo9yPRBNkns6+CiKdtMtCtzi3k2RDz9jpYm
 +Pcak03Lr7IkdC1Tp6+jA+//yPHSO1o4CqW89IQzNAAAFgEUd7lZFHe5WAAAAB3NzaC1yc2
 +EAAAGBAKTxuDHZGECg+e/6q3ha4fRkQttsuuqmTlmVkYwvPO6627wczuvYVciaUyF5XiRL
 +6Voh2HIzEeRujTRbJzbWeH8Q6pknOL3BY+dybBP1zaiyquqbF2nQm+b5DaRm8QPmeWyZcy
 +fevT4CSCBG4HPOrHouJIEdjLj1qrWW2ORpKTQk6lri2HhSvteKBa7gNp8lh/TDiEQxyv3e
 +fe6bB8vi0zLcpju2T4Tue9WmysOo778Ikng8VRPZFeygECLjPf0t4H7b4EEK6J9xi9+KYJ
 +iGm3UhnW3x6hg6KK8iYZW6riWRCwTdt+ioETUwgI1b1M440K9XkT98bLBsFTuhAgRgkC5f
 +2mKIAILcJ8I/Yl6rX4iytxMJYI6rlOPiUNAlbS4Rt4CGQfqqDE4XKNKZh0647X0AsK87bA
 +QRbp0mtvwrLbldZkOTuWa2egAqPcj0QTZJ7OvgoinbTLQrc4t5NkQ8/Y6WJj3GpNNy6+yJ
 +HQtU6evowPv/8jx0jtaOAqlvPSEMzQAAAAMBAAEAAAGAGaqbdPZJNdVWzyb8g6/wtSzc0n
 +Qq6dSTIJGLonq/So69HpqFAGIbhymsger24UMGvsXBfpO/1wH06w68HWZmPa+OMeLOi4iK
 +WTuO4dQ/+l5DBlq32/lgKSLcIpb6LhcxEdsW9j9Mx1dnjc45owun/yMq/wRwH1/q/nLIsV
 +JD3R9ZcGcYNDD8DWIm3D17gmw+qbG7hJES+0oh4n0xS2KyZpm7LFOEMDVEA8z+hE/HbryQ
 +vjD1NC91n+qQWD1wKfN3WZDRwip3z1I5VHMpvXrA/spHpa9gzHK5qXNmZSz3/dfA1zHjCR
 +2dHjJnrIUH8nyPfw8t+COC+sQBL3Nr0KUWEFPRM08cOcQm4ctzg17aDIZBONjlZGKlReR8
 +1zfAw84Q70q2spLWLBLXSFblHkaOfijEbejIbaz2UUEQT27WD7RHAORdQlkx7eitk66T9d
 +DzIq/cpYhm5Fs8KZsh3PLldp9nsHbD2Oa9J9LJyI4ryuIW0mVwRdvPSiiYi3K+mDCpAAAA
 +wBe+ugEEJ+V7orb1f4Zez0Bd4FNkEc52WZL4CWbaCtM+ZBg5KnQ6xW14JdC8IS9cNi/I5P
 +yLsBvG4bWPLGgQruuKY6oLueD6BFnKjqF6ACUCiSQldh4BAW1nYc2U48+FFvo3ZQyudFSy
 +QEFlhHmcaNMDo0AIJY5Xnq2BG3nEX7AqdtZ8hhenHwLCRQJatDwSYBHDpSDdh9vpTnGp/2
 +0jBz25Ko4UANzvSAc3sA4yN3jfpoM366TgdNf8x3g1v7yljQAAAMEA0HSQjzH5nhEwB58k
 +mYYxnBYp1wb86zIuVhAyjZaeinvBQSTmLow8sXIHcCVuD3CgBezlU2SX5d9YuvRU9rcthi
 +uzn4wWnbnzYy4SwzkMJXchUAkumFVD8Hq5TNPh2Z+033rLLE08EhYypSeVpuzdpFoStaS9
 +3DUZA2bR/zLZI9MOVZRUcYImNegqIjOYHY8Sbj3/0QPV6+WpUJFMPvvedWhfaOsRMTA6nr
 +VLG4pxkrieVl0UtuRGbzD/exXhXVi7AAAAwQDKkJj4ez/+KZFYlZQKiV0BrfUFcgS6ElFM
 +2CZIEagCtu8eedrwkNqx2FUX33uxdvUTr4c9I3NvWeEEGTB9pgD4lh1x/nxfuhyGXtimFM
 +GnznGV9oyz0DmKlKiKSEGwWf5G+/NiiCwwVJ7wsQQm7TqNtkQ9b8MhWWXC7xlXKUs7dmTa
 +e8AqAndCCMEnbS1UQFO/R5PNcZXkFWDggLQ/eWRYKlrXgdnUgH6h0saOcViKpNJBUXb3+x
 +eauhOY52PS/BcAAAAKamFtZXNAbmV3dAE=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test3.pub b/tests/integration_tests/assets/keys/id_rsa.test3.pub
 new file mode 100644
 index 00000000..057db632
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test3.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCk8bgx2RhAoPnv+qt4WuH0ZELbbLrqpk5ZlZGMLzzuutu8HM7r2FXImlMheV4kS+laIdhyMxHkbo00Wyc21nh/EOqZJzi9wWPncmwT9c2osqrqmxdp0Jvm+Q2kZvED5nlsmXMn3r0+AkggRuBzzqx6LiSBHYy49aq1ltjkaSk0JOpa4th4Ur7XigWu4DafJYf0w4hEMcr93n3umwfL4tMy3KY7tk+E7nvVpsrDqO+/CJJ4PFUT2RXsoBAi4z39LeB+2+BBCuifcYvfimCYhpt1IZ1t8eoYOiivImGVuq4lkQsE3bfoqBE1MICNW9TOONCvV5E/fGywbBU7oQIEYJAuX9piiACC3CfCP2Jeq1+IsrcTCWCOq5Tj4lDQJW0uEbeAhkH6qgxOFyjSmYdOuO19ALCvO2wEEW6dJrb8Ky25XWZDk7lmtnoAKj3I9EE2Sezr4KIp20y0K3OLeTZEPP2OliY9xqTTcuvsiR0LVOnr6MD7//I8dI7WjgKpbz0hDM0= test3@host
 diff --git a/tests/integration_tests/modules/test_ssh_keysfile.py b/tests/integration_tests/modules/test_ssh_keysfile.py
 new file mode 100644
 index 00000000..f82d7649
 --- /dev/null
 +++ b/tests/integration_tests/modules/test_ssh_keysfile.py
@@ -0,0 +1,85 @@
 +import paramiko
 +import pytest
 +from io import StringIO
 +from paramiko.ssh_exception import SSHException
 +
 +from tests.integration_tests.instances import IntegrationInstance
 +from tests.integration_tests.util import get_test_rsa_keypair
 +
 +TEST_USER1_KEYS = get_test_rsa_keypair('test1')
 +TEST_USER2_KEYS = get_test_rsa_keypair('test2')
 +TEST_DEFAULT_KEYS = get_test_rsa_keypair('test3')
 +
 +USERDATA = """\
 +#cloud-config
 +bootcmd:
 + - sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile /etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' /etc/ssh/sshd_config
 +ssh_authorized_keys:
 + - {default}
 +users:
 +- default
 +- name: test_user1
 +  ssh_authorized_keys:
 +    - {user1}
 +- name: test_user2
 +  ssh_authorized_keys:
 +    - {user2}
 +""".format(  # noqa: E501
 +    default=TEST_DEFAULT_KEYS.public_key,
 +    user1=TEST_USER1_KEYS.public_key,
 +    user2=TEST_USER2_KEYS.public_key,
 +)
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(USERDATA)
 +def test_authorized_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 +    ]
 +
 +    for user, filename, keys in expected_keys:
 +        contents = client.read_from_file(filename)
 +        if user in ['ubuntu', 'root']:
 +            # Our personal public key gets added by pycloudlib
 +            lines = contents.split('\n')
 +            assert len(lines) == 2
 +            assert keys.public_key.strip() in contents
 +        else:
 +            assert contents.strip() == keys.public_key.strip()
 +
 +        # Ensure we can actually connect
 +        ssh = paramiko.SSHClient()
 +        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
 +        paramiko_key = paramiko.RSAKey.from_private_key(StringIO(
 +            keys.private_key))
 +
 +        # Will fail with AuthenticationException if
 +        # we cannot connect
 +        ssh.connect(
 +            client.instance.ip,
 +            username=user,
 +            pkey=paramiko_key,
 +            look_for_keys=False,
 +            allow_agent=False,
 +        )
 +
 +        # Ensure other uses can't connect using our key
 +        other_users = [u[0] for u in expected_keys if u[2] != keys]
 +        for other_user in other_users:
 +            with pytest.raises(SSHException):
 +                print('trying to connect as {} with key from {}'.format(
 +                    other_user, user))
 +                ssh.connect(
 +                    client.instance.ip,
 +                    username=other_user,
 +                    pkey=paramiko_key,
 +                    look_for_keys=False,
 +                    allow_agent=False,
 +                )
 diff --git a/tests/unittests/test_sshutil.py b/tests/unittests/test_sshutil.py
 index fd1d1bac..bcb8044f 100644
 --- a/tests/unittests/test_sshutil.py
 +++ b/tests/unittests/test_sshutil.py
@@ -570,20 +570,33 @@ class TestBasicAuthorizedKeyParse(test_helpers.CiTestCase):
             ssh_util.render_authorizedkeysfile_paths(
                 "%h/.keys", "/homedirs/bobby", "bobby"))
 +    def test_all(self):
 +        self.assertEqual(
 +            ["/homedirs/bobby/.keys", "/homedirs/bobby/.secret/keys",
 +             "/keys/path1", "/opt/bobby/keys"],
 +            ssh_util.render_authorizedkeysfile_paths(
 +                "%h/.keys .secret/keys /keys/path1 /opt/%u/keys",
 +                "/homedirs/bobby", "bobby"))
 +
 class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
     @patch("cloudinit.ssh_util.pwd.getpwnam")
     def test_multiple_authorizedkeys_file_order1(self, m_getpwnam):
 -        fpw = FakePwEnt(pw_name='bobby', pw_dir='/home2/bobby')
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
         m_getpwnam.return_value = fpw
 -        authorized_keys = self.tmp_path('authorized_keys')
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
         util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 -        user_keys = self.tmp_path('user_keys')
 +        # /tmp/home2/bobby/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
         util.write_file(user_keys, VALID_CONTENT['dsa'])
 -        sshd_config = self.tmp_path('sshd_config')
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
         util.write_file(
             sshd_config,
             "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
@@ -593,33 +606,244 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
             fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
 +        self.assertEqual(user_keys, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
     @patch("cloudinit.ssh_util.pwd.getpwnam")
     def test_multiple_authorizedkeys_file_order2(self, m_getpwnam):
 -        fpw = FakePwEnt(pw_name='suzie', pw_dir='/home/suzie')
 +        fpw = FakePwEnt(pw_name='suzie', pw_dir='/tmp/home/suzie')
         m_getpwnam.return_value = fpw
 -        authorized_keys = self.tmp_path('authorized_keys')
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home/suzie/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
         util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 -        user_keys = self.tmp_path('user_keys')
 +        # /tmp/home/suzie/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
         util.write_file(user_keys, VALID_CONTENT['dsa'])
 -        sshd_config = self.tmp_path('sshd_config')
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
         util.write_file(
             sshd_config,
 -            "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
 +            "AuthorizedKeysFile %s %s" % (user_keys, authorized_keys)
         )
         (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 -            fpw.pw_name, sshd_config
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_local_global(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +
 +        # /tmp/home2/bobby/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %s %s" % (authorized_keys_global,
 +                                             user_keys, authorized_keys)
 +        )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_local_global2(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +
 +        # /tmp/home2/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %s %s" % (authorized_keys_global,
 +                                             authorized_keys, user_keys)
 +        )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_global(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +
 +        # /tmp/etc/ssh/authorized_keys = rsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['rsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config')
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s" % (authorized_keys_global)
         )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
         self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_multiuser(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +        # /tmp/home2/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +        # /tmp/home2/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        fpw2 = FakePwEnt(pw_name='suzie', pw_dir='/tmp/home/suzie')
 +        user_ssh_folder = "%s/.ssh" % fpw2.pw_dir
 +        # /tmp/home/suzie/.ssh/authorized_keys2 = ssh-xmss@openssh.com
 +        authorized_keys2 = self.tmp_path('authorized_keys2',
 +                                         dir=user_ssh_folder)
 +        util.write_file(authorized_keys2,
 +                        VALID_CONTENT['ssh-xmss@openssh.com'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys2',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %%h/.ssh/authorized_keys2 %s" %
 +            (authorized_keys_global, user_keys)
 +        )
 +
 +        # process first user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['ssh-xmss@openssh.com'] in content)
 +
 +        m_getpwnam.return_value = fpw2
 +        # process second user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw2.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys2, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['ssh-xmss@openssh.com'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['rsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_multiuser2(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +        # /tmp/home/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +        # /tmp/home/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        fpw2 = FakePwEnt(pw_name='badguy', pw_dir='/tmp/home/badguy')
 +        user_ssh_folder = "%s/.ssh" % fpw2.pw_dir
 +        # /tmp/home/badguy/home/bobby = ""
 +        authorized_keys2 = self.tmp_path('home/bobby', dir="/tmp/home/badguy")
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys2',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %%h/.ssh/authorized_keys2 %s %s" %
 +            (authorized_keys_global, user_keys, authorized_keys2)
 +        )
 +
 +        # process first user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +        m_getpwnam.return_value = fpw2
 +        # process second user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw2.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        # badguy should not take the key from the other user!
 +        self.assertEqual(authorized_keys2, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['rsa'] in content)
 # vi: ts=4 expandtab
 -- 
 2.27.0
--- a/SOURCES/ci-write-passwords-only-to-serial-console-lock-down-clo.patch
+++ b/SOURCES/ci-write-passwords-only-to-serial-console-lock-down-clo.patch
@ -1,369 +0,0 @@
 From 769b9f8c9b1ecc294a197575108ae7cb54ad7f4b Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Mon, 5 Jul 2021 14:13:45 +0200
 Subject: [PATCH] write passwords only to serial console, lock down
 cloud-init-output.log (#847)
 RH-Author: Eduardo Otubo <otubo@redhat.com>
 RH-MergeRequest: 21: write passwords only to serial console, lock down cloud-init-output.log (#847)
 RH-Commit: [1/1] 8f30f2b7d0d6f9dca19994dbd0827b44e998f238 (otubo/cloud-init)
 RH-Bugzilla: 1945891
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 commit b794d426b9ab43ea9d6371477466070d86e10668
 Author: Daniel Watkins <oddbloke@ubuntu.com>
 Date:   Fri Mar 19 10:06:42 2021 -0400
    write passwords only to serial console, lock down cloud-init-output.log (#847)
    Prior to this commit, when a user specified configuration which would
    generate random passwords for users, cloud-init would cause those
    passwords to be written to the serial console by emitting them on
    stderr.  In the default configuration, any stdout or stderr emitted by
    cloud-init is also written to `/var/log/cloud-init-output.log`.  This
    file is world-readable, meaning that those randomly-generated passwords
    were available to be read by any user with access to the system.  This
    presents an obvious security issue.
    This commit responds to this issue in two ways:
    * We address the direct issue by moving from writing the passwords to
      sys.stderr to writing them directly to /dev/console (via
      util.multi_log); this means that the passwords will never end up in
      cloud-init-output.log
    * To avoid future issues like this, we also modify the logging code so
      that any files created in a log sink subprocess will only be
      owner/group readable and, if it exists, will be owned by the adm
      group.  This results in `/var/log/cloud-init-output.log` no longer
      being world-readable, meaning that if there are other parts of the
      codebase that are emitting sensitive data intended for the serial
      console, that data is no longer available to all users of the system.
    LP: #1918303
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/config/cc_set_passwords.py          |  5 +-
 cloudinit/config/tests/test_set_passwords.py  | 40 +++++++++----
 cloudinit/tests/test_util.py                  | 56 +++++++++++++++++++
 cloudinit/util.py                             | 38 +++++++++++--
 .../modules/test_set_password.py              | 24 ++++++++
 tests/integration_tests/test_logging.py       | 22 ++++++++
 tests/unittests/test_util.py                  |  4 ++
 7 files changed, 173 insertions(+), 16 deletions(-)
 create mode 100644 tests/integration_tests/test_logging.py
 diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
 index d6b5682d..433de751 100755
 --- a/cloudinit/config/cc_set_passwords.py
 +++ b/cloudinit/config/cc_set_passwords.py
@@ -78,7 +78,6 @@ password.
 """
 import re
 -import sys
 from cloudinit.distros import ug_util
 from cloudinit import log as logging
@@ -214,7 +213,9 @@ def handle(_name, cfg, cloud, log, args):
         if len(randlist):
             blurb = ("Set the following 'random' passwords\n",
                      '\n'.join(randlist))
 -            sys.stderr.write("%s\n%s\n" % blurb)
 +            util.multi_log(
 +                "%s\n%s\n" % blurb, stderr=False, fallback_to_stdout=False
 +            )
         if expire:
             expired_users = []
 diff --git a/cloudinit/config/tests/test_set_passwords.py b/cloudinit/config/tests/test_set_passwords.py
 index daa1ef51..bbe2ee8f 100644
 --- a/cloudinit/config/tests/test_set_passwords.py
 +++ b/cloudinit/config/tests/test_set_passwords.py
@@ -74,10 +74,6 @@ class TestSetPasswordsHandle(CiTestCase):
     with_logs = True
 -    def setUp(self):
 -        super(TestSetPasswordsHandle, self).setUp()
 -        self.add_patch('cloudinit.config.cc_set_passwords.sys.stderr', 'm_err')
 -
     def test_handle_on_empty_config(self, *args):
         """handle logs that no password has changed when config is empty."""
         cloud = self.tmp_cloud(distro='ubuntu')
@@ -129,10 +125,12 @@ class TestSetPasswordsHandle(CiTestCase):
             mock.call(['pw', 'usermod', 'ubuntu', '-p', '01-Jan-1970'])],
             m_subp.call_args_list)
 +    @mock.patch(MODPATH + "util.multi_log")
     @mock.patch(MODPATH + "util.is_BSD")
     @mock.patch(MODPATH + "subp.subp")
 -    def test_handle_on_chpasswd_list_creates_random_passwords(self, m_subp,
 -                                                              m_is_bsd):
 +    def test_handle_on_chpasswd_list_creates_random_passwords(
 +        self, m_subp, m_is_bsd, m_multi_log
 +    ):
         """handle parses command set random passwords."""
         m_is_bsd.return_value = False
         cloud = self.tmp_cloud(distro='ubuntu')
@@ -146,10 +144,32 @@ class TestSetPasswordsHandle(CiTestCase):
         self.assertIn(
             'DEBUG: Handling input for chpasswd as list.',
             self.logs.getvalue())
 -        self.assertNotEqual(
 -            [mock.call(['chpasswd'],
 -             '\n'.join(valid_random_pwds) + '\n')],
 -            m_subp.call_args_list)
 +
 +        self.assertEqual(1, m_subp.call_count)
 +        args, _kwargs = m_subp.call_args
 +        self.assertEqual(["chpasswd"], args[0])
 +
 +        stdin = args[1]
 +        user_pass = {
 +            user: password
 +            for user, password
 +            in (line.split(":") for line in stdin.splitlines())
 +        }
 +
 +        self.assertEqual(1, m_multi_log.call_count)
 +        self.assertEqual(
 +            mock.call(mock.ANY, stderr=False, fallback_to_stdout=False),
 +            m_multi_log.call_args
 +        )
 +
 +        self.assertEqual(set(["root", "ubuntu"]), set(user_pass.keys()))
 +        written_lines = m_multi_log.call_args[0][0].splitlines()
 +        for password in user_pass.values():
 +            for line in written_lines:
 +                if password in line:
 +                    break
 +            else:
 +                self.fail("Password not emitted to console")
 # vi: ts=4 expandtab
 diff --git a/cloudinit/tests/test_util.py b/cloudinit/tests/test_util.py
 index b7a302f1..e811917e 100644
 --- a/cloudinit/tests/test_util.py
 +++ b/cloudinit/tests/test_util.py
@@ -851,4 +851,60 @@ class TestEnsureFile:
         assert "ab" == kwargs["omode"]
 +@mock.patch("cloudinit.util.grp.getgrnam")
 +@mock.patch("cloudinit.util.os.setgid")
 +@mock.patch("cloudinit.util.os.umask")
 +class TestRedirectOutputPreexecFn:
 +    """This tests specifically the preexec_fn used in redirect_output."""
 +
 +    @pytest.fixture(params=["outfmt", "errfmt"])
 +    def preexec_fn(self, request):
 +        """A fixture to gather the preexec_fn used by redirect_output.
 +
 +        This enables simpler direct testing of it, and parameterises any tests
 +        using it to cover both the stdout and stderr code paths.
 +        """
 +        test_string = "| piped output to invoke subprocess"
 +        if request.param == "outfmt":
 +            args = (test_string, None)
 +        elif request.param == "errfmt":
 +            args = (None, test_string)
 +        with mock.patch("cloudinit.util.subprocess.Popen") as m_popen:
 +            util.redirect_output(*args)
 +
 +        assert 1 == m_popen.call_count
 +        _args, kwargs = m_popen.call_args
 +        assert "preexec_fn" in kwargs, "preexec_fn not passed to Popen"
 +        return kwargs["preexec_fn"]
 +
 +    def test_preexec_fn_sets_umask(
 +        self, m_os_umask, _m_setgid, _m_getgrnam, preexec_fn
 +    ):
 +        """preexec_fn should set a mask that avoids world-readable files."""
 +        preexec_fn()
 +
 +        assert [mock.call(0o037)] == m_os_umask.call_args_list
 +
 +    def test_preexec_fn_sets_group_id_if_adm_group_present(
 +        self, _m_os_umask, m_setgid, m_getgrnam, preexec_fn
 +    ):
 +        """We should setgrp to adm if present, so files are owned by them."""
 +        fake_group = mock.Mock(gr_gid=mock.sentinel.gr_gid)
 +        m_getgrnam.return_value = fake_group
 +
 +        preexec_fn()
 +
 +        assert [mock.call("adm")] == m_getgrnam.call_args_list
 +        assert [mock.call(mock.sentinel.gr_gid)] == m_setgid.call_args_list
 +
 +    def test_preexec_fn_handles_absent_adm_group_gracefully(
 +        self, _m_os_umask, m_setgid, m_getgrnam, preexec_fn
 +    ):
 +        """We should handle an absent adm group gracefully."""
 +        m_getgrnam.side_effect = KeyError("getgrnam(): name not found: 'adm'")
 +
 +        preexec_fn()
 +
 +        assert 0 == m_setgid.call_count
 +
 # vi: ts=4 expandtab
 diff --git a/cloudinit/util.py b/cloudinit/util.py
 index 769f3425..4e0a72db 100644
 --- a/cloudinit/util.py
 +++ b/cloudinit/util.py
@@ -359,7 +359,7 @@ def find_modules(root_dir):
 def multi_log(text, console=True, stderr=True,
 -              log=None, log_level=logging.DEBUG):
 +              log=None, log_level=logging.DEBUG, fallback_to_stdout=True):
     if stderr:
         sys.stderr.write(text)
     if console:
@@ -368,7 +368,7 @@ def multi_log(text, console=True, stderr=True,
             with open(conpath, 'w') as wfh:
                 wfh.write(text)
                 wfh.flush()
 -        else:
 +        elif fallback_to_stdout:
             # A container may lack /dev/console (arguably a container bug).  If
             # it does not exist, then write output to stdout.  this will result
             # in duplicate stderr and stdout messages if stderr was True.
@@ -623,6 +623,26 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
     if not o_err:
         o_err = sys.stderr
 +    # pylint: disable=subprocess-popen-preexec-fn
 +    def set_subprocess_umask_and_gid():
 +        """Reconfigure umask and group ID to create output files securely.
 +
 +        This is passed to subprocess.Popen as preexec_fn, so it is executed in
 +        the context of the newly-created process.  It:
 +
 +        * sets the umask of the process so created files aren't world-readable
 +        * if an adm group exists in the system, sets that as the process' GID
 +          (so that the created file(s) are owned by root:adm)
 +        """
 +        os.umask(0o037)
 +        try:
 +            group_id = grp.getgrnam("adm").gr_gid
 +        except KeyError:
 +            # No adm group, don't set a group
 +            pass
 +        else:
 +            os.setgid(group_id)
 +
     if outfmt:
         LOG.debug("Redirecting %s to %s", o_out, outfmt)
         (mode, arg) = outfmt.split(" ", 1)
@@ -632,7 +652,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
                 owith = "wb"
             new_fp = open(arg, owith)
         elif mode == "|":
 -            proc = subprocess.Popen(arg, shell=True, stdin=subprocess.PIPE)
 +            proc = subprocess.Popen(
 +                arg,
 +                shell=True,
 +                stdin=subprocess.PIPE,
 +                preexec_fn=set_subprocess_umask_and_gid,
 +            )
             new_fp = proc.stdin
         else:
             raise TypeError("Invalid type for output format: %s" % outfmt)
@@ -654,7 +679,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
                 owith = "wb"
             new_fp = open(arg, owith)
         elif mode == "|":
 -            proc = subprocess.Popen(arg, shell=True, stdin=subprocess.PIPE)
 +            proc = subprocess.Popen(
 +                arg,
 +                shell=True,
 +                stdin=subprocess.PIPE,
 +                preexec_fn=set_subprocess_umask_and_gid,
 +            )
             new_fp = proc.stdin
         else:
             raise TypeError("Invalid type for error format: %s" % errfmt)
 diff --git a/tests/integration_tests/modules/test_set_password.py b/tests/integration_tests/modules/test_set_password.py
 index b13f76fb..d7cf91a5 100644
 --- a/tests/integration_tests/modules/test_set_password.py
 +++ b/tests/integration_tests/modules/test_set_password.py
@@ -116,6 +116,30 @@ class Mixin:
         # Which are not the same
         assert shadow_users["harry"] != shadow_users["dick"]
 +    def test_random_passwords_not_stored_in_cloud_init_output_log(
 +        self, class_client
 +    ):
 +        """We should not emit passwords to the in-instance log file.
 +
 +        LP: #1918303
 +        """
 +        cloud_init_output = class_client.read_from_file(
 +            "/var/log/cloud-init-output.log"
 +        )
 +        assert "dick:" not in cloud_init_output
 +        assert "harry:" not in cloud_init_output
 +
 +    def test_random_passwords_emitted_to_serial_console(self, class_client):
 +        """We should emit passwords to the serial console. (LP: #1918303)"""
 +        try:
 +            console_log = class_client.instance.console_log()
 +        except NotImplementedError:
 +            # Assume that an exception here means that we can't use the console
 +            # log
 +            pytest.skip("NotImplementedError when requesting console log")
 +        assert "dick:" in console_log
 +        assert "harry:" in console_log
 +
     def test_explicit_password_set_correctly(self, class_client):
         """Test that an explicitly-specified password is set correctly."""
         shadow_users, _ = self._fetch_and_parse_etc_shadow(class_client)
 diff --git a/tests/integration_tests/test_logging.py b/tests/integration_tests/test_logging.py
 new file mode 100644
 index 00000000..b31a0434
 --- /dev/null
 +++ b/tests/integration_tests/test_logging.py
@@ -0,0 +1,22 @@
 +"""Integration tests relating to cloud-init's logging."""
 +
 +
 +class TestVarLogCloudInitOutput:
 +    """Integration tests relating to /var/log/cloud-init-output.log."""
 +
 +    def test_var_log_cloud_init_output_not_world_readable(self, client):
 +        """
 +        The log can contain sensitive data, it shouldn't be world-readable.
 +
 +        LP: #1918303
 +        """
 +        # Check the file exists
 +        assert client.execute("test -f /var/log/cloud-init-output.log").ok
 +
 +        # Check its permissions are as we expect
 +        perms, user, group = client.execute(
 +            "stat -c %a:%U:%G /var/log/cloud-init-output.log"
 +        ).split(":")
 +        assert "640" == perms
 +        assert "root" == user
 +        assert "adm" == group
 diff --git a/tests/unittests/test_util.py b/tests/unittests/test_util.py
 index 857629f1..e5292001 100644
 --- a/tests/unittests/test_util.py
 +++ b/tests/unittests/test_util.py
@@ -572,6 +572,10 @@ class TestMultiLog(helpers.FilesystemMockingTestCase):
         util.multi_log(logged_string)
         self.assertEqual(logged_string, self.stdout.getvalue())
 +    def test_logs_dont_go_to_stdout_if_fallback_to_stdout_is_false(self):
 +        util.multi_log('something', fallback_to_stdout=False)
 +        self.assertEqual('', self.stdout.getvalue())
 +
     def test_logs_go_to_log_if_given(self):
         log = mock.MagicMock()
         logged_string = 'something very important'
 -- 
 2.27.0
--- a/SPECS/cloud-init.spec
+++ b/SPECS/cloud-init.spec
@ -5,8 +5,8 @@
 %global debug_package %{nil}
 Name:           cloud-init
-Version:        21.1
+Version:        22.1
-Release:        7%{?dist}.5
+Release:        5%{?dist}
 Summary:        Cloud instance init scripts
 Group:          System Environment/Base
@ -18,42 +18,33 @@ Source1:        cloud-init-tmpfiles.conf
 Patch0001: 0001-Add-initial-redhat-setup.patch
 Patch0002: 0002-Do-not-write-NM_CONTROLLED-no-in-generated-interface.patch
 Patch0003: 0003-limit-permissions-on-def_log_file.patch
-Patch0004: 0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
+Patch0004: 0004-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
-Patch0005: 0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
+Patch0005: 0005-Remove-race-condition-between-cloud-init-and-Network.patch
-Patch0006: 0006-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
+Patch0006: 0006-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
-Patch0007: 0007-Remove-race-condition-between-cloud-init-and-Network.patch
+# For bz#2059872 - [RHEL-8]Rebase cloud-init from Fedora so it can configure networking using NM keyfiles
-Patch0008: 0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
+Patch7: ci-Add-native-NetworkManager-support-1224.patch
-Patch0009: 0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
+# For bz#2059872 - [RHEL-8]Rebase cloud-init from Fedora so it can configure networking using NM keyfiles
-# For bz#1957532 - [cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image
+Patch8: ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch
-Patch10: ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
+# For bz#2082071 - Align cloud.cfg file and systemd with cloud-init upstream .tmpl files
-# For bz#1945891 - CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8]
+Patch9: ci-Align-rhel-custom-files-with-upstream-1431.patch
-Patch11: ci-write-passwords-only-to-serial-console-lock-down-clo.patch
+# For bz#2082071 - Align cloud.cfg file and systemd with cloud-init upstream .tmpl files
-# For bz#1862967 - [cloud-init]Customize ssh AuthorizedKeysFile causes login failure
+Patch10: ci-Remove-rhel-specific-files.patch
-Patch12: ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
+# For bz#2082686 - [cloud][init] Add support for reading tags from instance metadata
-# For bz#1862967 - [cloud-init]Customize ssh AuthorizedKeysFile causes login failure
+Patch11: ci-Support-EC2-tags-in-instance-metadata-1309.patch
-Patch13: ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
+# For bz#2096269 - Adjust udev/rules default path[RHEL-8]
-# For bz#1995840 - [cloudinit]  Fix home permissions modified by ssh module
+Patch12: ci-setup.py-adjust-udev-rules-default-path-1513.patch
-Patch14: ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
+# For bz#2107464 - [RHEL-8.7] Cannot run sysconfig when changing the priority of network renderers
-# For bz#2017697 - cloud-init fails to set host key permissions correctly [rhel-8.5.0.z]
+# For bz#2110066 - DNS integration with OpenStack/cloud-init/NetworkManager is not working
-Patch15: ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch
+# For bz#2117526 - [RHEL8.7] Revert patch of configuring networking by NM keyfiles
-# For bz#2028738 - cloud-init.service fails to start after package update [rhel-8.5.0.z]
+# For bz#2104393 - [RHEL-8.7]Failed to config static IP and IPv6 according to VMware Customization Config File
-Patch16: ci-fix-error-on-upgrade-caused-by-new-vendordata2-attri.patch
+# For bz#2098624 - [RHEL-8.7] IPv6 not workable when cloud-init configure network using NM keyfiles
-# For bz#2028756 - [RHEL-8] Above 19.2 of cloud-init fails to configure routes when configuring static and default routes to the same destination IP [rhel-8.5.0.z]
+Patch13: ci-Revert-Add-native-NetworkManager-support-1224.patch
-Patch17: ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch
+# For bz#2107464 - [RHEL-8.7] Cannot run sysconfig when changing the priority of network renderers
-# For bz#2040690 - [RHEL8] [Azure] cloud-init fails to configure the system [rhel-8.5.0.z]
+# For bz#2110066 - DNS integration with OpenStack/cloud-init/NetworkManager is not working
-#Patch18: ci-Add-gdisk-and-openssl-as-deps-to-fix-UEFI-Azure-init.patch
+# For bz#2117526 - [RHEL8.7] Revert patch of configuring networking by NM keyfiles
-# For bz#2040704 - [cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z]
+# For bz#2104393 - [RHEL-8.7]Failed to config static IP and IPv6 according to VMware Customization Config File
-Patch19: ci-Datasource-for-VMware-953.patch
+# For bz#2098624 - [RHEL-8.7] IPv6 not workable when cloud-init configure network using NM keyfiles
-# For bz#2040704 - [cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z]
+Patch14: ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch
 Patch20: ci-Change-netifaces-dependency-to-0.10.4-965.patch
 # For bz#2040704 - [cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z]
 Patch21: ci-Update-dscheck_VMware-s-rpctool-check-970.patch
 # For bz#2040704 - [cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z]
 Patch22: ci-Revert-unnecesary-lcase-in-ds-identify-978.patch
 # For bz#2060026 - cloud-init writes route6-$DEVICE config with a HEX netmask. ip route does not like : Error: inet6 prefix is expected rather than "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::". [rhel-8.5.0.z]
 Patch23: ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch
 # For bz#2040704 - [cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z]
 #Patch23: ci-Add-netifaces-package-as-a-Requires-in-cloud-init.sp.patch
 BuildArch:      noarch
@ -102,7 +93,7 @@ Requires:       shadow-utils
 Requires:       util-linux
 Requires:       xfsprogs
 Requires:       dhcp-client
-# https://bugzilla.redhat.com/show_bug.cgi?id=2040690
+# https://bugzilla.redhat.com/show_bug.cgi?id=2039697
 Requires:       gdisk
 Requires:       openssl
 Requires:       python3-netifaces
@ -129,8 +120,6 @@ sed -i -e 's|#!/usr/bin/env python|#!/usr/bin/env python3|' \
 %install
 %py3_install --
 python3 tools/render-cloudcfg --variant fedora > $RPM_BUILD_ROOT/%{_sysconfdir}/cloud/cloud.cfg
 sed -i "s,@@PACKAGED_VERSION@@,%{version}-%{release}," $RPM_BUILD_ROOT/%{python3_sitelib}/cloudinit/version.py
 mkdir -p $RPM_BUILD_ROOT/var/lib/cloud
@ -140,9 +129,6 @@ mkdir -p $RPM_BUILD_ROOT/run/cloud-init
 mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir}
 cp -p %{SOURCE1} $RPM_BUILD_ROOT/%{_tmpfilesdir}/%{name}.conf
 # We supply our own config file since our software differs from Ubuntu's.
 cp -p rhel/cloud.cfg $RPM_BUILD_ROOT/%{_sysconfdir}/cloud/cloud.cfg
 mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rsyslog.d
 cp -p tools/21-cloudinit.conf $RPM_BUILD_ROOT/%{_sysconfdir}/rsyslog.d/21-cloudinit.conf
@ -150,17 +136,10 @@ cp -p tools/21-cloudinit.conf $RPM_BUILD_ROOT/%{_sysconfdir}/rsyslog.d/21-cloudi
 mv $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/hook-network-manager \
   $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/cloud-init-azure-hook
 # Install our own systemd units (rhbz#1440831)
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 cp rhel/systemd/* $RPM_BUILD_ROOT%{_unitdir}/
 [ ! -d $RPM_BUILD_ROOT/usr/lib/systemd/system-generators ] && mkdir -p $RPM_BUILD_ROOT/usr/lib/systemd/system-generators
 python3 tools/render-cloudcfg --variant rhel systemd/cloud-init-generator.tmpl > $RPM_BUILD_ROOT/usr/lib/systemd/system-generators/cloud-init-generator
 chmod 755 $RPM_BUILD_ROOT/usr/lib/systemd/system-generators/cloud-init-generator
 [ ! -d $RPM_BUILD_ROOT/usr/lib/%{name} ] && mkdir -p $RPM_BUILD_ROOT/usr/lib/%{name}
 cp -p tools/ds-identify $RPM_BUILD_ROOT%{_libexecdir}/%{name}/ds-identify
 # installing man pages
 mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/man1/
 for man in cloud-id.1 cloud-init.1 cloud-init-per.1; do
@ -216,7 +195,6 @@ fi
 %files
 %license LICENSE
 %doc ChangeLog rhel/README.rhel
 %config(noreplace) %{_sysconfdir}/cloud/cloud.cfg
 %dir               %{_sysconfdir}/cloud/cloud.cfg.d
 %config(noreplace) %{_sysconfdir}/cloud/cloud.cfg.d/*.cfg
@ -226,6 +204,8 @@ fi
 %{_unitdir}/cloud-config.service
 %{_unitdir}/cloud-config.target
 %{_unitdir}/cloud-final.service
 %{_unitdir}/cloud-init-hotplugd.service
 %{_unitdir}/cloud-init-hotplugd.socket
 %{_unitdir}/cloud-init-local.service
 %{_unitdir}/cloud-init.service
 %{_unitdir}/cloud-init.target
@ -238,48 +218,109 @@ fi
 %dir %verify(not mode) /run/cloud-init
 %dir /var/lib/cloud
 /etc/NetworkManager/dispatcher.d/cloud-init-azure-hook
 /etc/dhcp/dhclient-exit-hooks.d/hook-dhclient
 %{_udevrulesdir}/66-azure-ephemeral.rules
-%{_sysconfdir}/bash_completion.d/cloud-init
+%{_datadir}/bash-completion/completions/cloud-init
 %{_bindir}/cloud-id
 %{_libexecdir}/%{name}/ds-identify
 /usr/lib/systemd/system-generators/cloud-init-generator
 %{_sysconfdir}/systemd/system/sshd-keygen@.service.d/disable-sshd-keygen-if-cloud-init-active.conf
 %dir %{_sysconfdir}/rsyslog.d
 %config(noreplace) %{_sysconfdir}/rsyslog.d/21-cloudinit.conf
 %changelog
-* Thu Mar 03 2022 Jon Maloy <jmaloy@redhat.com> - 21.1-7.el8_5.5
+* Wed Aug 17 2022 Jon Maloy <jmaloy@redhat.com> - 22.1-5
- ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch [bz#2060026]
+- ci-Revert-Add-native-NetworkManager-support-1224.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
- Resolves: bz#2060026
+- ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
-  (cloud-init writes route6-$DEVICE config with a HEX netmask. ip route does not like : Error: inet6 prefix is expected rather than "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::". [rhel-8.5.0.z])
+- Resolves: bz#2107464
  ([RHEL-8.7] Cannot run sysconfig when changing the priority of network renderers)
 - Resolves: bz#2110066
  (DNS integration with OpenStack/cloud-init/NetworkManager is not working)
 - Resolves: bz#2117526
  ([RHEL8.7] Revert patch of configuring networking by NM keyfiles)
 - Resolves: bz#2104393
  ([RHEL-8.7]Failed to config static IP and IPv6 according to VMware Customization Config File)
 - Resolves: bz#2098624
  ([RHEL-8.7] IPv6 not workable when cloud-init configure network using NM keyfiles)
-* Wed Jan 19 2022 Jon Maloy <jmaloy@redhat.com> - 21.1-7.el8_5.4
+* Tue Jul 12 2022 Miroslav Rezanina <mrezanin@redhat.com> - 22.1-4
- ci-Add-gdisk-and-openssl-as-deps-to-fix-UEFI-Azure-init.patch [bz#2040690]
+- ci-cloud-init.spec-adjust-path-for-66-azure-ephemeral.r.patch [bz#2096269]
- ci-Datasource-for-VMware-953.patch [bz#2040704]
+- ci-setup.py-adjust-udev-rules-default-path-1513.patch [bz#2096269]
- ci-Change-netifaces-dependency-to-0.10.4-965.patch [bz#2040704]
+- Resolves: bz#2096269
- ci-Update-dscheck_VMware-s-rpctool-check-970.patch [bz#2040704]
+  (Adjust udev/rules default path[RHEL-8])
 - ci-Revert-unnecesary-lcase-in-ds-identify-978.patch [bz#2040704]
 - ci-Add-netifaces-package-as-a-Requires-in-cloud-init.sp.patch [bz#2040704]
 - Resolves: bz#2040690
  ([RHEL8] [Azure] cloud-init fails to configure the system [rhel-8.5.0.z])
 - Resolves: bz#2040704
  ([cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo' [rhel-8.5.0.z])
-* Wed Dec 08 2021 Jon Maloy <jmaloy@redhat.com> - 21.1-7.el8_5.3
+* Thu Jun 23 2022 Jon Maloy <jmaloy@redhat.com> - 22.1-3
- ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch [bz#2028756]
+- ci-Support-EC2-tags-in-instance-metadata-1309.patch [bz#2082686]
- Resolves: bz#2028756
+- Resolves: bz#2082686
-  ([RHEL-8] Above 19.2 of cloud-init fails to configure routes when configuring static and default routes to the same destination IP [rhel-8.5.0.z])
+  ([cloud][init] Add support for reading tags from instance metadata)
-* Mon Dec 06 2021 Jon Maloy <jmaloy@redhat.com> - 21.1-7.el8_5.2
+* Tue May 31 2022 Jon Maloy <jmaloy@redhat.com> - 22.1-2
- ci-fix-error-on-upgrade-caused-by-new-vendordata2-attri.patch [bz#2028738]
+- ci-Add-native-NetworkManager-support-1224.patch [bz#2059872]
- Resolves: bz#2028738
+- ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch [bz#2059872]
-  (cloud-init.service fails to start after package update [rhel-8.5.0.z])
+- ci-Align-rhel-custom-files-with-upstream-1431.patch [bz#2082071]
 - ci-Remove-rhel-specific-files.patch [bz#2082071]
 - Resolves: bz#2059872
  ([RHEL-8]Rebase cloud-init from Fedora so it can configure networking using NM keyfiles)
 - Resolves: bz#2082071
  (Align cloud.cfg file and systemd with cloud-init upstream .tmpl files)
-* Tue Nov 02 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-7.el8_5.1
+* Mon Apr 25 2022 Amy Chen <xiachen@redhat.com> - 22.1-1
- ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch [bz#2017697]
+- Rebaes to 22.1 [bz#2065544]
- Resolves: bz#2017697
+- Resolves: bz#2065544
-  (cloud-init fails to set host key permissions correctly [rhel-8.5.0.z])
+  ([RHEL-8.7.0] cloud-init rebase to 22.1)
 * Fri Apr 01 2022 Camilla Conte <cconte@redhat.com> - 21.1-15
 - ci-Detect-a-Python-version-change-and-clear-the-cache-8.patch [bz#1935826]
 - ci-Fix-MIME-policy-failure-on-python-version-upgrade-93.patch [bz#1935826]
 * Fri Feb 25 2022 Jon Maloy <jmaloy@redhat.com> - 21.1-14
 - ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch [bz#2046540]
 - Resolves: bz#2046540
  (cloud-init writes route6-$DEVICE config with a HEX netmask. ip route does not like : Error: inet6 prefix is expected rather than "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::".)
 * Tue Jan 25 2022 Jon Maloy <jmaloy@redhat.com> - 21.1-13
 - ci-Add-flexibility-to-IMDS-api-version-793.patch [bz#2023940]
 - ci-Azure-helper-Ensure-Azure-http-handler-sleeps-betwee.patch [bz#2023940]
 - ci-azure-Removing-ability-to-invoke-walinuxagent-799.patch [bz#2023940]
 - ci-Azure-eject-the-provisioning-iso-before-reporting-re.patch [bz#2023940]
 - ci-Azure-Retrieve-username-and-hostname-from-IMDS-865.patch [bz#2023940]
 - ci-Azure-Retry-net-metadata-during-nic-attach-for-non-t.patch [bz#2023940]
 - ci-Azure-adding-support-for-consuming-userdata-from-IMD.patch [bz#2023940]
 - Resolves: bz#2023940
  ([RHEL-8] Support for provisioning Azure VM with userdata)
 * Wed Jan 19 2022 Jon Maloy <jmaloy@redhat.com> - 21.1-12
 - ci-Add-gdisk-and-openssl-as-deps-to-fix-UEFI-Azure-init.patch [bz#2039697]
 - ci-Datasource-for-VMware-953.patch [bz#2026587]
 - ci-Change-netifaces-dependency-to-0.10.4-965.patch [bz#2026587]
 - ci-Update-dscheck_VMware-s-rpctool-check-970.patch [bz#2026587]
 - ci-Revert-unnecesary-lcase-in-ds-identify-978.patch [bz#2026587]
 - ci-Add-netifaces-package-as-a-Requires-in-cloud-init.sp.patch [bz#2026587]
 - Resolves: bz#2039697
  ([RHEL8] [Azure] cloud-init fails to configure the system)
 - Resolves: bz#2026587
  ([cloud-init][RHEL8] Support for cloud-init datasource 'cloud-init-vmware-guestinfo')
 * Wed Dec 08 2021 Jon Maloy <jmaloy@redhat.com> - 21.1-11
 - ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch [bz#2028028]
 - Resolves: bz#2028028
  ([RHEL-8] Above 19.2 of cloud-init fails to configure routes when configuring static and default routes to the same destination IP)
 * Mon Dec 06 2021 Jon Maloy <jmaloy@redhat.com> - 21.1-10
 - ci-fix-error-on-upgrade-caused-by-new-vendordata2-attri.patch [bz#2021538]
 - Resolves: bz#2021538
  (cloud-init.service fails to start after package update)
 * Mon Oct 25 2021 Jon Maloy <jmaloy@redhat.com> - 21.1-9
 - ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch [bz#2013644]
 - Resolves: bz#2013644
  (cloud-init fails to set host key permissions correctly)
 * Thu Sep 23 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-8
 - ci-ssh_utils.py-ignore-when-sshd_config-options-are-not.patch [bz#1862933]
 - Resolves: bz#1862933
  (cloud-init fails with ValueError: need more than 1 value to unpack[rhel-8])
 * Fri Aug 27 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-7
 - ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch [bz#1995840]
@ -319,6 +360,17 @@ fi
 - Resolves: bz#1958174
  ([RHEL-8.5.0] Rebase cloud-init to 21.1)
 * Thu May 13 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.3
 - ci-get_interfaces-don-t-exclude-Open-vSwitch-bridge-bon.patch [bz#1957135]
 - ci-net-exclude-OVS-internal-interfaces-in-get_interface.patch [bz#1957135]
 - Resolves: bz#1957135
  (Intermittent failure to start cloud-init due to failure to detect macs [rhel-8.4.0.z])
 * Tue Apr 06 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.1
 - ci-Fix-requiring-device-number-on-EC2-derivatives-836.patch [bz#1942699]
 - Resolves: bz#1942699
  ([Aliyun][RHEL8.4][cloud-init] cloud-init service failed to start with Alibaba instance [rhel-8.4.0.z])
 * Tue Feb 02 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8
 - ci-fix-a-typo-in-man-page-cloud-init.1-752.patch [bz#1913127]
 - Resolves: bz#1913127
Author	SHA1	Message	Date
CentOS Sources	8706acdb01	import cloud-init-22.1-5.el8	2022-11-08 11:53:07 +00:00
CentOS Sources	5b0b552e23	import cloud-init-21.1-15.el8_6.3	2022-06-28 11:00:34 +00:00
CentOS Sources	cd2b81ea61	import cloud-init-21.1-15.el8_6.1	2022-05-23 09:17:46 +00:00
CentOS Sources	947bda3709	import cloud-init-21.1-15.el8	2022-05-10 08:01:31 +00:00
`@ -1 +1 @@`
	`2ae378aa2ae23b34b0ff123623ba5e2fbdc4928d SOURCES/cloud-init-21.1.tar.gz`	`830185bb5ce87ad86e4d1c0c62329bb255ec1648 SOURCES/cloud-init-22.1.tar.gz`
`@ -1 +1 @@`
	`SOURCES/cloud-init-21.1.tar.gz`	`SOURCES/cloud-init-22.1.tar.gz`