AlmaLinux changes

import cloud-init-21.1-7.el8
2021-11-17 14:47:32 +03:00 · 2021-11-09 09:53:06 +00:00
28 changed files with 2583 additions and 1985 deletions
--- a/.cloud-init.metadata
+++ b/.cloud-init.metadata
@ -1 +1 @@
-cbde66f717b7883c4ab64b145042de54f131afab SOURCES/cloud-init-20.3.tar.gz
+2ae378aa2ae23b34b0ff123623ba5e2fbdc4928d SOURCES/cloud-init-21.1.tar.gz
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/cloud-init-20.3.tar.gz
+SOURCES/cloud-init-21.1.tar.gz
--- a/SOURCES/0001-Add-initial-redhat-setup.patch
+++ b/SOURCES/0001-Add-initial-redhat-setup.patch
@ -1,8 +1,18 @@
-From 25ea7a28d69518319ae1ed1b3cd510147868fd29 Mon Sep 17 00:00:00 2001
+From 074cb9b011623849cfa95c1d7cc813bb28f03ff0 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:49:36 +0200
+Date: Fri, 7 May 2021 13:36:03 +0200
 Subject: Add initial redhat setup
 Merged patches (21.1):
 - 915d30ad Change gating file to correct rhel version
 - 311f318d Removing net-tools dependency
 - 74731806 Adding man pages to Red Hat spec file
 - 758d333d Removing blocking test from yaml configuration file
 - c7e7c59c Changing permission of cloud-init-generator to 755
 - 8b85abbb Installing man pages in the correct place with correct permissions
 - c6808d8d Fix unit failure of cloud-final.service if NetworkManager was not present.
 - 11866ef6 Report full specific version with "cloud-init --version"
 Rebase notes (18.5):
 - added bash_completition file
 - added cloud-id file
@ -33,36 +43,36 @@ setup.py:
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 .gitignore                            |   1 +
- cloudinit/config/cc_chef.py           |  67 ++++-
+ cloudinit/config/cc_chef.py           |  67 +++-
 cloudinit/settings.py                 |   7 +-
 redhat/.gitignore                     |   1 +
- redhat/Makefile                       |  71 +++++
+ redhat/Makefile                       |  71 ++++
- redhat/Makefile.common                |  37 +++
+ redhat/Makefile.common                |  37 ++
 redhat/cloud-init-tmpfiles.conf       |   1 +
- redhat/cloud-init.spec.template       | 517 ++++++++++++++++++++++++++++++++++
+ redhat/cloud-init.spec.template       | 530 ++++++++++++++++++++++++++
- redhat/gating.yaml                    |   9 +
+ redhat/gating.yaml                    |   8 +
 redhat/rpmbuild/BUILD/.gitignore      |   3 +
 redhat/rpmbuild/RPMS/.gitignore       |   3 +
 redhat/rpmbuild/SOURCES/.gitignore    |   3 +
 redhat/rpmbuild/SPECS/.gitignore      |   3 +
 redhat/rpmbuild/SRPMS/.gitignore      |   3 +
 redhat/scripts/frh.py                 |  27 ++
- redhat/scripts/git-backport-diff      | 327 +++++++++++++++++++++
+ redhat/scripts/git-backport-diff      | 327 ++++++++++++++++
- redhat/scripts/git-compile-check      | 215 ++++++++++++++
+ redhat/scripts/git-compile-check      | 215 +++++++++++
- redhat/scripts/process-patches.sh     |  77 +++++
+ redhat/scripts/process-patches.sh     |  77 ++++
 redhat/scripts/tarball_checksum.sh    |   3 +
 rhel/README.rhel                      |   5 +
 rhel/cloud-init-tmpfiles.conf         |   1 +
- rhel/cloud.cfg                        |  69 +++++
+ rhel/cloud.cfg                        |  69 ++++
- rhel/systemd/cloud-config.service     |  18 ++
+ rhel/systemd/cloud-config.service     |  18 +
 rhel/systemd/cloud-config.target      |  11 +
- rhel/systemd/cloud-final.service      |  19 ++
+ rhel/systemd/cloud-final.service      |  24 ++
 rhel/systemd/cloud-init-local.service |  31 ++
 rhel/systemd/cloud-init.service       |  25 ++
 rhel/systemd/cloud-init.target        |   7 +
 setup.py                              |  23 +-
 tools/read-version                    |  28 +-
- 30 files changed, 1562 insertions(+), 50 deletions(-)
+ 30 files changed, 1579 insertions(+), 50 deletions(-)
 create mode 100644 redhat/.gitignore
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
@ -90,7 +100,7 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 create mode 100644 rhel/systemd/cloud-init.target
 diff --git a/cloudinit/config/cc_chef.py b/cloudinit/config/cc_chef.py
-index aaf7136..97ef649 100644
+index aaf71366..97ef649a 100644
 --- a/cloudinit/config/cc_chef.py
 +++ b/cloudinit/config/cc_chef.py
@@ -6,7 +6,70 @@
@ -175,10 +185,10 @@ index aaf7136..97ef649 100644
 REQUIRED_CHEF_DIRS = tuple([
     '/etc/chef',
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index ca4ffa8..3a04a58 100644
+index 91e1bfe7..e690c0fd 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -46,13 +46,16 @@ CFG_BUILTIN = {
+@@ -47,13 +47,16 @@ CFG_BUILTIN = {
     ],
     'def_log_file': '/var/log/cloud-init.log',
     'log_cfgs': [],
@ -199,7 +209,7 @@ index ca4ffa8..3a04a58 100644
     'vendor_data': {'enabled': True, 'prefix': []},
 diff --git a/rhel/README.rhel b/rhel/README.rhel
 new file mode 100644
-index 0000000..aa29630
+index 00000000..aa29630d
 --- /dev/null
 +++ b/rhel/README.rhel
@@ -0,0 +1,5 @@
@ -210,14 +220,14 @@ index 0000000..aa29630
 + - grub_dpkg
 diff --git a/rhel/cloud-init-tmpfiles.conf b/rhel/cloud-init-tmpfiles.conf
 new file mode 100644
-index 0000000..0c6d2a3
+index 00000000..0c6d2a3b
 --- /dev/null
 +++ b/rhel/cloud-init-tmpfiles.conf
@@ -0,0 +1 @@
 +d /run/cloud-init 0700 root root - -
 diff --git a/rhel/cloud.cfg b/rhel/cloud.cfg
 new file mode 100644
-index 0000000..82e8bf6
+index 00000000..82e8bf62
 --- /dev/null
 +++ b/rhel/cloud.cfg
@@ -0,0 +1,69 @@
@ -292,7 +302,7 @@ index 0000000..82e8bf6
 +# vim:syntax=yaml
 diff --git a/rhel/systemd/cloud-config.service b/rhel/systemd/cloud-config.service
 new file mode 100644
-index 0000000..f3dcd4b
+index 00000000..f3dcd4be
 --- /dev/null
 +++ b/rhel/systemd/cloud-config.service
@@ -0,0 +1,18 @@
@ -316,7 +326,7 @@ index 0000000..f3dcd4b
 +WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-config.target b/rhel/systemd/cloud-config.target
 new file mode 100644
-index 0000000..ae9b7d0
+index 00000000..ae9b7d02
 --- /dev/null
 +++ b/rhel/systemd/cloud-config.target
@@ -0,0 +1,11 @@
@ -333,10 +343,10 @@ index 0000000..ae9b7d0
 +After=cloud-init-local.service cloud-init.service
 diff --git a/rhel/systemd/cloud-final.service b/rhel/systemd/cloud-final.service
 new file mode 100644
-index 0000000..739b7e3
+index 00000000..e281c0cf
 --- /dev/null
 +++ b/rhel/systemd/cloud-final.service
-@@ -0,0 +1,19 @@
+@@ -0,0 +1,24 @@
 +[Unit]
 +Description=Execute cloud user/final scripts
 +After=network-online.target cloud-config.service rc-local.service
@ -350,6 +360,11 @@ index 0000000..739b7e3
 +RemainAfterExit=yes
 +TimeoutSec=0
 +KillMode=process
 +# Restart NetworkManager if it is present and running.
 +ExecStartPost=/bin/sh -c 'u=NetworkManager.service; \
 + out=$(systemctl show --property=SubState $u) || exit; \
 + [ "$out" = "SubState=running" ] || exit 0; \
 + systemctl reload-or-try-restart $u'
 +
 +# Output needs to appear in instance console output
 +StandardOutput=journal+console
@ -358,7 +373,7 @@ index 0000000..739b7e3
 +WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init-local.service b/rhel/systemd/cloud-init-local.service
 new file mode 100644
-index 0000000..8f9f6c9
+index 00000000..8f9f6c9f
 --- /dev/null
 +++ b/rhel/systemd/cloud-init-local.service
@@ -0,0 +1,31 @@
@ -395,7 +410,7 @@ index 0000000..8f9f6c9
 +WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init.service b/rhel/systemd/cloud-init.service
 new file mode 100644
-index 0000000..d0023a0
+index 00000000..d0023a05
 --- /dev/null
 +++ b/rhel/systemd/cloud-init.service
@@ -0,0 +1,25 @@
@ -426,7 +441,7 @@ index 0000000..d0023a0
 +WantedBy=cloud-init.target
 diff --git a/rhel/systemd/cloud-init.target b/rhel/systemd/cloud-init.target
 new file mode 100644
-index 0000000..083c3b6
+index 00000000..083c3b6f
 --- /dev/null
 +++ b/rhel/systemd/cloud-init.target
@@ -0,0 +1,7 @@
@ -438,7 +453,7 @@ index 0000000..083c3b6
 +Description=Cloud-init target
 +After=multi-user.target
 diff --git a/setup.py b/setup.py
-index cbacf48..d5cd01a 100755
+index cbacf48e..d5cd01a4 100755
 --- a/setup.py
 +++ b/setup.py
@@ -125,14 +125,6 @@ INITSYS_FILES = {
@ -503,7 +518,7 @@ index cbacf48..d5cd01a 100755
         'console_scripts': [
             'cloud-init = cloudinit.cmd.main:main',
 diff --git a/tools/read-version b/tools/read-version
-index 02c9064..79755f7 100755
+index 02c90643..79755f78 100755
 --- a/tools/read-version
 +++ b/tools/read-version
@@ -71,32 +71,8 @@ version_long = None
@ -542,5 +557,5 @@ index 02c9064..79755f7 100755
 # version is X.Y.Z[+xxx.gHASH]
 # version_long is None or X.Y.Z-xxx-gHASH
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0002-Do-not-write-NM_CONTROLLED-no-in-generated-interface.patch
+++ b/SOURCES/0002-Do-not-write-NM_CONTROLLED-no-in-generated-interface.patch
@ -1,6 +1,6 @@
-From d9024cd3bd3bf09b05eb75ba3d81bd15f519c9f8 Mon Sep 17 00:00:00 2001
+From 472c2b5d4342b6ab6ce1584dc39bed0e6c1ca2e7 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:49:46 +0200
+Date: Fri, 7 May 2021 13:36:06 +0200
 Subject: Do not write NM_CONTROLLED=no in generated interface config  files
 Conflicts 20.3:
@ -13,14 +13,14 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Signed-off-by: Ryan McCabe <rmccabe@redhat.com>
 ---
 cloudinit/net/sysconfig.py  |  2 +-
- tests/unittests/test_net.py | 30 ------------------------------
+ tests/unittests/test_net.py | 28 ----------------------------
- 2 files changed, 1 insertion(+), 31 deletions(-)
+ 2 files changed, 1 insertion(+), 29 deletions(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
-index 0a5d481..23e467d 100644
+index 99a4bae4..3d276666 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
-@@ -277,7 +277,7 @@ class Renderer(renderer.Renderer):
+@@ -289,7 +289,7 @@ class Renderer(renderer.Renderer):
     #                                         details about this)
     iface_defaults = {
@ -30,7 +30,7 @@ index 0a5d481..23e467d 100644
         'suse': {'BOOTPROTO': 'static', 'STARTMODE': 'auto'},
     }
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
-index 54cc846..9985a97 100644
+index 38d934d4..c67b5fcc 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -535,7 +535,6 @@ GATEWAY=172.19.3.254
@ -49,15 +49,15 @@ index 54cc846..9985a97 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -754,7 +752,6 @@ IPV6ADDR_SECONDARIES="2001:DB9::10/64 2001:DB10::10/64"
+@@ -756,7 +754,6 @@ IPV6_AUTOCONF=no
 IPV6INIT=yes
 IPV6_DEFAULTGW=2001:DB8::1
 IPV6_FORCE_ACCEPT_RA=no
 NETMASK=255.255.252.0
 -NM_CONTROLLED=no
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -882,7 +879,6 @@ NETWORK_CONFIGS = {
+@@ -884,7 +881,6 @@ NETWORK_CONFIGS = {
                 BOOTPROTO=none
                 DEVICE=eth1
                 HWADDR=cf:d6:af:48:e8:80
@ -65,7 +65,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -899,7 +895,6 @@ NETWORK_CONFIGS = {
+@@ -901,7 +897,6 @@ NETWORK_CONFIGS = {
                 IPADDR=192.168.21.3
                 NETMASK=255.255.255.0
                 METRIC=10000
@ -73,15 +73,15 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -1028,7 +1023,6 @@ NETWORK_CONFIGS = {
+@@ -1032,7 +1027,6 @@ NETWORK_CONFIGS = {
-                 IPV6ADDR=2001:1::1/64
+                 IPV6_AUTOCONF=no
-                 IPV6INIT=yes
+                 IPV6_FORCE_ACCEPT_RA=no
                 NETMASK=255.255.255.0
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
-@@ -1622,7 +1616,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1737,7 +1731,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DHCPV6C=yes
                 IPV6INIT=yes
                 MACADDR=aa:bb:cc:dd:ee:ff
@ -89,15 +89,15 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Bond
                 USERCTL=no"""),
-@@ -1630,7 +1623,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1745,7 +1738,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=dhcp
                 DEVICE=bond0.200
                 DHCLIENT_SET_DEFAULT_ROUTE=no
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 PHYSDEV=bond0
-                 TYPE=Ethernet
+                 USERCTL=no
-@@ -1647,7 +1639,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1763,7 +1755,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 IPV6_DEFAULTGW=2001:4800:78ff:1b::1
                 MACADDR=bb:bb:bb:bb:bb:aa
                 NETMASK=255.255.255.0
@ -105,7 +105,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 PRIO=22
                 STP=no
-@@ -1657,7 +1648,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1773,7 +1764,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=eth0
                 HWADDR=c0:d6:9f:2c:e8:80
@ -113,15 +113,15 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -1674,7 +1664,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1790,7 +1780,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 MTU=1500
                 NETMASK=255.255.255.0
                 NETMASK1=255.255.255.0
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 PHYSDEV=eth0
-                 TYPE=Ethernet
+                 USERCTL=no
-@@ -1685,7 +1674,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1800,7 +1789,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth1
                 HWADDR=aa:d6:9f:2c:e8:80
                 MASTER=bond0
@ -129,7 +129,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 SLAVE=yes
                 TYPE=Ethernet
-@@ -1695,7 +1683,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1810,7 +1798,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth2
                 HWADDR=c0:bb:9f:2c:e8:80
                 MASTER=bond0
@ -137,7 +137,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 SLAVE=yes
                 TYPE=Ethernet
-@@ -1705,7 +1692,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1820,7 +1807,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BRIDGE=br0
                 DEVICE=eth3
                 HWADDR=66:bb:9f:2c:e8:80
@ -145,7 +145,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -1714,7 +1700,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1829,7 +1815,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BRIDGE=br0
                 DEVICE=eth4
                 HWADDR=98:bb:9f:2c:e8:80
@ -153,7 +153,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -1723,7 +1708,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1838,7 +1823,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DEVICE=eth5
                 DHCLIENT_SET_DEFAULT_ROUTE=no
                 HWADDR=98:bb:9f:2c:e8:8a
@ -161,7 +161,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=no
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -2177,7 +2161,6 @@ iface bond0 inet6 static
+@@ -2294,7 +2278,6 @@ iface bond0 inet6 static
         MTU=9000
         NETMASK=255.255.255.0
         NETMASK1=255.255.255.0
@ -169,7 +169,7 @@ index 54cc846..9985a97 100644
         ONBOOT=yes
         TYPE=Bond
         USERCTL=no
-@@ -2187,7 +2170,6 @@ iface bond0 inet6 static
+@@ -2304,7 +2287,6 @@ iface bond0 inet6 static
         DEVICE=bond0s0
         HWADDR=aa:bb:cc:dd:e8:00
         MASTER=bond0
@ -177,7 +177,7 @@ index 54cc846..9985a97 100644
         ONBOOT=yes
         SLAVE=yes
         TYPE=Ethernet
-@@ -2209,7 +2191,6 @@ iface bond0 inet6 static
+@@ -2326,7 +2308,6 @@ iface bond0 inet6 static
         DEVICE=bond0s1
         HWADDR=aa:bb:cc:dd:e8:01
         MASTER=bond0
@ -185,7 +185,7 @@ index 54cc846..9985a97 100644
         ONBOOT=yes
         SLAVE=yes
         TYPE=Ethernet
-@@ -2266,7 +2247,6 @@ iface bond0 inet6 static
+@@ -2383,7 +2364,6 @@ iface bond0 inet6 static
                 BOOTPROTO=none
                 DEVICE=en0
                 HWADDR=aa:bb:cc:dd:e8:00
@ -193,15 +193,15 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no"""),
-@@ -2283,7 +2263,6 @@ iface bond0 inet6 static
+@@ -2402,7 +2382,6 @@ iface bond0 inet6 static
                 MTU=2222
                 NETMASK=255.255.255.0
                 NETMASK1=255.255.255.0
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 PHYSDEV=en0
-                 TYPE=Ethernet
+                 USERCTL=no
-@@ -2349,7 +2328,6 @@ iface bond0 inet6 static
+@@ -2467,7 +2446,6 @@ iface bond0 inet6 static
                 DEVICE=br0
                 IPADDR=192.168.2.2
                 NETMASK=255.255.255.0
@ -209,23 +209,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 PRIO=22
                 STP=no
-@@ -2363,7 +2341,6 @@ iface bond0 inet6 static
+@@ -2591,7 +2569,6 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:00
                 IPV6ADDR=2001:1::100/96
                 IPV6INIT=yes
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
@@ -2375,7 +2352,6 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:01
                 IPV6ADDR=2001:1::101/96
                 IPV6INIT=yes
 -                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
@@ -2469,7 +2445,6 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:00
                 IPADDR=192.168.1.2
                 NETMASK=255.255.255.0
@ -233,7 +217,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=no
                 TYPE=Ethernet
                 USERCTL=no
-@@ -2479,7 +2454,6 @@ iface bond0 inet6 static
+@@ -2601,7 +2578,6 @@ iface bond0 inet6 static
                 DEVICE=eth1
                 HWADDR=52:54:00:12:34:aa
                 MTU=1480
@ -241,7 +225,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
-@@ -2488,7 +2462,6 @@ iface bond0 inet6 static
+@@ -2610,7 +2586,6 @@ iface bond0 inet6 static
                 BOOTPROTO=none
                 DEVICE=eth2
                 HWADDR=52:54:00:12:34:ff
@ -249,7 +233,7 @@ index 54cc846..9985a97 100644
                 ONBOOT=no
                 TYPE=Ethernet
                 USERCTL=no
-@@ -2905,7 +2878,6 @@ class TestRhelSysConfigRendering(CiTestCase):
+@@ -3027,7 +3002,6 @@ class TestRhelSysConfigRendering(CiTestCase):
 BOOTPROTO=dhcp
 DEVICE=eth1000
 HWADDR=07-1c-c6-75-a4-be
@ -257,7 +241,7 @@ index 54cc846..9985a97 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -3026,7 +2998,6 @@ GATEWAY=10.0.2.2
+@@ -3148,7 +3122,6 @@ GATEWAY=10.0.2.2
 HWADDR=52:54:00:12:34:00
 IPADDR=10.0.2.15
 NETMASK=255.255.255.0
@ -265,7 +249,7 @@ index 54cc846..9985a97 100644
 ONBOOT=yes
 TYPE=Ethernet
 USERCTL=no
-@@ -3096,7 +3067,6 @@ USERCTL=no
+@@ -3218,7 +3191,6 @@ USERCTL=no
 #
 BOOTPROTO=dhcp
 DEVICE=eth0
@ -274,5 +258,5 @@ index 54cc846..9985a97 100644
 TYPE=Ethernet
 USERCTL=no
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0003-limit-permissions-on-def_log_file.patch
+++ b/SOURCES/0003-limit-permissions-on-def_log_file.patch
@ -1,6 +1,6 @@
-From de22eafc9046b8ea6fddda7440df5a05f5a40607 Mon Sep 17 00:00:00 2001
+From 6134624f10ef56534e37624adc12f11b09910591 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:49:53 +0200
+Date: Fri, 7 May 2021 13:36:08 +0200
 Subject: limit permissions on def_log_file
 This sets a default mode of 0600 on def_log_file, and makes this
@ -10,18 +10,22 @@ LP: #1541196
 Resolves: rhbz#1424612
 X-approved-upstream: true
 Conflicts 21.1:
    cloudinit/stages.py: adjusting call of ensure_file() to use more
 recent version
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/settings.py         | 1 +
- cloudinit/stages.py           | 3 ++-
+ cloudinit/stages.py           | 1 +
 doc/examples/cloud-config.txt | 4 ++++
- 3 files changed, 7 insertions(+), 1 deletion(-)
+ 3 files changed, 6 insertions(+)
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index 3a04a58..439eee0 100644
+index e690c0fd..43a1490c 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -45,6 +45,7 @@ CFG_BUILTIN = {
+@@ -46,6 +46,7 @@ CFG_BUILTIN = {
         'None',
     ],
     'def_log_file': '/var/log/cloud-init.log',
@ -30,22 +34,19 @@ index 3a04a58..439eee0 100644
     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
     'ssh_deletekeys': False,
 diff --git a/cloudinit/stages.py b/cloudinit/stages.py
-index 765f4aa..d769375 100644
+index 3ef4491c..83e25dd1 100644
 --- a/cloudinit/stages.py
 +++ b/cloudinit/stages.py
-@@ -147,8 +147,9 @@ class Init(object):
+@@ -147,6 +147,7 @@ class Init(object):
     def _initialize_filesystem(self):
         util.ensure_dirs(self._initial_subdirs())
         log_file = util.get_cfg_option_str(self.cfg, 'def_log_file')
 +        log_file_mode = util.get_cfg_option_int(self.cfg, 'def_log_file_mode')
         if log_file:
-            util.ensure_file(log_file)
+             util.ensure_file(log_file, preserve_mode=True)
 +            util.ensure_file(log_file, mode=log_file_mode)
             perms = self.cfg.get('syslog_fix_perms')
             if not perms:
                 perms = {}
 diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
-index f3ae5e6..b5b1fdd 100644
+index de9a0f87..bb33ad45 100644
 --- a/doc/examples/cloud-config.txt
 +++ b/doc/examples/cloud-config.txt
@@ -414,10 +414,14 @@ timezone: US/Eastern
@ -64,5 +65,5 @@ index f3ae5e6..b5b1fdd 100644
 # you can set passwords for a user or multiple users
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
+++ b/SOURCES/0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
@ -1,6 +1,6 @@
-From bb87d9a83ddbc5bf84fbdab9c58dedc0c9629eea Mon Sep 17 00:00:00 2001
+From 699d37a6ff3e343e214943794aac09e4156c2b2b Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:51:34 +0200
+Date: Fri, 7 May 2021 13:36:10 +0200
 Subject: sysconfig: Don't write BOOTPROTO=dhcp for ipv6 dhcp
 Don't write BOOTPROTO=dhcp for ipv6 dhcp, as BOOTPROTO applies
@ -20,10 +20,10 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 1 file changed, 1 insertion(+)
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
-index 9985a97..2cc57fe 100644
+index c67b5fcc..4ea0e597 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
-@@ -1614,6 +1614,7 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1729,6 +1729,7 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=bond0
                 DHCPV6C=yes
@ -32,5 +32,5 @@ index 9985a97..2cc57fe 100644
                 MACADDR=aa:bb:cc:dd:ee:ff
                 ONBOOT=yes
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
+++ b/SOURCES/0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
@ -1,6 +1,6 @@
-From 9c6562c6d3516df8d11aa7cf7cd9cc62e5c91a70 Mon Sep 17 00:00:00 2001
+From ccc75c1be3ae08d813193071c798fc905b5c03e5 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:51:37 +0200
+Date: Fri, 7 May 2021 13:36:12 +0200
 Subject: DataSourceAzure.py: use hostnamectl to set hostname
 RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
@ -40,10 +40,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
-index f3c6452..1c214db 100755
+index cee630f7..553b5a7e 100755
 --- a/cloudinit/sources/DataSourceAzure.py
 +++ b/cloudinit/sources/DataSourceAzure.py
-@@ -258,7 +258,7 @@ def get_hostname(hostname_command='hostname'):
+@@ -296,7 +296,7 @@ def get_hostname(hostname_command='hostname'):
 def set_hostname(hostname, hostname_command='hostname'):
@ -53,5 +53,5 @@ index f3c6452..1c214db 100755
 @azure_ds_telemetry_reporter
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0006-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
+++ b/SOURCES/0006-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
@ -1,6 +1,6 @@
-From bdcad981ac530277529d1c77fb5e9e6f89409bd8 Mon Sep 17 00:00:00 2001
+From dfea0490b899804761fbd7aa23822783d7c36ec5 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:51:44 +0200
+Date: Fri, 7 May 2021 13:36:13 +0200
 Subject: include 'NOZEROCONF=yes' in /etc/sysconfig/network
 RH-Author: Eduardo Otubo <otubo@redhat.com>
@ -27,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 10 insertions(+), 2 deletions(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
-index 23e467d..af093dd 100644
+index 3d276666..d5440998 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
-@@ -888,7 +888,16 @@ class Renderer(renderer.Renderer):
+@@ -925,7 +925,16 @@ class Renderer(renderer.Renderer):
         # Distros configuring /etc/sysconfig/network as a file e.g. Centos
         if sysconfig_path.endswith('network'):
             util.ensure_dir(os.path.dirname(sysconfig_path))
@ -49,10 +49,10 @@ index 23e467d..af093dd 100644
                 netcfg.append('NETWORKING_IPV6=yes')
                 netcfg.append('IPV6_AUTOCONF=no')
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
-index 2cc57fe..9985a97 100644
+index 4ea0e597..c67b5fcc 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
-@@ -1614,7 +1614,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
+@@ -1729,7 +1729,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 BOOTPROTO=none
                 DEVICE=bond0
                 DHCPV6C=yes
@ -61,5 +61,5 @@ index 2cc57fe..9985a97 100644
                 MACADDR=aa:bb:cc:dd:ee:ff
                 ONBOOT=yes
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0007-Remove-race-condition-between-cloud-init-and-Network.patch
+++ b/SOURCES/0007-Remove-race-condition-between-cloud-init-and-Network.patch
@ -1,6 +1,6 @@
-From a52c7b659c6569c78aad4b92303f289009da476c Mon Sep 17 00:00:00 2001
+From 24894dcf45a307f44e29dc5d5b2d864b75fd982c Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Oct 2020 13:51:50 +0200
+Date: Fri, 7 May 2021 13:36:14 +0200
 Subject: Remove race condition between cloud-init and NetworkManager
 Message-id: <20200302104635.11648-1-otubo@redhat.com>
@ -115,12 +115,11 @@ Date:   Thu May 28 08:44:06 2020 +0200
    Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 rhel/cloud.cfg                  | 2 +-
 rhel/systemd/cloud-final.service | 2 ++
 rhel/systemd/cloud-init.service | 1 +
- 3 files changed, 4 insertions(+), 1 deletion(-)
+ 2 files changed, 2 insertions(+), 1 deletion(-)
 diff --git a/rhel/cloud.cfg b/rhel/cloud.cfg
-index 82e8bf6..9ecba21 100644
+index 82e8bf62..9ecba215 100644
 --- a/rhel/cloud.cfg
 +++ b/rhel/cloud.cfg
@@ -6,7 +6,7 @@ ssh_pwauth:   0
@ -132,21 +131,8 @@ index 82e8bf6..9ecba21 100644
 ssh_genkeytypes:  ~
 syslog_fix_perms: ~
 disable_vmware_customization: false
 diff --git a/rhel/systemd/cloud-final.service b/rhel/systemd/cloud-final.service
 index 739b7e3..05add07 100644
 --- a/rhel/systemd/cloud-final.service
 +++ b/rhel/systemd/cloud-final.service
@@ -11,6 +11,8 @@ ExecStart=/usr/bin/cloud-init modules --mode=final
 RemainAfterExit=yes
 TimeoutSec=0
 KillMode=process
 +ExecStartPost=/bin/echo "trying to reload or restart NetworkManager.service"
 +ExecStartPost=/usr/bin/systemctl try-reload-or-restart NetworkManager.service
 # Output needs to appear in instance console output
 StandardOutput=journal+console
 diff --git a/rhel/systemd/cloud-init.service b/rhel/systemd/cloud-init.service
-index d0023a0..0b3d796 100644
+index d0023a05..0b3d796d 100644
 --- a/rhel/systemd/cloud-init.service
 +++ b/rhel/systemd/cloud-init.service
@@ -5,6 +5,7 @@ Wants=sshd-keygen.service
@ -158,5 +144,5 @@ index d0023a0..0b3d796 100644
 Before=sshd-keygen.service
 Before=sshd.service
 -- 
-1.8.3.1
+2.27.0
--- a/SOURCES/0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
+++ b/SOURCES/0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
@ -1,21 +1,7 @@
-From 83e17432645b9e959c82ffe9c86d20fa183bc5ef Mon Sep 17 00:00:00 2001
+From b48dda73da94782d7ab0c455fa382d3a5ef3c419 Mon Sep 17 00:00:00 2001
 From: Daniel Watkins <oddbloke@ubuntu.com>
 Date: Mon, 8 Mar 2021 12:50:57 -0500
-Subject: [PATCH 2/2] net: exclude OVS internal interfaces in get_interfaces
+Subject: net: exclude OVS internal interfaces in get_interfaces (#829)
 (#829)
 RH-Author: Eduardo Otubo (otubo)
 RH-MergeRequest: 6: Patch series to fix "Bug 1957135 - Intermittent failure to start cloud-init due to failure to detect macs"
 RH-Commit: [2/2] d401dc64a7ceeecb091a792aa24de334940a3750 (otubo/cloud-init)
 RH-Bugzilla: 1957135
 RH-Acked-by: Mohammed Gamal <mmorsy@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <[eesposit@redhat.com](mailto:eesposit@redhat.com>
 commit 121bc04cdf0e6732fe143b7419131dc250c13384
 Author: Daniel Watkins <oddbloke@ubuntu.com>
 Date:   Mon Mar 8 12:50:57 2021 -0500
    net: exclude OVS internal interfaces in get_interfaces (#829)
 `get_interfaces` is used to in two ways, broadly: firstly, to determine
 the available interfaces when converting cloud network configuration
@ -34,8 +20,6 @@ Date:   Mon Mar 8 12:50:57 2021 -0500
 interfaces from the set of interfaces returned by `get_interfaces`.
 LP: #1912844
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/net/__init__.py                     |  62 +++++++++
 cloudinit/net/tests/test_init.py              | 119 ++++++++++++++++++
@ -48,7 +32,7 @@ Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 create mode 100644 tests/integration_tests/bugs/test_lp1912844.py
 diff --git a/cloudinit/net/__init__.py b/cloudinit/net/__init__.py
-index 0aa58b27..2ff770e1 100644
+index de65e7af..385b7bcc 100644
 --- a/cloudinit/net/__init__.py
 +++ b/cloudinit/net/__init__.py
@@ -6,6 +6,7 @@
@ -132,15 +116,15 @@ index 0aa58b27..2ff770e1 100644
 def is_netfailover(devname, driver=None):
     """ netfailover driver uses 3 nics, master, primary and standby.
         this returns True if the device is either the primary or standby
-@@ -877,6 +937,8 @@ def get_interfaces():
+@@ -884,6 +944,8 @@ def get_interfaces(blacklist_drivers=None) -> list:
         # skip nics that have no mac (00:00....)
         if name != 'lo' and mac == zero_mac[:len(mac)]:
             continue
 +        if is_openvswitch_internal_interface(name):
 +            continue
-         ret.append((name, mac, device_driver(name), device_devid(name)))
+         # skip nics that have drivers blacklisted
-     return ret
+         driver = device_driver(name)
- 
+         if driver in blacklist_drivers:
 diff --git a/cloudinit/net/tests/test_init.py b/cloudinit/net/tests/test_init.py
 index 0535387a..946f8ee2 100644
 --- a/cloudinit/net/tests/test_init.py
@ -299,7 +283,7 @@ index 2bde1e3f..95fb9743 100644
     def test_phy_types(self):
 diff --git a/cloudinit/sources/tests/test_oracle.py b/cloudinit/sources/tests/test_oracle.py
-index 7bd23813..902d1e40 100644
+index a7bbdfd9..dcf33b9b 100644
 --- a/cloudinit/sources/tests/test_oracle.py
 +++ b/cloudinit/sources/tests/test_oracle.py
@@ -173,6 +173,10 @@ class TestIsPlatformViable(test_helpers.CiTestCase):
@ -449,10 +433,10 @@ index 6f830cc6..2e2b7847 100644
     with_logs = True
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
-index 844d5ba8..3607c5e3 100644
+index c67b5fcc..14d3462f 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
-@@ -2825,6 +2825,10 @@ iface eth1 inet dhcp
+@@ -2908,6 +2908,10 @@ iface eth1 inet dhcp
         self.assertEqual(0, mock_settle.call_count)
@ -463,7 +447,7 @@ index 844d5ba8..3607c5e3 100644
 class TestRhelSysConfigRendering(CiTestCase):
     with_logs = True
-@@ -3495,6 +3499,10 @@ USERCTL=no
+@@ -3592,6 +3596,10 @@ USERCTL=no
                 expected, self._render_and_read(network_config=v2data))
@ -474,7 +458,7 @@ index 844d5ba8..3607c5e3 100644
 class TestOpenSuseSysConfigRendering(CiTestCase):
     with_logs = True
-@@ -4859,6 +4867,10 @@ class TestNetRenderers(CiTestCase):
+@@ -5009,6 +5017,10 @@ class TestNetRenderers(CiTestCase):
             self.assertTrue(result)
@ -485,7 +469,7 @@ index 844d5ba8..3607c5e3 100644
 class TestGetInterfaces(CiTestCase):
     _data = {'bonds': ['bond1'],
              'bridges': ['bridge1'],
-@@ -5008,6 +5020,10 @@ class TestInterfaceHasOwnMac(CiTestCase):
+@@ -5158,6 +5170,10 @@ class TestInterfaceHasOwnMac(CiTestCase):
         self.assertFalse(interface_has_own_mac("eth0"))
@ -496,7 +480,7 @@ index 844d5ba8..3607c5e3 100644
 class TestGetInterfacesByMac(CiTestCase):
     _data = {'bonds': ['bond1'],
              'bridges': ['bridge1'],
-@@ -5164,6 +5180,10 @@ class TestInterfacesSorting(CiTestCase):
+@@ -5314,6 +5330,10 @@ class TestInterfacesSorting(CiTestCase):
             ['enp0s3', 'enp0s8', 'enp0s13', 'enp1s2', 'enp2s0', 'enp2s3'])
--- a/SOURCES/0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
+++ b/SOURCES/0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
@ -1,21 +1,7 @@
-From 93b48730e201bf374f75a3f71d8d6b28211016ba Mon Sep 17 00:00:00 2001
+From bec5fb60ffae3d1137c7261e5571c2751c5dda25 Mon Sep 17 00:00:00 2001
-From: Eduardo Otubo <otubo@redhat.com>
+From: James Falcon <TheRealFalcon@users.noreply.github.com>
-Date: Tue, 23 Mar 2021 16:14:16 +0100
+Date: Mon, 8 Mar 2021 14:09:47 -0600
-Subject: [PATCH] Fix requiring device-number on EC2 derivatives (#836)
+Subject: Fix requiring device-number on EC2 derivatives (#836)
 RH-Author: Eduardo Otubo <otubo@redhat.com>
 RH-MergeRequest: 3: Fix requiring device-number on EC2 derivatives (#836)
 RH-Commit: [1/1] f372b10d179a969fcf824db8a39bdea3befc4ef4 (eterell/cloud-init)
 RH-Bugzilla: 1942699
 RH-Acked-by: Acked-by: Mohammed Gamal <mgamal@redhat.com>
 RH-Acked-by: Acked-by: Vitaly Kuznetsov vkuznets@redhat.com
 RH-Acked-by: Acked-by: Cathy Avery cavery@redhat.com
 commit 9bd19645a61586b82e86db6f518dd05c3363b17f
 Author: James Falcon <TheRealFalcon@users.noreply.github.com>
 Date:   Mon Mar 8 14:09:47 2021 -0600
    Fix requiring device-number on EC2 derivatives (#836)
 #342 (70dbccbb) introduced the ability to determine route-metrics based on
 the `device-number` provided by the EC2 IMDS. Not all datasources that
@ -23,18 +9,16 @@ Date:   Mon Mar 8 14:09:47 2021 -0600
 `device-number` is not present.
 LP: #1917875
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/sources/DataSourceEc2.py            |  3 +-
 .../unittests/test_datasource/test_aliyun.py  | 30 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 diff --git a/cloudinit/sources/DataSourceEc2.py b/cloudinit/sources/DataSourceEc2.py
-index 1d09c12a..ce69d1b3 100644
+index 1930a509..a2105dc7 100644
 --- a/cloudinit/sources/DataSourceEc2.py
 +++ b/cloudinit/sources/DataSourceEc2.py
-@@ -764,13 +764,14 @@ def convert_ec2_metadata_network_config(
+@@ -765,13 +765,14 @@ def convert_ec2_metadata_network_config(
         netcfg['ethernets'][nic_name] = dev_config
         return netcfg
     # Apply network config for all nics and any secondary IPv4/v6 addresses
@ -51,7 +35,7 @@ index 1d09c12a..ce69d1b3 100644
         dev_config = {'dhcp4': True, 'dhcp4-overrides': dhcp_override,
                       'dhcp6': False,
 diff --git a/tests/unittests/test_datasource/test_aliyun.py b/tests/unittests/test_datasource/test_aliyun.py
-index b626229e..a57f86a1 100644
+index eb2828d5..cab1ac2b 100644
 --- a/tests/unittests/test_datasource/test_aliyun.py
 +++ b/tests/unittests/test_datasource/test_aliyun.py
@@ -7,6 +7,7 @@ from unittest import mock
--- a/SOURCES/ci-Add-config-modules-for-controlling-IBM-PowerVM-RMC.-.patch
+++ b/SOURCES/ci-Add-config-modules-for-controlling-IBM-PowerVM-RMC.-.patch
@ -1,496 +0,0 @@
 From c3a1b3a5d7abe51a1facbdae71aca4b2bca7d6aa Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Wed, 28 Oct 2020 20:43:33 +0100
 Subject: [PATCH 2/3] Add config modules for controlling IBM PowerVM RMC.
 (#584)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 12: Support for cloud-init config modules for PowerVM Hypervisor in Red Hat cloud-init
 RH-Commit: [1/1] d175c3607a8d4f473573ba0ce42e0f311dbc31ed (eterrell/cloud-init)
 RH-Bugzilla: 1886430
 commit f99d4f96b00a9cfec1c721d364cbfd728674e5dc (upstream/master)
 Author: Aman306 <45781773+Aman306@users.noreply.github.com>
 Date:   Wed Oct 28 23:36:09 2020 +0530
    Add config modules for controlling IBM PowerVM RMC. (#584)
    Reliable Scalable Cluster Technology (RSCT) is a set of software
    components that together provide a comprehensive clustering
    environment(RAS features) for IBM PowerVM based virtual machines. RSCT
    includes the Resource Monitoring and Control (RMC) subsystem. RMC is a
    generalized framework used for managing, monitoring, and manipulating
    resources. RMC runs as a daemon process on individual machines and needs
    creation of unique node id and restarts during VM boot.
    LP: #1895979
    Co-authored-by: Scott Moser <smoser@brickies.net>
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/config/cc_refresh_rmc_and_interface.py   | 159 +++++++++++++++++++++
 cloudinit/config/cc_reset_rmc.py                   | 143 ++++++++++++++++++
 config/cloud.cfg.tmpl                              |   2 +
 .../test_handler_refresh_rmc_and_interface.py      | 109 ++++++++++++++
 tools/.github-cla-signers                          |   1 +
 5 files changed, 414 insertions(+)
 create mode 100644 cloudinit/config/cc_refresh_rmc_and_interface.py
 create mode 100644 cloudinit/config/cc_reset_rmc.py
 create mode 100644 tests/unittests/test_handler/test_handler_refresh_rmc_and_interface.py
 diff --git a/cloudinit/config/cc_refresh_rmc_and_interface.py b/cloudinit/config/cc_refresh_rmc_and_interface.py
 new file mode 100644
 index 0000000..146758a
 --- /dev/null
 +++ b/cloudinit/config/cc_refresh_rmc_and_interface.py
@@ -0,0 +1,159 @@
 +# (c) Copyright IBM Corp. 2020 All Rights Reserved
 +#
 +# Author: Aman Kumar Sinha <amansi26@in.ibm.com>
 +#
 +# This file is part of cloud-init. See LICENSE file for license information.
 +
 +"""
 +Refresh IPv6 interface and RMC
 +------------------------------
 +**Summary:** Ensure Network Manager is not managing IPv6 interface
 +
 +This module is IBM PowerVM Hypervisor specific
 +
 +Reliable Scalable Cluster Technology (RSCT) is a set of software components
 +that together provide a comprehensive clustering environment(RAS features)
 +for IBM PowerVM based virtual machines. RSCT includes the Resource
 +Monitoring and Control (RMC) subsystem. RMC is a generalized framework used
 +for managing, monitoring, and manipulating resources. RMC runs as a daemon
 +process on individual machines and needs creation of unique node id and
 +restarts during VM boot.
 +More details refer
 +https://www.ibm.com/support/knowledgecenter/en/SGVKBA_3.2/admin/bl503_ovrv.htm
 +
 +This module handles
 +- Refreshing RMC
 +- Disabling NetworkManager from handling IPv6 interface, as IPv6 interface
 +  is used for communication between RMC daemon and PowerVM hypervisor.
 +
 +**Internal name:** ``cc_refresh_rmc_and_interface``
 +
 +**Module frequency:** per always
 +
 +**Supported distros:** RHEL
 +
 +"""
 +
 +from cloudinit import log as logging
 +from cloudinit.settings import PER_ALWAYS
 +from cloudinit import util
 +from cloudinit import subp
 +from cloudinit import netinfo
 +
 +import errno
 +
 +frequency = PER_ALWAYS
 +
 +LOG = logging.getLogger(__name__)
 +# Ensure that /opt/rsct/bin has been added to standard PATH of the
 +# distro. The symlink to rmcctrl is /usr/sbin/rsct/bin/rmcctrl .
 +RMCCTRL = 'rmcctrl'
 +
 +
 +def handle(name, _cfg, _cloud, _log, _args):
 +    if not subp.which(RMCCTRL):
 +        LOG.debug("No '%s' in path, disabled", RMCCTRL)
 +        return
 +
 +    LOG.debug(
 +        'Making the IPv6 up explicitly. '
 +        'Ensuring IPv6 interface is not being handled by NetworkManager '
 +        'and it is  restarted to re-establish the communication with '
 +        'the hypervisor')
 +
 +    ifaces = find_ipv6_ifaces()
 +
 +    # Setting NM_CONTROLLED=no for IPv6 interface
 +    # making it down and up
 +
 +    if len(ifaces) == 0:
 +        LOG.debug("Did not find any interfaces with ipv6 addresses.")
 +    else:
 +        for iface in ifaces:
 +            refresh_ipv6(iface)
 +            disable_ipv6(sysconfig_path(iface))
 +        restart_network_manager()
 +
 +
 +def find_ipv6_ifaces():
 +    info = netinfo.netdev_info()
 +    ifaces = []
 +    for iface, data in info.items():
 +        if iface == "lo":
 +            LOG.debug('Skipping localhost interface')
 +        if len(data.get("ipv4", [])) != 0:
 +            # skip this interface, as it has ipv4 addrs
 +            continue
 +        ifaces.append(iface)
 +    return ifaces
 +
 +
 +def refresh_ipv6(interface):
 +    # IPv6 interface is explicitly brought up, subsequent to which the
 +    # RMC services are restarted to re-establish the communication with
 +    # the hypervisor.
 +    subp.subp(['ip', 'link', 'set', interface, 'down'])
 +    subp.subp(['ip', 'link', 'set', interface, 'up'])
 +
 +
 +def sysconfig_path(iface):
 +    return '/etc/sysconfig/network-scripts/ifcfg-' + iface
 +
 +
 +def restart_network_manager():
 +    subp.subp(['systemctl', 'restart', 'NetworkManager'])
 +
 +
 +def disable_ipv6(iface_file):
 +    # Ensuring that the communication b/w the hypervisor and VM is not
 +    # interrupted due to NetworkManager. For this purpose, as part of
 +    # this function, the NM_CONTROLLED is explicitly set to No for IPV6
 +    # interface and NetworkManager is restarted.
 +    try:
 +        contents = util.load_file(iface_file)
 +    except IOError as e:
 +        if e.errno == errno.ENOENT:
 +            LOG.debug("IPv6 interface file %s does not exist\n",
 +                      iface_file)
 +        else:
 +            raise e
 +
 +    if 'IPV6INIT' not in contents:
 +        LOG.debug("Interface file %s did not have IPV6INIT", iface_file)
 +        return
 +
 +    LOG.debug("Editing interface file %s ", iface_file)
 +
 +    # Dropping any NM_CONTROLLED or IPV6 lines from IPv6 interface file.
 +    lines = contents.splitlines()
 +    lines = [line for line in lines if not search(line)]
 +    lines.append("NM_CONTROLLED=no")
 +
 +    with open(iface_file, "w") as fp:
 +        fp.write("\n".join(lines) + "\n")
 +
 +
 +def search(contents):
 +    # Search for any NM_CONTROLLED or IPV6 lines in IPv6 interface file.
 +    return(
 +        contents.startswith("IPV6ADDR") or
 +        contents.startswith("IPADDR6") or
 +        contents.startswith("IPV6INIT") or
 +        contents.startswith("NM_CONTROLLED"))
 +
 +
 +def refresh_rmc():
 +    # To make a healthy connection between RMC daemon and hypervisor we
 +    # refresh RMC. With refreshing RMC we are ensuring that making IPv6
 +    # down and up shouldn't impact communication between RMC daemon and
 +    # hypervisor.
 +    # -z : stop Resource Monitoring & Control subsystem and all resource
 +    # managers, but the command does not return control to the user
 +    # until the subsystem and all resource managers are stopped.
 +    # -s : start Resource Monitoring & Control subsystem.
 +    try:
 +        subp.subp([RMCCTRL, '-z'])
 +        subp.subp([RMCCTRL, '-s'])
 +    except Exception:
 +        util.logexc(LOG, 'Failed to refresh the RMC subsystem.')
 +        raise
 diff --git a/cloudinit/config/cc_reset_rmc.py b/cloudinit/config/cc_reset_rmc.py
 new file mode 100644
 index 0000000..1cd7277
 --- /dev/null
 +++ b/cloudinit/config/cc_reset_rmc.py
@@ -0,0 +1,143 @@
 +# (c) Copyright IBM Corp. 2020 All Rights Reserved
 +#
 +# Author: Aman Kumar Sinha <amansi26@in.ibm.com>
 +#
 +# This file is part of cloud-init. See LICENSE file for license information.
 +
 +
 +"""
 +Reset RMC
 +------------
 +**Summary:** reset rsct node id
 +
 +Reset RMC module is IBM PowerVM Hypervisor specific
 +
 +Reliable Scalable Cluster Technology (RSCT) is a set of software components,
 +that  together provide a comprehensive clustering environment (RAS features)
 +for IBM PowerVM based virtual machines. RSCT includes the Resource monitoring
 +and control (RMC) subsystem. RMC is a generalized framework used for managing,
 +monitoring, and manipulating resources. RMC runs as a daemon process on
 +individual machines and needs creation of unique node id and restarts
 +during VM boot.
 +More details refer
 +https://www.ibm.com/support/knowledgecenter/en/SGVKBA_3.2/admin/bl503_ovrv.htm
 +
 +This module handles
 +- creation of the unique RSCT node id to every instance/virtual machine
 +  and ensure once set, it isn't changed subsequently by cloud-init.
 +  In order to do so, it restarts RSCT service.
 +
 +Prerequisite of using this module is to install RSCT packages.
 +
 +**Internal name:** ``cc_reset_rmc``
 +
 +**Module frequency:** per instance
 +
 +**Supported distros:** rhel, sles and ubuntu
 +
 +"""
 +import os
 +
 +from cloudinit import log as logging
 +from cloudinit.settings import PER_INSTANCE
 +from cloudinit import util
 +from cloudinit import subp
 +
 +frequency = PER_INSTANCE
 +
 +# RMCCTRL is expected to be in system PATH (/opt/rsct/bin)
 +# The symlink for RMCCTRL and RECFGCT are
 +# /usr/sbin/rsct/bin/rmcctrl and
 +# /usr/sbin/rsct/install/bin/recfgct respectively.
 +RSCT_PATH = '/opt/rsct/install/bin'
 +RMCCTRL = 'rmcctrl'
 +RECFGCT = 'recfgct'
 +
 +LOG = logging.getLogger(__name__)
 +
 +NODE_ID_FILE = '/etc/ct_node_id'
 +
 +
 +def handle(name, _cfg, cloud, _log, _args):
 +    # Ensuring node id has to be generated only once during first boot
 +    if cloud.datasource.platform_type == 'none':
 +        LOG.debug('Skipping creation of new ct_node_id node')
 +        return
 +
 +    if not os.path.isdir(RSCT_PATH):
 +        LOG.debug("module disabled, RSCT_PATH not present")
 +        return
 +
 +    orig_path = os.environ.get('PATH')
 +    try:
 +        add_path(orig_path)
 +        reset_rmc()
 +    finally:
 +        if orig_path:
 +            os.environ['PATH'] = orig_path
 +        else:
 +            del os.environ['PATH']
 +
 +
 +def reconfigure_rsct_subsystems():
 +    # Reconfigure the RSCT subsystems, which includes removing all RSCT data
 +    # under the /var/ct directory, generating a new node ID, and making it
 +    # appear as if the RSCT components were just installed
 +    try:
 +        out = subp.subp([RECFGCT])[0]
 +        LOG.debug(out.strip())
 +        return out
 +    except subp.ProcessExecutionError:
 +        util.logexc(LOG, 'Failed to reconfigure the RSCT subsystems.')
 +        raise
 +
 +
 +def get_node_id():
 +    try:
 +        fp = util.load_file(NODE_ID_FILE)
 +        node_id = fp.split('\n')[0]
 +        return node_id
 +    except Exception:
 +        util.logexc(LOG, 'Failed to get node ID from file %s.' % NODE_ID_FILE)
 +        raise
 +
 +
 +def add_path(orig_path):
 +    # Adding the RSCT_PATH to env standard path
 +    # So thet cloud init automatically find and
 +    # run RECFGCT to create new node_id.
 +    suff = ":" + orig_path if orig_path else ""
 +    os.environ['PATH'] = RSCT_PATH + suff
 +    return os.environ['PATH']
 +
 +
 +def rmcctrl():
 +    # Stop the RMC subsystem and all resource managers so that we can make
 +    # some changes to it
 +    try:
 +        return subp.subp([RMCCTRL, '-z'])
 +    except Exception:
 +        util.logexc(LOG, 'Failed to stop the RMC subsystem.')
 +        raise
 +
 +
 +def reset_rmc():
 +    LOG.debug('Attempting to reset RMC.')
 +
 +    node_id_before = get_node_id()
 +    LOG.debug('Node ID at beginning of module: %s', node_id_before)
 +
 +    # Stop the RMC subsystem and all resource managers so that we can make
 +    # some changes to it
 +    rmcctrl()
 +    reconfigure_rsct_subsystems()
 +
 +    node_id_after = get_node_id()
 +    LOG.debug('Node ID at end of module: %s', node_id_after)
 +
 +    # Check if new node ID is generated or not
 +    # by comparing old and new node ID
 +    if node_id_after == node_id_before:
 +        msg = 'New node ID did not get generated.'
 +        LOG.error(msg)
 +        raise Exception(msg)
 diff --git a/config/cloud.cfg.tmpl b/config/cloud.cfg.tmpl
 index 2beb9b0..7171aaa 100644
 --- a/config/cloud.cfg.tmpl
 +++ b/config/cloud.cfg.tmpl
@@ -135,6 +135,8 @@ cloud_final_modules:
  - chef
  - mcollective
  - salt-minion
 + - reset_rmc
 + - refresh_rmc_and_interface
  - rightscale_userdata
  - scripts-vendor
  - scripts-per-once
 diff --git a/tests/unittests/test_handler/test_handler_refresh_rmc_and_interface.py b/tests/unittests/test_handler/test_handler_refresh_rmc_and_interface.py
 new file mode 100644
 index 0000000..e13b779
 --- /dev/null
 +++ b/tests/unittests/test_handler/test_handler_refresh_rmc_and_interface.py
@@ -0,0 +1,109 @@
 +from cloudinit.config import cc_refresh_rmc_and_interface as ccrmci
 +
 +from cloudinit import util
 +
 +from cloudinit.tests import helpers as t_help
 +from cloudinit.tests.helpers import mock
 +
 +from textwrap import dedent
 +import logging
 +
 +LOG = logging.getLogger(__name__)
 +MPATH = "cloudinit.config.cc_refresh_rmc_and_interface"
 +NET_INFO = {
 +    'lo': {'ipv4': [{'ip': '127.0.0.1',
 +                    'bcast': '', 'mask': '255.0.0.0',
 +                                 'scope': 'host'}],
 +           'ipv6': [{'ip': '::1/128',
 +                     'scope6': 'host'}], 'hwaddr': '',
 +           'up': 'True'},
 +    'env2': {'ipv4': [{'ip': '8.0.0.19',
 +                       'bcast': '8.0.0.255', 'mask': '255.255.255.0',
 +                                             'scope': 'global'}],
 +             'ipv6': [{'ip': 'fe80::f896:c2ff:fe81:8220/64',
 +                       'scope6': 'link'}], 'hwaddr': 'fa:96:c2:81:82:20',
 +             'up': 'True'},
 +    'env3': {'ipv4': [{'ip': '90.0.0.14',
 +                       'bcast': '90.0.0.255', 'mask': '255.255.255.0',
 +                                              'scope': 'global'}],
 +             'ipv6': [{'ip': 'fe80::f896:c2ff:fe81:8221/64',
 +                       'scope6': 'link'}], 'hwaddr': 'fa:96:c2:81:82:21',
 +             'up': 'True'},
 +    'env4': {'ipv4': [{'ip': '9.114.23.7',
 +                       'bcast': '9.114.23.255', 'mask': '255.255.255.0',
 +                                                'scope': 'global'}],
 +             'ipv6': [{'ip': 'fe80::f896:c2ff:fe81:8222/64',
 +                       'scope6': 'link'}], 'hwaddr': 'fa:96:c2:81:82:22',
 +             'up': 'True'},
 +    'env5': {'ipv4': [],
 +             'ipv6': [{'ip': 'fe80::9c26:c3ff:fea4:62c8/64',
 +                       'scope6': 'link'}], 'hwaddr': '42:20:86:df:fa:4c',
 +             'up': 'True'}}
 +
 +
 +class TestRsctNodeFile(t_help.CiTestCase):
 +    def test_disable_ipv6_interface(self):
 +        """test parsing of iface files."""
 +        fname = self.tmp_path("iface-eth5")
 +        util.write_file(fname, dedent("""\
 +            BOOTPROTO=static
 +            DEVICE=eth5
 +            HWADDR=42:20:86:df:fa:4c
 +            IPV6INIT=yes
 +            IPADDR6=fe80::9c26:c3ff:fea4:62c8/64
 +            IPV6ADDR=fe80::9c26:c3ff:fea4:62c8/64
 +            NM_CONTROLLED=yes
 +            ONBOOT=yes
 +            STARTMODE=auto
 +            TYPE=Ethernet
 +            USERCTL=no
 +            """))
 +
 +        ccrmci.disable_ipv6(fname)
 +        self.assertEqual(dedent("""\
 +            BOOTPROTO=static
 +            DEVICE=eth5
 +            HWADDR=42:20:86:df:fa:4c
 +            ONBOOT=yes
 +            STARTMODE=auto
 +            TYPE=Ethernet
 +            USERCTL=no
 +            NM_CONTROLLED=no
 +            """), util.load_file(fname))
 +
 +    @mock.patch(MPATH + '.refresh_rmc')
 +    @mock.patch(MPATH + '.restart_network_manager')
 +    @mock.patch(MPATH + '.disable_ipv6')
 +    @mock.patch(MPATH + '.refresh_ipv6')
 +    @mock.patch(MPATH + '.netinfo.netdev_info')
 +    @mock.patch(MPATH + '.subp.which')
 +    def test_handle(self, m_refresh_rmc,
 +                    m_netdev_info, m_refresh_ipv6, m_disable_ipv6,
 +                    m_restart_nm, m_which):
 +        """Basic test of handle."""
 +        m_netdev_info.return_value = NET_INFO
 +        m_which.return_value = '/opt/rsct/bin/rmcctrl'
 +        ccrmci.handle(
 +            "refresh_rmc_and_interface", None, None, None, None)
 +        self.assertEqual(1, m_netdev_info.call_count)
 +        m_refresh_ipv6.assert_called_with('env5')
 +        m_disable_ipv6.assert_called_with(
 +            '/etc/sysconfig/network-scripts/ifcfg-env5')
 +        self.assertEqual(1, m_restart_nm.call_count)
 +        self.assertEqual(1, m_refresh_rmc.call_count)
 +
 +    @mock.patch(MPATH + '.netinfo.netdev_info')
 +    def test_find_ipv6(self, m_netdev_info):
 +        """find_ipv6_ifaces parses netdev_info returning those with ipv6"""
 +        m_netdev_info.return_value = NET_INFO
 +        found = ccrmci.find_ipv6_ifaces()
 +        self.assertEqual(['env5'], found)
 +
 +    @mock.patch(MPATH + '.subp.subp')
 +    def test_refresh_ipv6(self, m_subp):
 +        """refresh_ipv6 should ip down and up the interface."""
 +        iface = "myeth0"
 +        ccrmci.refresh_ipv6(iface)
 +        m_subp.assert_has_calls([
 +            mock.call(['ip', 'link', 'set', iface, 'down']),
 +            mock.call(['ip', 'link', 'set', iface, 'up'])])
 diff --git a/tools/.github-cla-signers b/tools/.github-cla-signers
 index c67db43..802a35b 100644
 --- a/tools/.github-cla-signers
 +++ b/tools/.github-cla-signers
@@ -1,4 +1,5 @@
 AlexBaranowski
 +Aman306
 beezly
 bipinbachhao
 BirknerAlex
 -- 
 1.8.3.1
--- a/SOURCES/ci-Adding-BOOTPROTO-dhcp-to-render-sysconfig-dhcp6-stat.patch
+++ b/SOURCES/ci-Adding-BOOTPROTO-dhcp-to-render-sysconfig-dhcp6-stat.patch
@ -1,58 +0,0 @@
 From 8a7d21fa739901bad847294004266dba76c027af Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Tue, 1 Dec 2020 15:51:47 +0100
 Subject: [PATCH 2/4] Adding BOOTPROTO = dhcp to render sysconfig dhcp6
 stateful on RHEL (#685)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 25: Adding BOOTPROTO = dhcp to render sysconfig dhcp6 stateful on RHEL (#685)
 RH-Commit: [1/1] b7304323096b1e40287950e44cf7aa3cdb4ba99e (eterrell/cloud-init)
 RH-Bugzilla: 1859695
 BOOTPROTO needs to be set to 'dhcp' on RHEL so NetworkManager can
 properly acquire ipv6 address.
 rhbz: #1859695
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Co-authored-by: Daniel Watkins <oddbloke@ubuntu.com>
 Co-authored-by: Scott Moser <smoser@brickies.net>
 ---
 cloudinit/net/sysconfig.py  | 6 ++++++
 tests/unittests/test_net.py | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
 index 078636a4..94801a93 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
@@ -391,6 +391,12 @@ class Renderer(renderer.Renderer):
                         # Only IPv6 is DHCP, IPv4 may be static
                         iface_cfg['BOOTPROTO'] = 'dhcp6'
                     iface_cfg['DHCLIENT6_MODE'] = 'managed'
 +                # only if rhel AND dhcpv6 stateful
 +                elif (flavor == 'rhel' and
 +                        subnet_type == 'ipv6_dhcpv6-stateful'):
 +                    iface_cfg['BOOTPROTO'] = 'dhcp'
 +                    iface_cfg['DHCPV6C'] = True
 +                    iface_cfg['IPV6INIT'] = True
                 else:
                     iface_cfg['IPV6INIT'] = True
                     # Configure network settings using DHCPv6
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index c0337459..bcd261db 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -1359,7 +1359,7 @@ NETWORK_CONFIGS = {
         },
         'expected_sysconfig_rhel': {
             'ifcfg-iface0': textwrap.dedent("""\
 -            BOOTPROTO=none
 +            BOOTPROTO=dhcp
             DEVICE=iface0
             DHCPV6C=yes
             IPV6INIT=yes
 -- 
 2.18.4
--- a/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
+++ b/SOURCES/ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
@ -1,60 +0,0 @@
 From bcbd6be99d8317793aff905c4222c351a1bf5c46 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Thu, 21 Jan 2021 10:08:49 +0100
 Subject: [PATCH 1/2] DataSourceAzure: update password for defuser if exists
 (#671)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 37: DataSourceAzure: update password for defuser if exists (#671)
 RH-Commit: [1/1] 264092a68a3771cc4ed99dad5b93f7a1433e143a (eterrell/cloud-init)
 RH-Bugzilla: 1900892
 commit eea754492f074e00b601cf77aa278e3623857c5a
 Author: Anh Vo <anhvo@microsoft.com>
 Date:   Thu Nov 19 00:35:46 2020 -0500
    DataSourceAzure: update password for defuser if exists (#671)
    cc_set_password will only update the password for the default user if
    cfg['password'] is set. The existing code of datasource Azure will fail
    to update the default user's password because it does not set that
    metadata. If the default user doesn't exist in the image, the current
    code works fine because the password is set during user create and
    not in cc_set_password
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/sources/DataSourceAzure.py          | 2 +-
 tests/unittests/test_datasource/test_azure.py | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)
 diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
 index 1c214db9..d4a2d60f 100755
 --- a/cloudinit/sources/DataSourceAzure.py
 +++ b/cloudinit/sources/DataSourceAzure.py
@@ -1231,7 +1231,7 @@ def read_azure_ovf(contents):
     if password:
         defuser['lock_passwd'] = False
         if DEF_PASSWD_REDACTION != password:
 -            defuser['passwd'] = encrypt_pass(password)
 +            defuser['passwd'] = cfg['password'] = encrypt_pass(password)
     if defuser:
         cfg['system_info'] = {'default_user': defuser}
 diff --git a/tests/unittests/test_datasource/test_azure.py b/tests/unittests/test_datasource/test_azure.py
 index 47e03bd1..2059990a 100644
 --- a/tests/unittests/test_datasource/test_azure.py
 +++ b/tests/unittests/test_datasource/test_azure.py
@@ -919,6 +919,9 @@ scbus-1 on xpt0 bus 0
                          crypt.crypt(odata['UserPassword'],
                                      defuser['passwd'][0:pos]))
 +        # the same hashed value should also be present in cfg['password']
 +        self.assertEqual(defuser['passwd'], dsrc.cfg['password'])
 +
     def test_user_not_locked_if_password_redacted(self):
         odata = {'HostName': "myhost", 'UserName': "myuser",
                  'UserPassword': dsaz.DEF_PASSWD_REDACTION}
 -- 
 2.18.4
--- a/SOURCES/ci-Explicit-set-IPV6_AUTOCONF-and-IPV6_FORCE_ACCEPT_RA-.patch
+++ b/SOURCES/ci-Explicit-set-IPV6_AUTOCONF-and-IPV6_FORCE_ACCEPT_RA-.patch
@ -1,295 +0,0 @@
 From 5ded09d5acf4d653fe2cbd54814f53063d265489 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Thu, 29 Oct 2020 15:05:42 +0100
 Subject: [PATCH 1/3] Explicit set IPV6_AUTOCONF and IPV6_FORCE_ACCEPT_RA on
 static6 (#634)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 13: [RHEL-8.4.0] Add support for ipv6_autoconf on cloud-init-20.3
 RH-Commit: [1/1] 41e61c35893f4487981a1ad31f9f97a9a740b397 (eterrell/cloud-init)
 RH-Bugzilla: 1889635
 commit b46e4a8cff667c8441622089cf7d57aeb88220cd
 Author: Eduardo Otubo <otubo@redhat.com>
 Date:   Thu Oct 29 15:05:42 2020 +0100
    Explicit set IPV6_AUTOCONF and IPV6_FORCE_ACCEPT_RA on static6 (#634)
    The static and static6 subnet types for network_data.json were
    being ignored by the Openstack handler, this would cause the code to
    break and not function properly.
    As of today, if a static6 configuration is chosen, the interface will
    still eventually be available to receive router advertisements or be set
    from NetworkManager to wait for them and cycle the interface in negative
    case.
    It is safe to assume that if the interface is manually configured to use
    static ipv6 address, there's no need to wait for router advertisements.
    This patch will set automatically IPV6_AUTOCONF and IPV6_FORCE_ACCEPT_RA
    both to "no" in this case.
    This patch fixes the specific behavior only for RHEL flavor and
    sysconfig renderer. It also introduces new unit tests for the specific
    case as well as adjusts some existent tests to be compatible with the
    new options. This patch also addresses this problem by assigning the
    appropriate subnet type for each case on the openstack handler.
    rhbz: #1889635
    rhbz: #1889635
    Signed-off-by: Eduardo Otubo otubo@redhat.com
 Signed-off-by: Eduardo Otubo otubo@redhat.com
 ---
 cloudinit/net/network_state.py                 |   3 +-
 cloudinit/net/sysconfig.py                     |   4 +
 cloudinit/sources/helpers/openstack.py         |   8 +-
 tests/unittests/test_distros/test_netconfig.py |   2 +
 tests/unittests/test_net.py                    | 100 +++++++++++++++++++++++++
 5 files changed, 115 insertions(+), 2 deletions(-)
 diff --git a/cloudinit/net/network_state.py b/cloudinit/net/network_state.py
 index b2f7d31..d9e7fd5 100644
 --- a/cloudinit/net/network_state.py
 +++ b/cloudinit/net/network_state.py
@@ -820,7 +820,8 @@ def _normalize_subnet(subnet):
     if subnet.get('type') in ('static', 'static6'):
         normal_subnet.update(
 -            _normalize_net_keys(normal_subnet, address_keys=('address',)))
 +            _normalize_net_keys(normal_subnet, address_keys=(
 +                'address', 'ip_address',)))
     normal_subnet['routes'] = [_normalize_route(r)
                                for r in subnet.get('routes', [])]
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
 index af093dd..c078898 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
@@ -451,6 +451,10 @@ class Renderer(renderer.Renderer):
                             iface_cfg[mtu_key] = subnet['mtu']
                     else:
                         iface_cfg[mtu_key] = subnet['mtu']
 +
 +                if subnet_is_ipv6(subnet) and flavor == 'rhel':
 +                    iface_cfg['IPV6_FORCE_ACCEPT_RA'] = False
 +                    iface_cfg['IPV6_AUTOCONF'] = False
             elif subnet_type == 'manual':
                 if flavor == 'suse':
                     LOG.debug('Unknown subnet type setting "%s"', subnet_type)
 diff --git a/cloudinit/sources/helpers/openstack.py b/cloudinit/sources/helpers/openstack.py
 index 65e020c..3e6365f 100644
 --- a/cloudinit/sources/helpers/openstack.py
 +++ b/cloudinit/sources/helpers/openstack.py
@@ -602,11 +602,17 @@ def convert_net_json(network_json=None, known_macs=None):
             elif network['type'] in ['ipv6_slaac', 'ipv6_dhcpv6-stateless',
                                      'ipv6_dhcpv6-stateful']:
                 subnet.update({'type': network['type']})
 -            elif network['type'] in ['ipv4', 'ipv6']:
 +            elif network['type'] in ['ipv4', 'static']:
                 subnet.update({
                     'type': 'static',
                     'address': network.get('ip_address'),
                 })
 +            elif network['type'] in ['ipv6', 'static6']:
 +                cfg.update({'accept-ra': False})
 +                subnet.update({
 +                    'type': 'static6',
 +                    'address': network.get('ip_address'),
 +                })
             # Enable accept_ra for stateful and legacy ipv6_dhcp types
             if network['type'] in ['ipv6_dhcpv6-stateful', 'ipv6_dhcp']:
 diff --git a/tests/unittests/test_distros/test_netconfig.py b/tests/unittests/test_distros/test_netconfig.py
 index 8d7b09c..f9fc3a1 100644
 --- a/tests/unittests/test_distros/test_netconfig.py
 +++ b/tests/unittests/test_distros/test_netconfig.py
@@ -514,7 +514,9 @@ class TestNetCfgDistroRedhat(TestNetCfgDistroBase):
                 DEVICE=eth0
                 IPV6ADDR=2607:f0d0:1002:0011::2/64
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
                 IPV6_DEFAULTGW=2607:f0d0:1002:0011::1
 +                IPV6_FORCE_ACCEPT_RA=no
                 NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index 9985a97..d7a7a65 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -750,7 +750,9 @@ IPADDR=172.19.1.34
 IPV6ADDR=2001:DB8::10/64
 IPV6ADDR_SECONDARIES="2001:DB9::10/64 2001:DB10::10/64"
 IPV6INIT=yes
 +IPV6_AUTOCONF=no
 IPV6_DEFAULTGW=2001:DB8::1
 +IPV6_FORCE_ACCEPT_RA=no
 NETMASK=255.255.252.0
 ONBOOT=yes
 TYPE=Ethernet
@@ -1022,6 +1024,8 @@ NETWORK_CONFIGS = {
                 IPADDR=192.168.14.2
                 IPV6ADDR=2001:1::1/64
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
 +                IPV6_FORCE_ACCEPT_RA=no
                 NETMASK=255.255.255.0
                 ONBOOT=yes
                 TYPE=Ethernet
@@ -1247,6 +1251,33 @@ NETWORK_CONFIGS = {
             """),
         },
     },
 +    'static6': {
 +        'yaml': textwrap.dedent("""\
 +        version: 1
 +        config:
 +          - type: 'physical'
 +            name: 'iface0'
 +            accept-ra: 'no'
 +            subnets:
 +            - type: 'static6'
 +              address: 2001:1::1/64
 +    """).rstrip(' '),
 +        'expected_sysconfig_rhel': {
 +            'ifcfg-iface0': textwrap.dedent("""\
 +            BOOTPROTO=none
 +            DEVICE=iface0
 +            IPV6ADDR=2001:1::1/64
 +            IPV6INIT=yes
 +            IPV6_AUTOCONF=no
 +            IPV6_FORCE_ACCEPT_RA=no
 +            DEVICE=iface0
 +            NM_CONTROLLED=no
 +            ONBOOT=yes
 +            TYPE=Ethernet
 +            USERCTL=no
 +            """),
 +        },
 +    },
     'dhcpv6_stateless': {
         'expected_eni': textwrap.dedent("""\
         auto lo
@@ -1636,6 +1667,8 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 IPADDR=192.168.14.2
                 IPV6ADDR=2001:1::1/64
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
 +                IPV6_FORCE_ACCEPT_RA=no
                 IPV6_DEFAULTGW=2001:4800:78ff:1b::1
                 MACADDR=bb:bb:bb:bb:bb:aa
                 NETMASK=255.255.255.0
@@ -2158,6 +2191,8 @@ iface bond0 inet6 static
         IPADDR1=192.168.1.2
         IPV6ADDR=2001:1::1/92
         IPV6INIT=yes
 +        IPV6_AUTOCONF=no
 +        IPV6_FORCE_ACCEPT_RA=no
         MTU=9000
         NETMASK=255.255.255.0
         NETMASK1=255.255.255.0
@@ -2259,6 +2294,8 @@ iface bond0 inet6 static
                 IPADDR1=192.168.1.2
                 IPV6ADDR=2001:1::bbbb/96
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
 +                IPV6_FORCE_ACCEPT_RA=no
                 IPV6_DEFAULTGW=2001:1::1
                 MTU=2222
                 NETMASK=255.255.255.0
@@ -2341,6 +2378,9 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:00
                 IPV6ADDR=2001:1::100/96
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
 +                IPV6_FORCE_ACCEPT_RA=no
 +                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
@@ -2352,6 +2392,9 @@ iface bond0 inet6 static
                 HWADDR=52:54:00:12:34:01
                 IPV6ADDR=2001:1::101/96
                 IPV6INIT=yes
 +                IPV6_AUTOCONF=no
 +                IPV6_FORCE_ACCEPT_RA=no
 +                NM_CONTROLLED=no
                 ONBOOT=yes
                 TYPE=Ethernet
                 USERCTL=no
@@ -3151,6 +3194,61 @@ USERCTL=no
         self._compare_files_to_expected(entry[self.expected_name], found)
         self._assert_headers(found)
 +    def test_stattic6_from_json(self):
 +        net_json = {
 +            "services": [{"type": "dns", "address": "172.19.0.12"}],
 +            "networks": [{
 +                "network_id": "dacd568d-5be6-4786-91fe-750c374b78b4",
 +                "type": "ipv4", "netmask": "255.255.252.0",
 +                "link": "tap1a81968a-79",
 +                "routes": [{
 +                    "netmask": "0.0.0.0",
 +                    "network": "0.0.0.0",
 +                    "gateway": "172.19.3.254",
 +                }, {
 +                    "netmask": "0.0.0.0",  # A second default gateway
 +                    "network": "0.0.0.0",
 +                    "gateway": "172.20.3.254",
 +                }],
 +                "ip_address": "172.19.1.34", "id": "network0"
 +            }, {
 +                "network_id": "mgmt",
 +                "netmask": "ffff:ffff:ffff:ffff::",
 +                "link": "interface1",
 +                "mode": "link-local",
 +                "routes": [],
 +                "ip_address": "fe80::c096:67ff:fe5c:6e84",
 +                "type": "static6",
 +                "id": "network1",
 +                "services": [],
 +                "accept-ra": "false"
 +            }],
 +            "links": [
 +                {
 +                    "ethernet_mac_address": "fa:16:3e:ed:9a:59",
 +                    "mtu": None, "type": "bridge", "id":
 +                    "tap1a81968a-79",
 +                    "vif_id": "1a81968a-797a-400f-8a80-567f997eb93f"
 +                },
 +            ],
 +        }
 +        macs = {'fa:16:3e:ed:9a:59': 'eth0'}
 +        render_dir = self.tmp_dir()
 +        network_cfg = openstack.convert_net_json(net_json, known_macs=macs)
 +        ns = network_state.parse_net_config_data(network_cfg,
 +                                                 skip_broken=False)
 +        renderer = self._get_renderer()
 +        with self.assertRaises(ValueError):
 +            renderer.render_network_state(ns, target=render_dir)
 +        self.assertEqual([], os.listdir(render_dir))
 +
 +    def test_static6_from_yaml(self):
 +        entry = NETWORK_CONFIGS['static6']
 +        found = self._render_and_read(network_config=yaml.load(
 +            entry['yaml']))
 +        self._compare_files_to_expected(entry[self.expected_name], found)
 +        self._assert_headers(found)
 +
     def test_dhcpv6_reject_ra_config_v2(self):
         entry = NETWORK_CONFIGS['dhcpv6_reject_ra']
         found = self._render_and_read(network_config=yaml.load(
@@ -3268,6 +3366,8 @@ USERCTL=no
                    IPADDR=192.168.42.100
                    IPV6ADDR=2001:db8::100/32
                    IPV6INIT=yes
 +                   IPV6_AUTOCONF=no
 +                   IPV6_FORCE_ACCEPT_RA=no
                    IPV6_DEFAULTGW=2001:db8::1
                    NETMASK=255.255.255.0
                    NM_CONTROLLED=no
 -- 
 1.8.3.1
--- a/SOURCES/ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
+++ b/SOURCES/ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
@ -0,0 +1,262 @@
 From 71989367e7a634fdd2af8ef58473975e0ef60464 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Sat, 21 Aug 2021 13:53:27 +0200
 Subject: [PATCH] Fix home permissions modified by ssh module (SC-338) (#984)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 29: Fix home permissions modified by ssh module (SC-338) (#984)
 RH-Commit: [1/1] c409f2609b1d7e024eba77b55a196a4cafadd1d7 (eesposit/cloud-init)
 RH-Bugzilla: 1995840
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 TESTED: By me and QA
 BREW: 39178090
 Fix home permissions modified by ssh module (SC-338) (#984)
 commit 7d3f5d750f6111c2716143364ea33486df67c927
 Author: James Falcon <therealfalcon@gmail.com>
 Date:   Fri Aug 20 17:09:49 2021 -0500
    Fix home permissions modified by ssh module (SC-338) (#984)
    Fix home permissions modified by ssh module
    In #956, we updated the file and directory permissions for keys not in
    the user's home directory. We also unintentionally modified the
    permissions within the home directory as well. These should not change,
    and this commit changes that back.
    LP: #1940233
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/ssh_util.py                         |  35 ++++-
 .../modules/test_ssh_keysfile.py              | 132 +++++++++++++++---
 2 files changed, 146 insertions(+), 21 deletions(-)
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index b8a3c8f7..9ccadf09 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -321,23 +321,48 @@ def check_create_path(username, filename, strictmodes):
         home_folder = os.path.dirname(user_pwent.pw_dir)
         for directory in directories:
             parent_folder += "/" + directory
 -            if home_folder.startswith(parent_folder):
 +
 +            # security check, disallow symlinks in the AuthorizedKeysFile path.
 +            if os.path.islink(parent_folder):
 +                LOG.debug(
 +                    "Invalid directory. Symlink exists in path: %s",
 +                    parent_folder)
 +                return False
 +
 +            if os.path.isfile(parent_folder):
 +                LOG.debug(
 +                    "Invalid directory. File exists in path: %s",
 +                    parent_folder)
 +                return False
 +
 +            if (home_folder.startswith(parent_folder) or
 +                    parent_folder == user_pwent.pw_dir):
                 continue
 -            if not os.path.isdir(parent_folder):
 +            if not os.path.exists(parent_folder):
                 # directory does not exist, and permission so far are good:
                 # create the directory, and make it accessible by everyone
                 # but owned by root, as it might be used by many users.
                 with util.SeLinuxGuard(parent_folder):
 -                    os.makedirs(parent_folder, mode=0o755, exist_ok=True)
 -                    util.chownbyid(parent_folder, root_pwent.pw_uid,
 -                                   root_pwent.pw_gid)
 +                    mode = 0o755
 +                    uid = root_pwent.pw_uid
 +                    gid = root_pwent.pw_gid
 +                    if parent_folder.startswith(user_pwent.pw_dir):
 +                        mode = 0o700
 +                        uid = user_pwent.pw_uid
 +                        gid = user_pwent.pw_gid
 +                    os.makedirs(parent_folder, mode=mode, exist_ok=True)
 +                    util.chownbyid(parent_folder, uid, gid)
             permissions = check_permissions(username, parent_folder,
                                             filename, False, strictmodes)
             if not permissions:
                 return False
 +        if os.path.islink(filename) or os.path.isdir(filename):
 +            LOG.debug("%s is not a file!", filename)
 +            return False
 +
         # check the file
         if not os.path.exists(filename):
             # if file does not exist: we need to create it, since the
 diff --git a/tests/integration_tests/modules/test_ssh_keysfile.py b/tests/integration_tests/modules/test_ssh_keysfile.py
 index f82d7649..3159feb9 100644
 --- a/tests/integration_tests/modules/test_ssh_keysfile.py
 +++ b/tests/integration_tests/modules/test_ssh_keysfile.py
@@ -10,10 +10,10 @@ TEST_USER1_KEYS = get_test_rsa_keypair('test1')
 TEST_USER2_KEYS = get_test_rsa_keypair('test2')
 TEST_DEFAULT_KEYS = get_test_rsa_keypair('test3')
 -USERDATA = """\
 +_USERDATA = """\
 #cloud-config
 bootcmd:
 - - sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile /etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' /etc/ssh/sshd_config
 + - {bootcmd}
 ssh_authorized_keys:
  - {default}
 users:
@@ -24,27 +24,17 @@ users:
 - name: test_user2
   ssh_authorized_keys:
     - {user2}
 -""".format(  # noqa: E501
 +""".format(
 +    bootcmd='{bootcmd}',
     default=TEST_DEFAULT_KEYS.public_key,
     user1=TEST_USER1_KEYS.public_key,
     user2=TEST_USER2_KEYS.public_key,
 )
 -@pytest.mark.ubuntu
 -@pytest.mark.user_data(USERDATA)
 -def test_authorized_keys(client: IntegrationInstance):
 -    expected_keys = [
 -        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 -         TEST_USER1_KEYS),
 -        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 -         TEST_USER2_KEYS),
 -        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 -         TEST_DEFAULT_KEYS),
 -        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 -    ]
 -
 +def common_verify(client, expected_keys):
     for user, filename, keys in expected_keys:
 +        # Ensure key is in the key file
         contents = client.read_from_file(filename)
         if user in ['ubuntu', 'root']:
             # Our personal public key gets added by pycloudlib
@@ -83,3 +73,113 @@ def test_authorized_keys(client: IntegrationInstance):
                     look_for_keys=False,
                     allow_agent=False,
                 )
 +
 +        # Ensure we haven't messed with any /home permissions
 +        # See LP: #1940233
 +        home_dir = '/home/{}'.format(user)
 +        home_perms = '755'
 +        if user == 'root':
 +            home_dir = '/root'
 +            home_perms = '700'
 +        assert '{} {}'.format(user, home_perms) == client.execute(
 +            'stat -c "%U %a" {}'.format(home_dir)
 +        )
 +        if client.execute("test -d {}/.ssh".format(home_dir)).ok:
 +            assert '{} 700'.format(user) == client.execute(
 +                'stat -c "%U %a" {}/.ssh'.format(home_dir)
 +            )
 +        assert '{} 600'.format(user) == client.execute(
 +            'stat -c "%U %a" {}'.format(filename)
 +        )
 +
 +        # Also ensure ssh-keygen works as expected
 +        client.execute('mkdir {}/.ssh'.format(home_dir))
 +        assert client.execute(
 +            "ssh-keygen -b 2048 -t rsa -f {}/.ssh/id_rsa -q -N ''".format(
 +                home_dir)
 +        ).ok
 +        assert client.execute('test -f {}/.ssh/id_rsa'.format(home_dir))
 +        assert client.execute('test -f {}/.ssh/id_rsa.pub'.format(home_dir))
 +
 +    assert 'root 755' == client.execute('stat -c "%U %a" /home')
 +
 +
 +DEFAULT_KEYS_USERDATA = _USERDATA.format(bootcmd='""')
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(DEFAULT_KEYS_USERDATA)
 +def test_authorized_keys_default(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +AUTHORIZED_KEYS2_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(AUTHORIZED_KEYS2_USERDATA)
 +def test_authorized_keys2(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +NESTED_KEYS_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys %h/foo/bar/ssh/keys;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(NESTED_KEYS_USERDATA)
 +def test_nested_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/foo/bar/ssh/keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/foo/bar/ssh/keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/foo/bar/ssh/keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/foo/bar/ssh/keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 +
 +
 +EXTERNAL_KEYS_USERDATA = _USERDATA.format(bootcmd=(
 +    "sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile "
 +    "/etc/ssh/authorized_keys /etc/ssh/authorized_keys/%u/keys;' "
 +    "/etc/ssh/sshd_config"))
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(EXTERNAL_KEYS_USERDATA)
 +def test_external_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/etc/ssh/authorized_keys/test_user1/keys',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/etc/ssh/authorized_keys/test_user2/keys',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/etc/ssh/authorized_keys/ubuntu/keys',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/etc/ssh/authorized_keys/root/keys', TEST_DEFAULT_KEYS),
 +    ]
 +    common_verify(client, expected_keys)
 -- 
 2.27.0
--- a/SOURCES/ci-Fix-unit-failure-of-cloud-final.service-if-NetworkMa.patch
+++ b/SOURCES/ci-Fix-unit-failure-of-cloud-final.service-if-NetworkMa.patch
@ -1,61 +0,0 @@
 From d3889c4645a1319c3d677006164b618ee53f4c8b Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Mon, 7 Dec 2020 14:23:22 +0100
 Subject: [PATCH 3/4] Fix unit failure of cloud-final.service if NetworkManager
 was not present.
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 27: Fix unit failure of cloud-final.service if NetworkManager was not present.
 RH-Commit: [1/1] 3c65a2cca140fff48df1ef32919e3cb035506a2b (eterrell/cloud-init)
 RH-Bugzilla: 1898943
 cloud-final.service would fail if NetworkManager was not installed.
 journal -u cloud-final.service would show:
   cloud-init[5328]: Cloud-init v. 19.4 finished at ...
   echo[5346]: try restart NetworkManager.service
   systemctl[5349]: Failed to reload-or-try-restart
       NetworkManager.service: Unit not found.
   systemd[1]: cloud-final.service: control process exited,
       code=exited status=5
   systemd[1]: Failed to start Execute cloud user/final scripts.
   systemd[1]: Unit cloud-final.service entered failed state.
   systemd[1]: cloud-final.service failed.
 The change here is to only attempt to restart NetworkManager if it is
 present, and its SubState is 'running'.
 The multi-line shell in a systemd unit is less than ideal, but I'm not
 aware of any other way of conditionally doing this.
 Note that both of 'try-reload-or-restart' and 'reload-or-try-restart'
 will fail if the service is not present.  So this would also affect rhel
 8 systems that do not use NetworkManager.
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 rhel/systemd/cloud-final.service | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/rhel/systemd/cloud-final.service b/rhel/systemd/cloud-final.service
 index 05add077..e281c0cf 100644
 --- a/rhel/systemd/cloud-final.service
 +++ b/rhel/systemd/cloud-final.service
@@ -11,8 +11,11 @@ ExecStart=/usr/bin/cloud-init modules --mode=final
 RemainAfterExit=yes
 TimeoutSec=0
 KillMode=process
 -ExecStartPost=/bin/echo "trying to reload or restart NetworkManager.service"
 -ExecStartPost=/usr/bin/systemctl try-reload-or-restart NetworkManager.service
 +# Restart NetworkManager if it is present and running.
 +ExecStartPost=/bin/sh -c 'u=NetworkManager.service; \
 + out=$(systemctl show --property=SubState $u) || exit; \
 + [ "$out" = "SubState=running" ] || exit 0; \
 + systemctl reload-or-try-restart $u'
 # Output needs to appear in instance console output
 StandardOutput=journal+console
 -- 
 2.18.4
--- a/SOURCES/ci-Missing-IPV6_AUTOCONF-no-to-render-sysconfig-dhcp6-s.patch
+++ b/SOURCES/ci-Missing-IPV6_AUTOCONF-no-to-render-sysconfig-dhcp6-s.patch
@ -1,49 +0,0 @@
 From 15852ea6958c18e3830aa9244b36cd0decc93b95 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Thu, 7 Jan 2021 16:51:30 +0100
 Subject: [PATCH] Missing IPV6_AUTOCONF=no to render sysconfig dhcp6 stateful
 on RHEL (#753)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 29: Missing IPV6_AUTOCONF=no to render sysconfig dhcp6 stateful on RHEL (#753)
 RH-Commit: [1/1] 46943f83071d243bcc61f9d987b4fe7d9cf98596 (eterrell/cloud-init)
 RH-Bugzilla: 1859695
 IPV6_AUTOCONF needs to be set to 'no' on RHEL so NetworkManager can
 properly acquire ipv6 address.
 rhbz: #1859695
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/net/sysconfig.py  | 1 +
 tests/unittests/test_net.py | 1 +
 2 files changed, 2 insertions(+)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
 index 94801a93..1793977d 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
@@ -397,6 +397,7 @@ class Renderer(renderer.Renderer):
                     iface_cfg['BOOTPROTO'] = 'dhcp'
                     iface_cfg['DHCPV6C'] = True
                     iface_cfg['IPV6INIT'] = True
 +                    iface_cfg['IPV6_AUTOCONF'] = False
                 else:
                     iface_cfg['IPV6INIT'] = True
                     # Configure network settings using DHCPv6
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index bcd261db..844d5ba8 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -1363,6 +1363,7 @@ NETWORK_CONFIGS = {
             DEVICE=iface0
             DHCPV6C=yes
             IPV6INIT=yes
 +            IPV6_AUTOCONF=no
             IPV6_FORCE_ACCEPT_RA=yes
             DEVICE=iface0
             NM_CONTROLLED=no
 -- 
 2.18.4
--- a/SOURCES/ci-Revert-ssh_util-handle-non-default-AuthorizedKeysFil.patch
+++ b/SOURCES/ci-Revert-ssh_util-handle-non-default-AuthorizedKeysFil.patch
@ -1,80 +0,0 @@
 From 4dde2a9bed58aba13c730bf4a7314b21038d7a31 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Mon, 25 Jan 2021 16:24:29 +0100
 Subject: [PATCH 2/2] Revert "ssh_util: handle non-default AuthorizedKeysFile
 config (#586)" (#775)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 38: Revert "ssh_util: handle non-default AuthorizedKeysFile config (#586)" (#775)
 RH-Commit: [1/1] aec2860c773ad1921f3949dc622543e81860c5bf (eterrell/cloud-init)
 RH-Bugzilla: 1919972
 commit cdc5b81f33aee0ed3ef1ae239e5cec1906d0178a
 Author: Daniel Watkins <oddbloke@ubuntu.com>
 Date:   Tue Jan 19 12:23:23 2021 -0500
    Revert "ssh_util: handle non-default AuthorizedKeysFile config (#586)" (#775)
    This reverts commit b0e73814db4027dba0b7dc0282e295b7f653325c.
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/ssh_util.py           | 6 +++---
 tests/unittests/test_sshutil.py | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index d5113996..c08042d6 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -262,13 +262,13 @@ def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
         except (IOError, OSError):
             # Give up and use a default key filename
 -            auth_key_fns.append(default_authorizedkeys_file)
 +            auth_key_fns[0] = default_authorizedkeys_file
             util.logexc(LOG, "Failed extracting 'AuthorizedKeysFile' in SSH "
                         "config from %r, using 'AuthorizedKeysFile' file "
                         "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
 -    # always store all the keys in the first file configured on sshd_config
 -    return (auth_key_fns[0], parse_authorized_keys(auth_key_fns))
 +    # always store all the keys in the user's private file
 +    return (default_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 def setup_user_keys(keys, username, options=None):
 diff --git a/tests/unittests/test_sshutil.py b/tests/unittests/test_sshutil.py
 index 88a111e3..fd1d1bac 100644
 --- a/tests/unittests/test_sshutil.py
 +++ b/tests/unittests/test_sshutil.py
@@ -593,7 +593,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
             fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual(authorized_keys, auth_key_fn)
 +        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
@@ -610,7 +610,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
         sshd_config = self.tmp_path('sshd_config')
         util.write_file(
             sshd_config,
 -            "AuthorizedKeysFile %s %s" % (user_keys, authorized_keys)
 +            "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
         )
         (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
@@ -618,7 +618,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
         )
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
 -- 
 2.18.4
--- a/SOURCES/ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
+++ b/SOURCES/ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
--- a/SOURCES/ci-fix-a-typo-in-man-page-cloud-init.1-752.patch
+++ b/SOURCES/ci-fix-a-typo-in-man-page-cloud-init.1-752.patch
@ -1,53 +0,0 @@
 From c90d5c11eb99ec25e0fd90585bad9283e60bda7e Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Tue, 26 Jan 2021 10:48:55 +0100
 Subject: [PATCH] fix a typo in man page cloud-init.1 (#752)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 39: fix a typo in man page cloud-init.1 (#752)
 RH-Commit: [1/1] d2f7efbc63a7928ef175ac0714053dba20aab01a (eterrell/cloud-init)
 RH-Bugzilla: 1913127
 commit 48b2c5f16bd4ef754fef137ea19894908d4bf1db
 Author: Amy Chen <66719270+xiachen-rh@users.noreply.github.com>
 Date:   Wed Jan 6 22:37:02 2021 +0800
    fix a typo in man page cloud-init.1 (#752)
    1. fix a typo in cloud-init.1
    2. add xiachen-rh as contributor
 Conflict: We don't really use tools/.github-cla-signers, but had to fix
 a tiny conflict of already included names on the file.
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 doc/man/cloud-init.1      | 2 +-
 tools/.github-cla-signers | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
 diff --git a/doc/man/cloud-init.1 b/doc/man/cloud-init.1
 index 9b52dc8d..3fde4148 100644
 --- a/doc/man/cloud-init.1
 +++ b/doc/man/cloud-init.1
@@ -10,7 +10,7 @@ cloud-init \- Cloud instance initialization
 Cloud-init provides a mechanism for cloud instance initialization.
 This is done by identifying the cloud platform that is in use, reading
 provided cloud metadata and optional vendor and user
 -data, and then intializing the instance as requested.
 +data, and then initializing the instance as requested.
 Generally, this command is not normally meant to be run directly by
 the user. However, some subcommands may useful for development or
 diff --git a/tools/.github-cla-signers b/tools/.github-cla-signers
 index 802a35bd..e5d2b95c 100644
 --- a/tools/.github-cla-signers
 +++ b/tools/.github-cla-signers
@@ -21,3 +21,4 @@ sshedi
 TheRealFalcon
 tomponline
 tsanghan
 +xiachen-rh
 -- 
 2.18.4
--- a/SOURCES/ci-get_interfaces-don-t-exclude-Open-vSwitch-bridge-bon.patch
+++ b/SOURCES/ci-get_interfaces-don-t-exclude-Open-vSwitch-bridge-bon.patch
@ -1,150 +0,0 @@
 From a0601a472dc5b05106617b35b81d8a0578ade339 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Lukas=20M=C3=A4rdian?= <luk@slyon.de>
 Date: Thu, 29 Oct 2020 14:38:56 +0100
 Subject: [PATCH 1/2] get_interfaces: don't exclude Open vSwitch bridge/bond
 members (#608)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eduardo Otubo (otubo)
 RH-MergeRequest: 6: Patch series to fix "Bug 1957135 - Intermittent failure to start cloud-init due to failure to detect macs"
 RH-Commit: [1/2] 4362f855d2d1a250a7d18490b35e65a1133a00c2 (otubo/cloud-init)
 RH-Bugzilla: 1957135
 RH-Acked-by: Mohammed Gamal <mmorsy@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <[eesposit@redhat.com](mailto:eesposit@redhat.com>
 commit 3c432b32de1bdce2699525201396a8bbc6a41f3e
 Author: Lukas Märdian <luk@slyon.de>
 Date:   Thu Oct 29 14:38:56 2020 +0100
    get_interfaces: don't exclude Open vSwitch bridge/bond members (#608)
    If an OVS bridge was used as the only/primary interface, the 'init'
    stage failed with a "Not all expected physical devices present" error,
    leaving the system with a broken SSH setup.
    LP: #1898997
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/net/__init__.py        | 15 +++++++++++--
 cloudinit/net/tests/test_init.py | 36 +++++++++++++++++++++++++++++++-
 tools/.github-cla-signers        |  1 +
 3 files changed, 49 insertions(+), 3 deletions(-)
 diff --git a/cloudinit/net/__init__.py b/cloudinit/net/__init__.py
 index e233149a..0aa58b27 100644
 --- a/cloudinit/net/__init__.py
 +++ b/cloudinit/net/__init__.py
@@ -124,6 +124,15 @@ def master_is_bridge_or_bond(devname):
     return (os.path.exists(bonding_path) or os.path.exists(bridge_path))
 +def master_is_openvswitch(devname):
 +    """Return a bool indicating if devname's master is openvswitch"""
 +    master_path = get_master(devname)
 +    if master_path is None:
 +        return False
 +    ovs_path = sys_dev_path(devname, path="upper_ovs-system")
 +    return os.path.exists(ovs_path)
 +
 +
 def is_netfailover(devname, driver=None):
     """ netfailover driver uses 3 nics, master, primary and standby.
         this returns True if the device is either the primary or standby
@@ -855,8 +864,10 @@ def get_interfaces():
             continue
         if is_bond(name):
             continue
 -        if get_master(name) is not None and not master_is_bridge_or_bond(name):
 -            continue
 +        if get_master(name) is not None:
 +            if (not master_is_bridge_or_bond(name) and
 +                    not master_is_openvswitch(name)):
 +                continue
         if is_netfailover(name):
             continue
         mac = get_interface_mac(name)
 diff --git a/cloudinit/net/tests/test_init.py b/cloudinit/net/tests/test_init.py
 index 311ab6f8..0535387a 100644
 --- a/cloudinit/net/tests/test_init.py
 +++ b/cloudinit/net/tests/test_init.py
@@ -190,6 +190,28 @@ class TestReadSysNet(CiTestCase):
         self.assertTrue(net.master_is_bridge_or_bond('eth1'))
         self.assertTrue(net.master_is_bridge_or_bond('eth2'))
 +    def test_master_is_openvswitch(self):
 +        ovs_mac = 'bb:cc:aa:bb:cc:aa'
 +
 +        # No master => False
 +        write_file(os.path.join(self.sysdir, 'eth1', 'address'), ovs_mac)
 +
 +        self.assertFalse(net.master_is_bridge_or_bond('eth1'))
 +
 +        # masters without ovs-system => False
 +        write_file(os.path.join(self.sysdir, 'ovs-system', 'address'), ovs_mac)
 +
 +        os.symlink('../ovs-system', os.path.join(self.sysdir, 'eth1',
 +                   'master'))
 +
 +        self.assertFalse(net.master_is_openvswitch('eth1'))
 +
 +        # masters with ovs-system => True
 +        os.symlink('../ovs-system', os.path.join(self.sysdir, 'eth1',
 +                   'upper_ovs-system'))
 +
 +        self.assertTrue(net.master_is_openvswitch('eth1'))
 +
     def test_is_vlan(self):
         """is_vlan is True when /sys/net/devname/uevent has DEVTYPE=vlan."""
         ensure_file(os.path.join(self.sysdir, 'eth0', 'uevent'))
@@ -465,20 +487,32 @@ class TestGetInterfaceMAC(CiTestCase):
     ):
         bridge_mac = 'aa:bb:cc:aa:bb:cc'
         bond_mac = 'cc:bb:aa:cc:bb:aa'
 +        ovs_mac = 'bb:cc:aa:bb:cc:aa'
 +
         write_file(os.path.join(self.sysdir, 'br0', 'address'), bridge_mac)
         write_file(os.path.join(self.sysdir, 'br0', 'bridge'), '')
         write_file(os.path.join(self.sysdir, 'bond0', 'address'), bond_mac)
         write_file(os.path.join(self.sysdir, 'bond0', 'bonding'), '')
 +        write_file(os.path.join(self.sysdir, 'ovs-system', 'address'),
 +                   ovs_mac)
 +
         write_file(os.path.join(self.sysdir, 'eth1', 'address'), bridge_mac)
         os.symlink('../br0', os.path.join(self.sysdir, 'eth1', 'master'))
         write_file(os.path.join(self.sysdir, 'eth2', 'address'), bond_mac)
         os.symlink('../bond0', os.path.join(self.sysdir, 'eth2', 'master'))
 +        write_file(os.path.join(self.sysdir, 'eth3', 'address'), ovs_mac)
 +        os.symlink('../ovs-system', os.path.join(self.sysdir, 'eth3',
 +                   'master'))
 +        os.symlink('../ovs-system', os.path.join(self.sysdir, 'eth3',
 +                   'upper_ovs-system'))
 +
         interface_names = [interface[0] for interface in net.get_interfaces()]
 -        self.assertEqual(['eth1', 'eth2'], sorted(interface_names))
 +        self.assertEqual(['eth1', 'eth2', 'eth3', 'ovs-system'],
 +                         sorted(interface_names))
 class TestInterfaceHasOwnMAC(CiTestCase):
 diff --git a/tools/.github-cla-signers b/tools/.github-cla-signers
 index e5d2b95c..db55361a 100644
 --- a/tools/.github-cla-signers
 +++ b/tools/.github-cla-signers
@@ -16,6 +16,7 @@ matthewruffell
 nishigori
 omBratteng
 onitake
 +slyon
 smoser
 sshedi
 TheRealFalcon
 -- 
 2.27.0
--- a/SOURCES/ci-network-Fix-type-and-respect-name-when-rendering-vla.patch
+++ b/SOURCES/ci-network-Fix-type-and-respect-name-when-rendering-vla.patch
@ -1,247 +0,0 @@
 From 51a90ecbdf1f3900183d8ec641eeb4571decf6dc Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Wed, 4 Nov 2020 12:37:54 +0100
 Subject: [PATCH] network: Fix type and respect name when rendering vlan in
 sysconfig. (#541)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 19: network: Fix type and respect name when rendering vlan in sysconfig. (#541)
 RH-Commit: [1/1] 75bea46017397082c5763125a5f35806c2f840e9 (eterrell/cloud-init)
 RH-Bugzilla: 1881462
 commit 8439b191ec2f336d544cab86dba2860f969cd5b8
 Author: Eduardo Otubo <otubo@redhat.com>
 Date:   Tue Sep 15 18:00:00 2020 +0200
    network: Fix type and respect name when rendering vlan in sysconfig. (#541)
    Prior to this change, vlans were rendered in sysconfig with
    'TYPE=Ethernet', and incorrectly rendered the PHYSDEV based on
    the name of the vlan device rather than the 'link' provided
    in the network config.
    The change here fixes:
     * rendering of TYPE=Ethernet for a vlan
     * adds a warning if the configured device name is not supported
       per the RHEL 7 docs "11.5. Naming Scheme for VLAN Interfaces"
    LP: #1788915
    LP: #1826608
    RHBZ: #1861871
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/net/sysconfig.py                     | 32 +++++++++-
 tests/unittests/test_distros/test_netconfig.py | 81 ++++++++++++++++++++++++++
 tests/unittests/test_net.py                    |  4 --
 3 files changed, 112 insertions(+), 5 deletions(-)
 diff --git a/cloudinit/net/sysconfig.py b/cloudinit/net/sysconfig.py
 index c078898..078636a 100644
 --- a/cloudinit/net/sysconfig.py
 +++ b/cloudinit/net/sysconfig.py
@@ -99,6 +99,10 @@ class ConfigMap(object):
     def __len__(self):
         return len(self._conf)
 +    def skip_key_value(self, key, val):
 +        """Skip the pair key, value if it matches a certain rule."""
 +        return False
 +
     def to_string(self):
         buf = io.StringIO()
         buf.write(_make_header())
@@ -106,6 +110,8 @@ class ConfigMap(object):
             buf.write("\n")
         for key in sorted(self._conf.keys()):
             value = self._conf[key]
 +            if self.skip_key_value(key, value):
 +                continue
             if isinstance(value, bool):
                 value = self._bool_map[value]
             if not isinstance(value, str):
@@ -214,6 +220,7 @@ class NetInterface(ConfigMap):
         'bond': 'Bond',
         'bridge': 'Bridge',
         'infiniband': 'InfiniBand',
 +        'vlan': 'Vlan',
     }
     def __init__(self, iface_name, base_sysconf_dir, templates,
@@ -267,6 +274,11 @@ class NetInterface(ConfigMap):
             c.routes = self.routes.copy()
         return c
 +    def skip_key_value(self, key, val):
 +        if key == 'TYPE' and val == 'Vlan':
 +            return True
 +        return False
 +
 class Renderer(renderer.Renderer):
     """Renders network information in a /etc/sysconfig format."""
@@ -701,7 +713,16 @@ class Renderer(renderer.Renderer):
                 iface_cfg['ETHERDEVICE'] = iface_name[:iface_name.rfind('.')]
             else:
                 iface_cfg['VLAN'] = True
 -                iface_cfg['PHYSDEV'] = iface_name[:iface_name.rfind('.')]
 +                iface_cfg.kind = 'vlan'
 +
 +                rdev = iface['vlan-raw-device']
 +                supported = _supported_vlan_names(rdev, iface['vlan_id'])
 +                if iface_name not in supported:
 +                    LOG.info(
 +                        "Name '%s' for vlan '%s' is not officially supported"
 +                        "by RHEL. Supported: %s",
 +                        iface_name, rdev, ' '.join(supported))
 +                iface_cfg['PHYSDEV'] = rdev
             iface_subnets = iface.get("subnets", [])
             route_cfg = iface_cfg.routes
@@ -909,6 +930,15 @@ class Renderer(renderer.Renderer):
                             "\n".join(netcfg) + "\n", file_mode)
 +def _supported_vlan_names(rdev, vid):
 +    """Return list of supported names for vlan devices per RHEL doc
 +    11.5. Naming Scheme for VLAN Interfaces."""
 +    return [
 +        v.format(rdev=rdev, vid=int(vid))
 +        for v in ("{rdev}{vid:04}", "{rdev}{vid}",
 +                  "{rdev}.{vid:04}", "{rdev}.{vid}")]
 +
 +
 def available(target=None):
     sysconfig = available_sysconfig(target=target)
     nm = available_nm(target=target)
 diff --git a/tests/unittests/test_distros/test_netconfig.py b/tests/unittests/test_distros/test_netconfig.py
 index f9fc3a1..a1df066 100644
 --- a/tests/unittests/test_distros/test_netconfig.py
 +++ b/tests/unittests/test_distros/test_netconfig.py
@@ -541,6 +541,87 @@ class TestNetCfgDistroRedhat(TestNetCfgDistroBase):
                                V1_NET_CFG_IPV6,
                                expected_cfgs=expected_cfgs.copy())
 +    def test_vlan_render_unsupported(self):
 +        """Render officially unsupported vlan names."""
 +        cfg = {
 +            'version': 2,
 +            'ethernets': {
 +                'eth0': {'addresses': ["192.10.1.2/24"],
 +                         'match': {'macaddress': "00:16:3e:60:7c:df"}}},
 +            'vlans': {
 +                'infra0': {'addresses': ["10.0.1.2/16"],
 +                           'id': 1001, 'link': 'eth0'}},
 +        }
 +        expected_cfgs = {
 +            self.ifcfg_path('eth0'): dedent("""\
 +                BOOTPROTO=none
 +                DEVICE=eth0
 +                HWADDR=00:16:3e:60:7c:df
 +                IPADDR=192.10.1.2
 +                NETMASK=255.255.255.0
 +                NM_CONTROLLED=no
 +                ONBOOT=yes
 +                TYPE=Ethernet
 +                USERCTL=no
 +                """),
 +            self.ifcfg_path('infra0'): dedent("""\
 +                BOOTPROTO=none
 +                DEVICE=infra0
 +                IPADDR=10.0.1.2
 +                NETMASK=255.255.0.0
 +                NM_CONTROLLED=no
 +                ONBOOT=yes
 +                PHYSDEV=eth0
 +                USERCTL=no
 +                VLAN=yes
 +                """),
 +            self.control_path(): dedent("""\
 +                NETWORKING=yes
 +                """),
 +        }
 +        self._apply_and_verify(
 +            self.distro.apply_network_config, cfg,
 +            expected_cfgs=expected_cfgs)
 +
 +    def test_vlan_render(self):
 +        cfg = {
 +            'version': 2,
 +            'ethernets': {
 +                'eth0': {'addresses': ["192.10.1.2/24"]}},
 +            'vlans': {
 +                'eth0.1001': {'addresses': ["10.0.1.2/16"],
 +                              'id': 1001, 'link': 'eth0'}},
 +        }
 +        expected_cfgs = {
 +            self.ifcfg_path('eth0'): dedent("""\
 +                BOOTPROTO=none
 +                DEVICE=eth0
 +                IPADDR=192.10.1.2
 +                NETMASK=255.255.255.0
 +                NM_CONTROLLED=no
 +                ONBOOT=yes
 +                TYPE=Ethernet
 +                USERCTL=no
 +                """),
 +            self.ifcfg_path('eth0.1001'): dedent("""\
 +                BOOTPROTO=none
 +                DEVICE=eth0.1001
 +                IPADDR=10.0.1.2
 +                NETMASK=255.255.0.0
 +                NM_CONTROLLED=no
 +                ONBOOT=yes
 +                PHYSDEV=eth0
 +                USERCTL=no
 +                VLAN=yes
 +                """),
 +            self.control_path(): dedent("""\
 +                NETWORKING=yes
 +                """),
 +        }
 +        self._apply_and_verify(
 +            self.distro.apply_network_config, cfg,
 +            expected_cfgs=expected_cfgs)
 +
 class TestNetCfgDistroOpensuse(TestNetCfgDistroBase):
 diff --git a/tests/unittests/test_net.py b/tests/unittests/test_net.py
 index d7a7a65..c033745 100644
 --- a/tests/unittests/test_net.py
 +++ b/tests/unittests/test_net.py
@@ -1656,7 +1656,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 DHCLIENT_SET_DEFAULT_ROUTE=no
                 ONBOOT=yes
                 PHYSDEV=bond0
 -                TYPE=Ethernet
                 USERCTL=no
                 VLAN=yes"""),
             'ifcfg-br0': textwrap.dedent("""\
@@ -1699,7 +1698,6 @@ pre-down route del -net 10.0.0.0/8 gw 11.0.0.1 metric 3 || true
                 NETMASK1=255.255.255.0
                 ONBOOT=yes
                 PHYSDEV=eth0
 -                TYPE=Ethernet
                 USERCTL=no
                 VLAN=yes"""),
             'ifcfg-eth1': textwrap.dedent("""\
@@ -2302,7 +2300,6 @@ iface bond0 inet6 static
                 NETMASK1=255.255.255.0
                 ONBOOT=yes
                 PHYSDEV=en0
 -                TYPE=Ethernet
                 USERCTL=no
                 VLAN=yes"""),
         },
@@ -3409,7 +3406,6 @@ USERCTL=no
                 NM_CONTROLLED=no
                 ONBOOT=yes
                 PHYSDEV=eno1
 -                TYPE=Ethernet
                 USERCTL=no
                 VLAN=yes
                 """)
 -- 
 1.8.3.1
--- a/SOURCES/ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
+++ b/SOURCES/ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
@ -1,13 +1,14 @@
-From 569a19866bba846bbea8c99b9998336299570783 Mon Sep 17 00:00:00 2001
+From abf1adeae8211f5acd87dc63b03b2ed995047efd Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 20 May 2021 08:53:55 +0200
 Subject: [PATCH 1/2] rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and
 set in cloud.cfg
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-MergeRequest: 8: rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and set in cloud.cfg
+RH-MergeRequest: 10: rhel/cloud.cfg: remove ssh_genkeytypes in settings.py and set in cloud.cfg
-RH-Commit: [1/1] 9c39347a790360bc23c5ea3d8a34d0722d0cd1ac
+RH-Commit: [1/1] 6da989423b9b6e017afbac2f1af3649b0487310f
-RH-Bugzilla: 1963981
+RH-Bugzilla: 1957532
 RH-Acked-by: Eduardo Otubo <otubo@redhat.com>
 RH-Acked-by: Cathy Avery <cavery@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
@ -34,10 +35,10 @@ Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 2 files changed, 1 insertion(+), 3 deletions(-)
 diff --git a/cloudinit/settings.py b/cloudinit/settings.py
-index 439eee02..87398eec 100644
+index 43a1490c..2acf2615 100644
 --- a/cloudinit/settings.py
 +++ b/cloudinit/settings.py
-@@ -48,8 +48,6 @@ CFG_BUILTIN = {
+@@ -49,8 +49,6 @@ CFG_BUILTIN = {
     'def_log_file_mode': 0o600,
     'log_cfgs': [],
     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
--- a/SOURCES/ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
+++ b/SOURCES/ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
@ -0,0 +1,653 @@
 From aeab67600eb2d5e483812620b56ce5fb031a57d6 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 12 Jul 2021 21:47:37 +0200
 Subject: [PATCH] ssh-util: allow cloudinit to merge all ssh keys into a custom
 user file, defined in AuthorizedKeysFile (#937)
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 25: ssh-util: allow cloudinit to merge all ssh keys into a custom user file, defined in AuthorizedKeysFile (#937)
 RH-Commit: [1/1] 27bbe94f3b9dd8734865766bd30b06cff83383ab (eesposit/cloud-init)
 RH-Bugzilla: 1862967
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
 TESTED: By me and QA
 BREW: 38030830
 Conflicts: upstream patch modifies tests/integration_tests/util.py, that is
 not present in RHEL.
 commit 9b52405c6f0de5e00d5ee9c1d13540425d8f6bf5
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Mon Jul 12 20:21:02 2021 +0200
    ssh-util: allow cloudinit to merge all ssh keys into a custom user file, defined in AuthorizedKeysFile (#937)
    This patch aims to fix LP1911680, by analyzing the files provided
    in sshd_config and merge all keys into an user-specific file. Also
    introduces additional tests to cover this specific case.
    The file is picked by analyzing the path given in AuthorizedKeysFile.
    If it points inside the current user folder (path is /home/user/*), it
    means it is an user-specific file, so we can copy all user-keys there.
    If it contains a %u or %h, it means that there will be a specific
    authorized_keys file for each user, so we can copy all user-keys there.
    If no path points to an user-specific file, for example when only
    /etc/ssh/authorized_keys is given, default to ~/.ssh/authorized_keys.
    Note that if there are more than a single user-specific file, the last
    one will be picked.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Co-authored-by: James Falcon <therealfalcon@gmail.com>
    LP: #1911680
    RHBZ:1862967
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 cloudinit/ssh_util.py                         |  22 +-
 .../assets/keys/id_rsa.test1                  |  38 +++
 .../assets/keys/id_rsa.test1.pub              |   1 +
 .../assets/keys/id_rsa.test2                  |  38 +++
 .../assets/keys/id_rsa.test2.pub              |   1 +
 .../assets/keys/id_rsa.test3                  |  38 +++
 .../assets/keys/id_rsa.test3.pub              |   1 +
 .../modules/test_ssh_keysfile.py              |  85 ++++++
 tests/unittests/test_sshutil.py               | 246 +++++++++++++++++-
 9 files changed, 456 insertions(+), 14 deletions(-)
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test1
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test1.pub
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test2
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test2.pub
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test3
 create mode 100644 tests/integration_tests/assets/keys/id_rsa.test3.pub
 create mode 100644 tests/integration_tests/modules/test_ssh_keysfile.py
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index c08042d6..89057262 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -252,13 +252,15 @@ def render_authorizedkeysfile_paths(value, homedir, username):
 def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
     (ssh_dir, pw_ent) = users_ssh_info(username)
     default_authorizedkeys_file = os.path.join(ssh_dir, 'authorized_keys')
 +    user_authorizedkeys_file = default_authorizedkeys_file
     auth_key_fns = []
     with util.SeLinuxGuard(ssh_dir, recursive=True):
         try:
             ssh_cfg = parse_ssh_config_map(sshd_cfg_file)
 +            key_paths = ssh_cfg.get("authorizedkeysfile",
 +                                    "%h/.ssh/authorized_keys")
             auth_key_fns = render_authorizedkeysfile_paths(
 -                ssh_cfg.get("authorizedkeysfile", "%h/.ssh/authorized_keys"),
 -                pw_ent.pw_dir, username)
 +                key_paths, pw_ent.pw_dir, username)
         except (IOError, OSError):
             # Give up and use a default key filename
@@ -267,8 +269,22 @@ def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
                         "config from %r, using 'AuthorizedKeysFile' file "
                         "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
 +    # check if one of the keys is the user's one
 +    for key_path, auth_key_fn in zip(key_paths.split(), auth_key_fns):
 +        if any([
 +            '%u' in key_path,
 +            '%h' in key_path,
 +            auth_key_fn.startswith('{}/'.format(pw_ent.pw_dir))
 +        ]):
 +            user_authorizedkeys_file = auth_key_fn
 +
 +    if user_authorizedkeys_file != default_authorizedkeys_file:
 +        LOG.debug(
 +            "AuthorizedKeysFile has an user-specific authorized_keys, "
 +            "using %s", user_authorizedkeys_file)
 +
     # always store all the keys in the user's private file
 -    return (default_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 +    return (user_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 def setup_user_keys(keys, username, options=None):
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test1 b/tests/integration_tests/assets/keys/id_rsa.test1
 new file mode 100644
 index 00000000..bd4c822e
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test1
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEAtRlG96aJ23URvAgO/bBsuLl+lquc350aSwV98/i8vlvOn5GVcHye
 +t/rXQg4lZ4s0owG3kWyQFY8nvTk+G+UNU8fN0anAzBDi+4MzsejkF9scjTMFmXVrIpICqV
 +3bYQNjPv6r+ubQdkD01du3eB9t5/zl84gtshp0hBdofyz8u1/A25s7fVU67GyI7PdKvaS+
 +yvJSInZnb2e9VQzfJC+qAnN7gUZatBKjdgUtJeiUUeDaVnaS17b0aoT9iBO0sIcQtOTBlY
 +lCjFt1TAMLZ64Hj3SfGZB7Yj0Z+LzFB2IWX1zzsjI68YkYPKOSL/NYhQU9e55kJQ7WnngN
 +HY/2n/A7dNKSFDmgM5c9IWgeZ7fjpsfIYAoJ/CAxFIND+PEHd1gCS6xoEhaUVyh5WH/Xkw
 +Kv1nx4AiZ2BFCE+75kySRLZUJ+5y0r3DU5ktMXeURzVIP7pu0R8DCul+GU+M/+THyWtAEO
 +geaNJ6fYpo2ipDhbmTYt3kk2lMIapRxGBFs+37sdAAAFgGGJssNhibLDAAAAB3NzaC1yc2
 +EAAAGBALUZRvemidt1EbwIDv2wbLi5fparnN+dGksFffP4vL5bzp+RlXB8nrf610IOJWeL
 +NKMBt5FskBWPJ705PhvlDVPHzdGpwMwQ4vuDM7Ho5BfbHI0zBZl1ayKSAqld22EDYz7+q/
 +rm0HZA9NXbt3gfbef85fOILbIadIQXaH8s/LtfwNubO31VOuxsiOz3Sr2kvsryUiJ2Z29n
 +vVUM3yQvqgJze4FGWrQSo3YFLSXolFHg2lZ2kte29GqE/YgTtLCHELTkwZWJQoxbdUwDC2
 +euB490nxmQe2I9Gfi8xQdiFl9c87IyOvGJGDyjki/zWIUFPXueZCUO1p54DR2P9p/wO3TS
 +khQ5oDOXPSFoHme346bHyGAKCfwgMRSDQ/jxB3dYAkusaBIWlFcoeVh/15MCr9Z8eAImdg
 +RQhPu+ZMkkS2VCfuctK9w1OZLTF3lEc1SD+6btEfAwrpfhlPjP/kx8lrQBDoHmjSen2KaN
 +oqQ4W5k2Ld5JNpTCGqUcRgRbPt+7HQAAAAMBAAEAAAGBAJJCTOd70AC2ptEGbR0EHHqADT
 +Wgefy7A94tHFEqxTy0JscGq/uCGimaY7kMdbcPXT59B4VieWeAC2cuUPP0ZHQSfS5ke7oT
 +tU3N47U+0uBVbNS4rUAH7bOo2o9wptnOA5x/z+O+AARRZ6tEXQOd1oSy4gByLf2Wkh2QTi
 +vP6Hln1vlFgKEzcXg6G8fN3MYWxKRhWmZM3DLERMvorlqqSBLcs5VvfZfLKcsKWTExioAq
 +KgwEjYm8T9+rcpsw1xBus3j9k7wCI1Sus6PCDjq0pcYKLMYM7p8ygnU2tRYrOztdIxgWRA
 +w/1oenm1Mqq2tV5xJcBCwCLOGe6SFwkIRywOYc57j5McH98Xhhg9cViyyBdXy/baF0mro+
 +qPhOsWDxqwD4VKZ9UmQ6O8kPNKcc7QcIpFJhcO0g9zbp/MT0KueaWYrTKs8y4lUkTT7Xz6
 ++MzlR122/JwlAbBo6Y2kWtB+y+XwBZ0BfyJsm2czDhKm7OI5KfuBNhq0tFfKwOlYBq4QAA
 +AMAyvUof1R8LLISkdO3EFTKn5RGNkPPoBJmGs6LwvU7NSjjLj/wPQe4jsIBc585tvbrddp
 +60h72HgkZ5tqOfdeBYOKqX0qQQBHUEvI6M+NeQTQRev8bCHMLXQ21vzpClnrwNzlja359E
 +uTRfiPRwIlyPLhOUiClBDSAnBI9h82Hkk3zzsQ/xGfsPB7iOjRbW69bMRSVCRpeweCVmWC
 +77DTsEOq69V2TdljhQNIXE5OcOWonIlfgPiI74cdd+dLhzc/AAAADBAO1/JXd2kYiRyNkZ
 +aXTLcwiSgBQIYbobqVP3OEtTclr0P1JAvby3Y4cCaEhkenx+fBqgXAku5lKM+U1Q9AEsMk
 +cjIhaDpb43rU7GPjMn4zHwgGsEKd5pC1yIQ2PlK+cHanAdsDjIg+6RR+fuvid/mBeBOYXb
 +Py0sa3HyekLJmCdx4UEyNASoiNaGFLQVAqo+RACsXy6VMxFH5dqDYlvwrfUQLwxJmse9Vb
 +GEuuPAsklNugZqssC2XOIujFVUpslduQAAAMEAwzVHQVtsc3icCSzEAARpDTUdTbI29OhB
 +/FMBnjzS9/3SWfLuBOSm9heNCHs2jdGNb8cPdKZuY7S9Fx6KuVUPyTbSSYkjj0F4fTeC9g
 +0ym4p4UWYdF67WSWwLORkaG8K0d+G/CXkz8hvKUg6gcZWKBHAE1ROrHu1nsc8v7mkiKq4I
 +bnTw5Q9TgjbWcQWtgPq0wXyyl/K8S1SFdkMCTOHDD0RQ+jTV2WNGVwFTodIRHenX+Rw2g4
 +CHbTWbsFrHR1qFAAAACmphbWVzQG5ld3Q=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test1.pub b/tests/integration_tests/assets/keys/id_rsa.test1.pub
 new file mode 100644
 index 00000000..3d2e26e1
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test1.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC1GUb3ponbdRG8CA79sGy4uX6Wq5zfnRpLBX3z+Ly+W86fkZVwfJ63+tdCDiVnizSjAbeRbJAVjye9OT4b5Q1Tx83RqcDMEOL7gzOx6OQX2xyNMwWZdWsikgKpXdthA2M+/qv65tB2QPTV27d4H23n/OXziC2yGnSEF2h/LPy7X8Dbmzt9VTrsbIjs90q9pL7K8lIidmdvZ71VDN8kL6oCc3uBRlq0EqN2BS0l6JRR4NpWdpLXtvRqhP2IE7SwhxC05MGViUKMW3VMAwtnrgePdJ8ZkHtiPRn4vMUHYhZfXPOyMjrxiRg8o5Iv81iFBT17nmQlDtaeeA0dj/af8Dt00pIUOaAzlz0haB5nt+Omx8hgCgn8IDEUg0P48Qd3WAJLrGgSFpRXKHlYf9eTAq/WfHgCJnYEUIT7vmTJJEtlQn7nLSvcNTmS0xd5RHNUg/um7RHwMK6X4ZT4z/5MfJa0AQ6B5o0np9imjaKkOFuZNi3eSTaUwhqlHEYEWz7fux0= test1@host
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test2 b/tests/integration_tests/assets/keys/id_rsa.test2
 new file mode 100644
 index 00000000..5854d901
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test2
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEAvK50D2PWOc4ikyHVRJS6tDhqzjL5cKiivID4p1X8BYCVw83XAEGO
 +LnItUyVXHNADlh6fpVq1NY6A2JVtygoPF6ZFx8ph7IWMmnhDdnxLLyGsbhd1M1tiXJD/R+
 +3WnGHRJ4PKrQavMLgqHRrieV3QVVfjFSeo6jX/4TruP6ZmvITMZWJrXaGphxJ/pPykEdkO
 +i8AmKU9FNviojyPS2nNtj9B/635IdgWvrd7Vf5Ycsw9MR55LWSidwa856RH62Yl6LpEGTH
 +m1lJiMk1u88JPSqvohhaUkLKkFpcQwcB0m76W1KOyllJsmX8bNXrlZsI+WiiYI7Xl5vQm2
 +17DEuNeavtPAtDMxu8HmTg2UJ55Naxehbfe2lx2k5kYGGw3i1O1OVN2pZ2/OB71LucYd/5
 +qxPaz03wswcGOJYGPkNc40vdES/Scc7Yt8HsnZuzqkyOgzn0HiUCzoYUYLYTpLf+yGmwxS
 +yAEY056aOfkCsboKHOKiOmlJxNaZZFQkX1evep4DAAAFgC7HMbUuxzG1AAAAB3NzaC1yc2
 +EAAAGBALyudA9j1jnOIpMh1USUurQ4as4y+XCooryA+KdV/AWAlcPN1wBBji5yLVMlVxzQ
 +A5Yen6VatTWOgNiVbcoKDxemRcfKYeyFjJp4Q3Z8Sy8hrG4XdTNbYlyQ/0ft1pxh0SeDyq
 +0GrzC4Kh0a4nld0FVX4xUnqOo1/+E67j+mZryEzGVia12hqYcSf6T8pBHZDovAJilPRTb4
 +qI8j0tpzbY/Qf+t+SHYFr63e1X+WHLMPTEeeS1koncGvOekR+tmJei6RBkx5tZSYjJNbvP
 +CT0qr6IYWlJCypBaXEMHAdJu+ltSjspZSbJl/GzV65WbCPloomCO15eb0JttewxLjXmr7T
 +wLQzMbvB5k4NlCeeTWsXoW33tpcdpOZGBhsN4tTtTlTdqWdvzge9S7nGHf+asT2s9N8LMH
 +BjiWBj5DXONL3REv0nHO2LfB7J2bs6pMjoM59B4lAs6GFGC2E6S3/shpsMUsgBGNOemjn5
 +ArG6ChziojppScTWmWRUJF9Xr3qeAwAAAAMBAAEAAAGASj/kkEHbhbfmxzujL2/P4Sfqb+
 +aDXqAeGkwujbs6h/fH99vC5ejmSMTJrVSeaUo6fxLiBDIj6UWA0rpLEBzRP59BCpRL4MXV
 +RNxav/+9nniD4Hb+ug0WMhMlQmsH71ZW9lPYqCpfOq7ec8GmqdgPKeaCCEspH7HMVhfYtd
 +eHylwAC02lrpz1l5/h900sS5G9NaWR3uPA+xbzThDs4uZVkSidjlCNt1QZhDSSk7jA5n34
 +qJ5UTGu9WQDZqyxWKND+RIyQuFAPGQyoyCC1FayHO2sEhT5qHuumL14Mn81XpzoXFoKyql
 +rhBDe+pHhKArBYt92Evch0k1ABKblFxtxLXcvk4Fs7pHi+8k4+Cnazej2kcsu1kURlMZJB
 +w2QT/8BV4uImbH05LtyscQuwGzpIoxqrnHrvg5VbohStmhoOjYybzqqW3/M0qhkn5JgTiy
 +dJcHRJisRnAcmbmEchYtLDi6RW1e022H4I9AFXQqyr5HylBq6ugtWcFCsrcX8ibZ8xAAAA
 +wQCAOPgwae6yZLkrYzRfbxZtGKNmhpI0EtNSDCHYuQQapFZJe7EFENs/VAaIiiut0yajGj
 +c3aoKcwGIoT8TUM8E3GSNW6+WidUOC7H6W+/6N2OYZHRBACGz820xO+UBCl2oSk+dLBlfr
 +IQzBGUWn5uVYCs0/2nxfCdFyHtMK8dMF/ypbdG+o1rXz5y9b7PVG6Mn+o1Rjsdkq7VERmy
 +Pukd8hwATOIJqoKl3TuFyBeYFLqe+0e7uTeswQFw17PF31VjAAAADBAOpJRQb8c6qWqsvv
 +vkve0uMuL0DfWW0G6+SxjPLcV6aTWL5xu0Grd8uBxDkkHU/CDrAwpchXyuLsvbw21Eje/u
 +U5k9nLEscWZwcX7odxlK+EfAY2Bf5+Hd9bH5HMzTRJH8KkWK1EppOLPyiDxz4LZGzPLVyv
 +/1PgSuvXkSWk1KIE4SvSemyxGX2tPVI6uO+URqevfnPOS1tMB7BMQlgkR6eh4bugx9UYx9
 +mwlXonNa4dN0iQxZ7N4rKFBbT/uyB2bQAAAMEAzisnkD8k9Tn8uyhxpWLHwb03X4ZUUHDV
 +zu15e4a8dZ+mM8nHO986913Xz5JujlJKkGwFTvgWkIiR2zqTEauZHARH7gANpaweTm6lPd
 +E4p2S0M3ulY7xtp9lCFIrDhMPPkGq8SFZB6qhgucHcZSRLq6ZDou3S2IdNOzDTpBtkhRCS
 +0zFcdTLh3zZweoy8HGbW36bwB6s1CIL76Pd4F64i0Ms9CCCU6b+E5ArFhYQIsXiDbgHWbD
 +tZRSm2GEgnDGAvAAAACmphbWVzQG5ld3Q=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test2.pub b/tests/integration_tests/assets/keys/id_rsa.test2.pub
 new file mode 100644
 index 00000000..f3831a57
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test2.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8rnQPY9Y5ziKTIdVElLq0OGrOMvlwqKK8gPinVfwFgJXDzdcAQY4uci1TJVcc0AOWHp+lWrU1joDYlW3KCg8XpkXHymHshYyaeEN2fEsvIaxuF3UzW2JckP9H7dacYdEng8qtBq8wuCodGuJ5XdBVV+MVJ6jqNf/hOu4/pma8hMxlYmtdoamHEn+k/KQR2Q6LwCYpT0U2+KiPI9Lac22P0H/rfkh2Ba+t3tV/lhyzD0xHnktZKJ3BrznpEfrZiXoukQZMebWUmIyTW7zwk9Kq+iGFpSQsqQWlxDBwHSbvpbUo7KWUmyZfxs1euVmwj5aKJgjteXm9CbbXsMS415q+08C0MzG7weZODZQnnk1rF6Ft97aXHaTmRgYbDeLU7U5U3alnb84HvUu5xh3/mrE9rPTfCzBwY4lgY+Q1zjS90RL9Jxzti3weydm7OqTI6DOfQeJQLOhhRgthOkt/7IabDFLIARjTnpo5+QKxugoc4qI6aUnE1plkVCRfV696ngM= test2@host
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test3 b/tests/integration_tests/assets/keys/id_rsa.test3
 new file mode 100644
 index 00000000..2596c762
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test3
@@ -0,0 +1,38 @@
 +-----BEGIN OPENSSH PRIVATE KEY-----
 +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 +NhAAAAAwEAAQAAAYEApPG4MdkYQKD57/qreFrh9GRC22y66qZOWZWRjC887rrbvBzO69hV
 +yJpTIXleJEvpWiHYcjMR5G6NNFsnNtZ4fxDqmSc4vcFj53JsE/XNqLKq6psXadCb5vkNpG
 +bxA+Z5bJlzJ969PgJIIEbgc86sei4kgR2MuPWqtZbY5GkpNCTqWuLYeFK+14oFruA2nyWH
 +9MOIRDHK/d597psHy+LTMtymO7ZPhO571abKw6jvvwiSeDxVE9kV7KAQIuM9/S3gftvgQQ
 +ron3GL34pgmIabdSGdbfHqGDooryJhlbquJZELBN236KgRNTCAjVvUzjjQr1eRP3xssGwV
 +O6ECBGCQLl/aYogAgtwnwj9iXqtfiLK3EwlgjquU4+JQ0CVtLhG3gIZB+qoMThco0pmHTr
 +jtfQCwrztsBBFunSa2/CstuV1mQ5O5ZrZ6ACo9yPRBNkns6+CiKdtMtCtzi3k2RDz9jpYm
 +Pcak03Lr7IkdC1Tp6+jA+//yPHSO1o4CqW89IQzNAAAFgEUd7lZFHe5WAAAAB3NzaC1yc2
 +EAAAGBAKTxuDHZGECg+e/6q3ha4fRkQttsuuqmTlmVkYwvPO6627wczuvYVciaUyF5XiRL
 +6Voh2HIzEeRujTRbJzbWeH8Q6pknOL3BY+dybBP1zaiyquqbF2nQm+b5DaRm8QPmeWyZcy
 +fevT4CSCBG4HPOrHouJIEdjLj1qrWW2ORpKTQk6lri2HhSvteKBa7gNp8lh/TDiEQxyv3e
 +fe6bB8vi0zLcpju2T4Tue9WmysOo778Ikng8VRPZFeygECLjPf0t4H7b4EEK6J9xi9+KYJ
 +iGm3UhnW3x6hg6KK8iYZW6riWRCwTdt+ioETUwgI1b1M440K9XkT98bLBsFTuhAgRgkC5f
 +2mKIAILcJ8I/Yl6rX4iytxMJYI6rlOPiUNAlbS4Rt4CGQfqqDE4XKNKZh0647X0AsK87bA
 +QRbp0mtvwrLbldZkOTuWa2egAqPcj0QTZJ7OvgoinbTLQrc4t5NkQ8/Y6WJj3GpNNy6+yJ
 +HQtU6evowPv/8jx0jtaOAqlvPSEMzQAAAAMBAAEAAAGAGaqbdPZJNdVWzyb8g6/wtSzc0n
 +Qq6dSTIJGLonq/So69HpqFAGIbhymsger24UMGvsXBfpO/1wH06w68HWZmPa+OMeLOi4iK
 +WTuO4dQ/+l5DBlq32/lgKSLcIpb6LhcxEdsW9j9Mx1dnjc45owun/yMq/wRwH1/q/nLIsV
 +JD3R9ZcGcYNDD8DWIm3D17gmw+qbG7hJES+0oh4n0xS2KyZpm7LFOEMDVEA8z+hE/HbryQ
 +vjD1NC91n+qQWD1wKfN3WZDRwip3z1I5VHMpvXrA/spHpa9gzHK5qXNmZSz3/dfA1zHjCR
 +2dHjJnrIUH8nyPfw8t+COC+sQBL3Nr0KUWEFPRM08cOcQm4ctzg17aDIZBONjlZGKlReR8
 +1zfAw84Q70q2spLWLBLXSFblHkaOfijEbejIbaz2UUEQT27WD7RHAORdQlkx7eitk66T9d
 +DzIq/cpYhm5Fs8KZsh3PLldp9nsHbD2Oa9J9LJyI4ryuIW0mVwRdvPSiiYi3K+mDCpAAAA
 +wBe+ugEEJ+V7orb1f4Zez0Bd4FNkEc52WZL4CWbaCtM+ZBg5KnQ6xW14JdC8IS9cNi/I5P
 +yLsBvG4bWPLGgQruuKY6oLueD6BFnKjqF6ACUCiSQldh4BAW1nYc2U48+FFvo3ZQyudFSy
 +QEFlhHmcaNMDo0AIJY5Xnq2BG3nEX7AqdtZ8hhenHwLCRQJatDwSYBHDpSDdh9vpTnGp/2
 +0jBz25Ko4UANzvSAc3sA4yN3jfpoM366TgdNf8x3g1v7yljQAAAMEA0HSQjzH5nhEwB58k
 +mYYxnBYp1wb86zIuVhAyjZaeinvBQSTmLow8sXIHcCVuD3CgBezlU2SX5d9YuvRU9rcthi
 +uzn4wWnbnzYy4SwzkMJXchUAkumFVD8Hq5TNPh2Z+033rLLE08EhYypSeVpuzdpFoStaS9
 +3DUZA2bR/zLZI9MOVZRUcYImNegqIjOYHY8Sbj3/0QPV6+WpUJFMPvvedWhfaOsRMTA6nr
 +VLG4pxkrieVl0UtuRGbzD/exXhXVi7AAAAwQDKkJj4ez/+KZFYlZQKiV0BrfUFcgS6ElFM
 +2CZIEagCtu8eedrwkNqx2FUX33uxdvUTr4c9I3NvWeEEGTB9pgD4lh1x/nxfuhyGXtimFM
 +GnznGV9oyz0DmKlKiKSEGwWf5G+/NiiCwwVJ7wsQQm7TqNtkQ9b8MhWWXC7xlXKUs7dmTa
 +e8AqAndCCMEnbS1UQFO/R5PNcZXkFWDggLQ/eWRYKlrXgdnUgH6h0saOcViKpNJBUXb3+x
 +eauhOY52PS/BcAAAAKamFtZXNAbmV3dAE=
 +-----END OPENSSH PRIVATE KEY-----
 diff --git a/tests/integration_tests/assets/keys/id_rsa.test3.pub b/tests/integration_tests/assets/keys/id_rsa.test3.pub
 new file mode 100644
 index 00000000..057db632
 --- /dev/null
 +++ b/tests/integration_tests/assets/keys/id_rsa.test3.pub
@@ -0,0 +1 @@
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCk8bgx2RhAoPnv+qt4WuH0ZELbbLrqpk5ZlZGMLzzuutu8HM7r2FXImlMheV4kS+laIdhyMxHkbo00Wyc21nh/EOqZJzi9wWPncmwT9c2osqrqmxdp0Jvm+Q2kZvED5nlsmXMn3r0+AkggRuBzzqx6LiSBHYy49aq1ltjkaSk0JOpa4th4Ur7XigWu4DafJYf0w4hEMcr93n3umwfL4tMy3KY7tk+E7nvVpsrDqO+/CJJ4PFUT2RXsoBAi4z39LeB+2+BBCuifcYvfimCYhpt1IZ1t8eoYOiivImGVuq4lkQsE3bfoqBE1MICNW9TOONCvV5E/fGywbBU7oQIEYJAuX9piiACC3CfCP2Jeq1+IsrcTCWCOq5Tj4lDQJW0uEbeAhkH6qgxOFyjSmYdOuO19ALCvO2wEEW6dJrb8Ky25XWZDk7lmtnoAKj3I9EE2Sezr4KIp20y0K3OLeTZEPP2OliY9xqTTcuvsiR0LVOnr6MD7//I8dI7WjgKpbz0hDM0= test3@host
 diff --git a/tests/integration_tests/modules/test_ssh_keysfile.py b/tests/integration_tests/modules/test_ssh_keysfile.py
 new file mode 100644
 index 00000000..f82d7649
 --- /dev/null
 +++ b/tests/integration_tests/modules/test_ssh_keysfile.py
@@ -0,0 +1,85 @@
 +import paramiko
 +import pytest
 +from io import StringIO
 +from paramiko.ssh_exception import SSHException
 +
 +from tests.integration_tests.instances import IntegrationInstance
 +from tests.integration_tests.util import get_test_rsa_keypair
 +
 +TEST_USER1_KEYS = get_test_rsa_keypair('test1')
 +TEST_USER2_KEYS = get_test_rsa_keypair('test2')
 +TEST_DEFAULT_KEYS = get_test_rsa_keypair('test3')
 +
 +USERDATA = """\
 +#cloud-config
 +bootcmd:
 + - sed -i 's;#AuthorizedKeysFile.*;AuthorizedKeysFile /etc/ssh/authorized_keys %h/.ssh/authorized_keys2;' /etc/ssh/sshd_config
 +ssh_authorized_keys:
 + - {default}
 +users:
 +- default
 +- name: test_user1
 +  ssh_authorized_keys:
 +    - {user1}
 +- name: test_user2
 +  ssh_authorized_keys:
 +    - {user2}
 +""".format(  # noqa: E501
 +    default=TEST_DEFAULT_KEYS.public_key,
 +    user1=TEST_USER1_KEYS.public_key,
 +    user2=TEST_USER2_KEYS.public_key,
 +)
 +
 +
 +@pytest.mark.ubuntu
 +@pytest.mark.user_data(USERDATA)
 +def test_authorized_keys(client: IntegrationInstance):
 +    expected_keys = [
 +        ('test_user1', '/home/test_user1/.ssh/authorized_keys2',
 +         TEST_USER1_KEYS),
 +        ('test_user2', '/home/test_user2/.ssh/authorized_keys2',
 +         TEST_USER2_KEYS),
 +        ('ubuntu', '/home/ubuntu/.ssh/authorized_keys2',
 +         TEST_DEFAULT_KEYS),
 +        ('root', '/root/.ssh/authorized_keys2', TEST_DEFAULT_KEYS),
 +    ]
 +
 +    for user, filename, keys in expected_keys:
 +        contents = client.read_from_file(filename)
 +        if user in ['ubuntu', 'root']:
 +            # Our personal public key gets added by pycloudlib
 +            lines = contents.split('\n')
 +            assert len(lines) == 2
 +            assert keys.public_key.strip() in contents
 +        else:
 +            assert contents.strip() == keys.public_key.strip()
 +
 +        # Ensure we can actually connect
 +        ssh = paramiko.SSHClient()
 +        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
 +        paramiko_key = paramiko.RSAKey.from_private_key(StringIO(
 +            keys.private_key))
 +
 +        # Will fail with AuthenticationException if
 +        # we cannot connect
 +        ssh.connect(
 +            client.instance.ip,
 +            username=user,
 +            pkey=paramiko_key,
 +            look_for_keys=False,
 +            allow_agent=False,
 +        )
 +
 +        # Ensure other uses can't connect using our key
 +        other_users = [u[0] for u in expected_keys if u[2] != keys]
 +        for other_user in other_users:
 +            with pytest.raises(SSHException):
 +                print('trying to connect as {} with key from {}'.format(
 +                    other_user, user))
 +                ssh.connect(
 +                    client.instance.ip,
 +                    username=other_user,
 +                    pkey=paramiko_key,
 +                    look_for_keys=False,
 +                    allow_agent=False,
 +                )
 diff --git a/tests/unittests/test_sshutil.py b/tests/unittests/test_sshutil.py
 index fd1d1bac..bcb8044f 100644
 --- a/tests/unittests/test_sshutil.py
 +++ b/tests/unittests/test_sshutil.py
@@ -570,20 +570,33 @@ class TestBasicAuthorizedKeyParse(test_helpers.CiTestCase):
             ssh_util.render_authorizedkeysfile_paths(
                 "%h/.keys", "/homedirs/bobby", "bobby"))
 +    def test_all(self):
 +        self.assertEqual(
 +            ["/homedirs/bobby/.keys", "/homedirs/bobby/.secret/keys",
 +             "/keys/path1", "/opt/bobby/keys"],
 +            ssh_util.render_authorizedkeysfile_paths(
 +                "%h/.keys .secret/keys /keys/path1 /opt/%u/keys",
 +                "/homedirs/bobby", "bobby"))
 +
 class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
     @patch("cloudinit.ssh_util.pwd.getpwnam")
     def test_multiple_authorizedkeys_file_order1(self, m_getpwnam):
 -        fpw = FakePwEnt(pw_name='bobby', pw_dir='/home2/bobby')
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
         m_getpwnam.return_value = fpw
 -        authorized_keys = self.tmp_path('authorized_keys')
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
         util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 -        user_keys = self.tmp_path('user_keys')
 +        # /tmp/home2/bobby/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
         util.write_file(user_keys, VALID_CONTENT['dsa'])
 -        sshd_config = self.tmp_path('sshd_config')
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
         util.write_file(
             sshd_config,
             "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
@@ -593,33 +606,244 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
             fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
 +        self.assertEqual(user_keys, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
     @patch("cloudinit.ssh_util.pwd.getpwnam")
     def test_multiple_authorizedkeys_file_order2(self, m_getpwnam):
 -        fpw = FakePwEnt(pw_name='suzie', pw_dir='/home/suzie')
 +        fpw = FakePwEnt(pw_name='suzie', pw_dir='/tmp/home/suzie')
         m_getpwnam.return_value = fpw
 -        authorized_keys = self.tmp_path('authorized_keys')
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home/suzie/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
         util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 -        user_keys = self.tmp_path('user_keys')
 +        # /tmp/home/suzie/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
         util.write_file(user_keys, VALID_CONTENT['dsa'])
 -        sshd_config = self.tmp_path('sshd_config')
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
         util.write_file(
             sshd_config,
 -            "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
 +            "AuthorizedKeysFile %s %s" % (user_keys, authorized_keys)
         )
         (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 -            fpw.pw_name, sshd_config
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_local_global(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys = rsa
 +        authorized_keys = self.tmp_path('authorized_keys', dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +
 +        # /tmp/home2/bobby/.ssh/user_keys = dsa
 +        user_keys = self.tmp_path('user_keys', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %s %s" % (authorized_keys_global,
 +                                             user_keys, authorized_keys)
 +        )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_local_global2(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +
 +        # /tmp/home2/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +
 +        # /tmp/home2/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %s %s" % (authorized_keys_global,
 +                                             authorized_keys, user_keys)
 +        )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_global(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +
 +        # /tmp/etc/ssh/authorized_keys = rsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['rsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config')
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s" % (authorized_keys_global)
         )
 +
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
         self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_multiuser(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home2/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +        # /tmp/home2/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +        # /tmp/home2/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        fpw2 = FakePwEnt(pw_name='suzie', pw_dir='/tmp/home/suzie')
 +        user_ssh_folder = "%s/.ssh" % fpw2.pw_dir
 +        # /tmp/home/suzie/.ssh/authorized_keys2 = ssh-xmss@openssh.com
 +        authorized_keys2 = self.tmp_path('authorized_keys2',
 +                                         dir=user_ssh_folder)
 +        util.write_file(authorized_keys2,
 +                        VALID_CONTENT['ssh-xmss@openssh.com'])
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys2',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %%h/.ssh/authorized_keys2 %s" %
 +            (authorized_keys_global, user_keys)
 +        )
 +
 +        # process first user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['ssh-xmss@openssh.com'] in content)
 +
 +        m_getpwnam.return_value = fpw2
 +        # process second user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw2.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(authorized_keys2, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['ssh-xmss@openssh.com'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['rsa'] in content)
 +
 +    @patch("cloudinit.ssh_util.pwd.getpwnam")
 +    def test_multiple_authorizedkeys_file_multiuser2(self, m_getpwnam):
 +        fpw = FakePwEnt(pw_name='bobby', pw_dir='/tmp/home/bobby')
 +        m_getpwnam.return_value = fpw
 +        user_ssh_folder = "%s/.ssh" % fpw.pw_dir
 +        # /tmp/home/bobby/.ssh/authorized_keys2 = rsa
 +        authorized_keys = self.tmp_path('authorized_keys2',
 +                                        dir=user_ssh_folder)
 +        util.write_file(authorized_keys, VALID_CONTENT['rsa'])
 +        # /tmp/home/bobby/.ssh/user_keys3 = dsa
 +        user_keys = self.tmp_path('user_keys3', dir=user_ssh_folder)
 +        util.write_file(user_keys, VALID_CONTENT['dsa'])
 +
 +        fpw2 = FakePwEnt(pw_name='badguy', pw_dir='/tmp/home/badguy')
 +        user_ssh_folder = "%s/.ssh" % fpw2.pw_dir
 +        # /tmp/home/badguy/home/bobby = ""
 +        authorized_keys2 = self.tmp_path('home/bobby', dir="/tmp/home/badguy")
 +
 +        # /tmp/etc/ssh/authorized_keys = ecdsa
 +        authorized_keys_global = self.tmp_path('etc/ssh/authorized_keys2',
 +                                               dir="/tmp")
 +        util.write_file(authorized_keys_global, VALID_CONTENT['ecdsa'])
 +
 +        # /tmp/sshd_config
 +        sshd_config = self.tmp_path('sshd_config', dir="/tmp")
 +        util.write_file(
 +            sshd_config,
 +            "AuthorizedKeysFile %s %%h/.ssh/authorized_keys2 %s %s" %
 +            (authorized_keys_global, user_keys, authorized_keys2)
 +        )
 +
 +        # process first user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        self.assertEqual(user_keys, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['rsa'] in content)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
 +        self.assertTrue(VALID_CONTENT['dsa'] in content)
 +
 +        m_getpwnam.return_value = fpw2
 +        # process second user
 +        (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
 +            fpw2.pw_name, sshd_config)
 +        content = ssh_util.update_authorized_keys(auth_key_entries, [])
 +
 +        # badguy should not take the key from the other user!
 +        self.assertEqual(authorized_keys2, auth_key_fn)
 +        self.assertTrue(VALID_CONTENT['ecdsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
 +        self.assertFalse(VALID_CONTENT['rsa'] in content)
 # vi: ts=4 expandtab
 -- 
 2.27.0
--- a/SOURCES/ci-ssh_util-handle-non-default-AuthorizedKeysFile-confi.patch
+++ b/SOURCES/ci-ssh_util-handle-non-default-AuthorizedKeysFile-confi.patch
@ -1,98 +0,0 @@
 From b84a1e6d246bbb758f0530038612bd18eff71767 Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
 Date: Tue, 8 Dec 2020 13:27:22 +0100
 Subject: [PATCH 4/4] ssh_util: handle non-default AuthorizedKeysFile config
 (#586)
 RH-Author: Eduardo Terrell Ferrari Otubo (eterrell)
 RH-MergeRequest: 28: ssh_util: handle non-default AuthorizedKeysFile config (#586)
 RH-Commit: [1/1] f7ce396e3002c53a3504e653b58810efb956aa26 (eterrell/cloud-init)
 RH-Bugzilla: 1862967
 commit b0e73814db4027dba0b7dc0282e295b7f653325c
 Author: Eduardo Otubo <otubo@redhat.com>
 Date:   Tue Oct 20 18:04:59 2020 +0200
    ssh_util: handle non-default AuthorizedKeysFile config (#586)
    The following commit merged all ssh keys into a default user file
    `~/.ssh/authorized_keys` in sshd_config had multiple files configured for
    AuthorizedKeysFile:
    commit f1094b1a539044c0193165a41501480de0f8df14
    Author: Eduardo Otubo <otubo@redhat.com>
    Date:   Thu Dec 5 17:37:35 2019 +0100
        Multiple file fix for AuthorizedKeysFile config (#60)
    This commit ignored the case when sshd_config would have a single file for
    AuthorizedKeysFile, but a non default configuration, for example
    `~/.ssh/authorized_keys_foobar`. In this case cloud-init would grab all keys
    from this file and write a new one, the default `~/.ssh/authorized_keys`
    causing the bug.
    rhbz: #1862967
    Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/ssh_util.py           | 6 +++---
 tests/unittests/test_sshutil.py | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
 index c08042d6..d5113996 100644
 --- a/cloudinit/ssh_util.py
 +++ b/cloudinit/ssh_util.py
@@ -262,13 +262,13 @@ def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
         except (IOError, OSError):
             # Give up and use a default key filename
 -            auth_key_fns[0] = default_authorizedkeys_file
 +            auth_key_fns.append(default_authorizedkeys_file)
             util.logexc(LOG, "Failed extracting 'AuthorizedKeysFile' in SSH "
                         "config from %r, using 'AuthorizedKeysFile' file "
                         "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
 -    # always store all the keys in the user's private file
 -    return (default_authorizedkeys_file, parse_authorized_keys(auth_key_fns))
 +    # always store all the keys in the first file configured on sshd_config
 +    return (auth_key_fns[0], parse_authorized_keys(auth_key_fns))
 def setup_user_keys(keys, username, options=None):
 diff --git a/tests/unittests/test_sshutil.py b/tests/unittests/test_sshutil.py
 index fd1d1bac..88a111e3 100644
 --- a/tests/unittests/test_sshutil.py
 +++ b/tests/unittests/test_sshutil.py
@@ -593,7 +593,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
             fpw.pw_name, sshd_config)
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
 +        self.assertEqual(authorized_keys, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
@@ -610,7 +610,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
         sshd_config = self.tmp_path('sshd_config')
         util.write_file(
             sshd_config,
 -            "AuthorizedKeysFile %s %s" % (authorized_keys, user_keys)
 +            "AuthorizedKeysFile %s %s" % (user_keys, authorized_keys)
         )
         (auth_key_fn, auth_key_entries) = ssh_util.extract_authorized_keys(
@@ -618,7 +618,7 @@ class TestMultipleSshAuthorizedKeysFile(test_helpers.CiTestCase):
         )
         content = ssh_util.update_authorized_keys(auth_key_entries, [])
 -        self.assertEqual("%s/.ssh/authorized_keys" % fpw.pw_dir, auth_key_fn)
 +        self.assertEqual(user_keys, auth_key_fn)
         self.assertTrue(VALID_CONTENT['rsa'] in content)
         self.assertTrue(VALID_CONTENT['dsa'] in content)
 -- 
 2.18.4
--- a/SOURCES/ci-write-passwords-only-to-serial-console-lock-down-clo.patch
+++ b/SOURCES/ci-write-passwords-only-to-serial-console-lock-down-clo.patch
@ -1,13 +1,13 @@
-From 4c38c004b016a4f0f255af8a779a58e549068967 Mon Sep 17 00:00:00 2001
+From 769b9f8c9b1ecc294a197575108ae7cb54ad7f4b Mon Sep 17 00:00:00 2001
 From: Eduardo Otubo <otubo@redhat.com>
-Date: Mon, 5 Jul 2021 14:19:06 +0200
+Date: Mon, 5 Jul 2021 14:13:45 +0200
 Subject: [PATCH] write passwords only to serial console, lock down
 cloud-init-output.log (#847)
 RH-Author: Eduardo Otubo <otubo@redhat.com>
-RH-MergeRequest: 22: write passwords only to serial console, lock down cloud-init-output.log (#847)
+RH-MergeRequest: 21: write passwords only to serial console, lock down cloud-init-output.log (#847)
-RH-Commit: [1/1] db5da651f305f65f518a548bb57c4977b17b4070 (otubo/cloud-init)
+RH-Commit: [1/1] 8f30f2b7d0d6f9dca19994dbd0827b44e998f238 (otubo/cloud-init)
-RH-Bugzilla: 1979252
+RH-Bugzilla: 1945891
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
@ -45,12 +45,13 @@ Date:   Fri Mar 19 10:06:42 2021 -0400
 Signed-off-by: Eduardo Otubo <otubo@redhat.com>
 ---
 cloudinit/config/cc_set_passwords.py          |  5 +-
- cloudinit/config/tests/test_set_passwords.py |  40 ++++++--
+ cloudinit/config/tests/test_set_passwords.py  | 40 +++++++++----
- cloudinit/tests/test_util.py                 | 101 +++++++++++++++++++
+ cloudinit/tests/test_util.py                  | 56 +++++++++++++++++++
- cloudinit/util.py                            |  38 ++++++-
+ cloudinit/util.py                             | 38 +++++++++++--
- tests/integration_tests/test_logging.py      |  22 ++++
+ .../modules/test_set_password.py              | 24 ++++++++
- tests/unittests/test_util.py                 |   4 +
+ tests/integration_tests/test_logging.py       | 22 ++++++++
- 6 files changed, 194 insertions(+), 16 deletions(-)
+ tests/unittests/test_util.py                  |  4 ++
 7 files changed, 173 insertions(+), 16 deletions(-)
 create mode 100644 tests/integration_tests/test_logging.py
 diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
@ -144,58 +145,13 @@ index daa1ef51..bbe2ee8f 100644
 # vi: ts=4 expandtab
 diff --git a/cloudinit/tests/test_util.py b/cloudinit/tests/test_util.py
-index 096a3037..b8dfbf51 100644
+index b7a302f1..e811917e 100644
 --- a/cloudinit/tests/test_util.py
 +++ b/cloudinit/tests/test_util.py
-@@ -771,4 +771,105 @@ class TestMountCb:
+@@ -851,4 +851,60 @@ class TestEnsureFile:
-         ] == callback.call_args_list
+         assert "ab" == kwargs["omode"]
 +@mock.patch("cloudinit.util.write_file")
 +class TestEnsureFile:
 +    """Tests for ``cloudinit.util.ensure_file``."""
 +
 +    def test_parameters_passed_through(self, m_write_file):
 +        """Test the parameters in the signature are passed to write_file."""
 +        util.ensure_file(
 +            mock.sentinel.path,
 +            mode=mock.sentinel.mode,
 +            preserve_mode=mock.sentinel.preserve_mode,
 +        )
 +
 +        assert 1 == m_write_file.call_count
 +        args, kwargs = m_write_file.call_args
 +        assert (mock.sentinel.path,) == args
 +        assert mock.sentinel.mode == kwargs["mode"]
 +        assert mock.sentinel.preserve_mode == kwargs["preserve_mode"]
 +
 +    @pytest.mark.parametrize(
 +        "kwarg,expected",
 +        [
 +            # Files should be world-readable by default
 +            ("mode", 0o644),
 +            # The previous behaviour of not preserving mode should be retained
 +            ("preserve_mode", False),
 +        ],
 +    )
 +    def test_defaults(self, m_write_file, kwarg, expected):
 +        """Test that ensure_file defaults appropriately."""
 +        util.ensure_file(mock.sentinel.path)
 +
 +        assert 1 == m_write_file.call_count
 +        _args, kwargs = m_write_file.call_args
 +        assert expected == kwargs[kwarg]
 +
 +    def test_static_parameters_are_passed(self, m_write_file):
 +        """Test that the static write_files parameters are passed correctly."""
 +        util.ensure_file(mock.sentinel.path)
 +
 +        assert 1 == m_write_file.call_count
 +        _args, kwargs = m_write_file.call_args
 +        assert "" == kwargs["content"]
 +        assert "ab" == kwargs["omode"]
 +
 +
 +@mock.patch("cloudinit.util.grp.getgrnam")
 +@mock.patch("cloudinit.util.os.setgid")
 +@mock.patch("cloudinit.util.os.umask")
@ -254,10 +210,10 @@ index 096a3037..b8dfbf51 100644
 +
 # vi: ts=4 expandtab
 diff --git a/cloudinit/util.py b/cloudinit/util.py
-index cf9e349f..94cec6ee 100644
+index 769f3425..4e0a72db 100644
 --- a/cloudinit/util.py
 +++ b/cloudinit/util.py
-@@ -391,7 +391,7 @@ def find_modules(root_dir):
+@@ -359,7 +359,7 @@ def find_modules(root_dir):
 def multi_log(text, console=True, stderr=True,
@ -266,7 +222,7 @@ index cf9e349f..94cec6ee 100644
     if stderr:
         sys.stderr.write(text)
     if console:
-@@ -400,7 +400,7 @@ def multi_log(text, console=True, stderr=True,
+@@ -368,7 +368,7 @@ def multi_log(text, console=True, stderr=True,
             with open(conpath, 'w') as wfh:
                 wfh.write(text)
                 wfh.flush()
@ -275,7 +231,7 @@ index cf9e349f..94cec6ee 100644
             # A container may lack /dev/console (arguably a container bug).  If
             # it does not exist, then write output to stdout.  this will result
             # in duplicate stderr and stdout messages if stderr was True.
-@@ -650,6 +650,26 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
+@@ -623,6 +623,26 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
     if not o_err:
         o_err = sys.stderr
@ -302,7 +258,7 @@ index cf9e349f..94cec6ee 100644
     if outfmt:
         LOG.debug("Redirecting %s to %s", o_out, outfmt)
         (mode, arg) = outfmt.split(" ", 1)
-@@ -659,7 +679,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
+@@ -632,7 +652,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
                 owith = "wb"
             new_fp = open(arg, owith)
         elif mode == "|":
@ -316,7 +272,7 @@ index cf9e349f..94cec6ee 100644
             new_fp = proc.stdin
         else:
             raise TypeError("Invalid type for output format: %s" % outfmt)
-@@ -681,7 +706,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
+@@ -654,7 +679,12 @@ def redirect_output(outfmt, errfmt, o_out=None, o_err=None):
                 owith = "wb"
             new_fp = open(arg, owith)
         elif mode == "|":
@ -330,6 +286,41 @@ index cf9e349f..94cec6ee 100644
             new_fp = proc.stdin
         else:
             raise TypeError("Invalid type for error format: %s" % errfmt)
 diff --git a/tests/integration_tests/modules/test_set_password.py b/tests/integration_tests/modules/test_set_password.py
 index b13f76fb..d7cf91a5 100644
 --- a/tests/integration_tests/modules/test_set_password.py
 +++ b/tests/integration_tests/modules/test_set_password.py
@@ -116,6 +116,30 @@ class Mixin:
         # Which are not the same
         assert shadow_users["harry"] != shadow_users["dick"]
 +    def test_random_passwords_not_stored_in_cloud_init_output_log(
 +        self, class_client
 +    ):
 +        """We should not emit passwords to the in-instance log file.
 +
 +        LP: #1918303
 +        """
 +        cloud_init_output = class_client.read_from_file(
 +            "/var/log/cloud-init-output.log"
 +        )
 +        assert "dick:" not in cloud_init_output
 +        assert "harry:" not in cloud_init_output
 +
 +    def test_random_passwords_emitted_to_serial_console(self, class_client):
 +        """We should emit passwords to the serial console. (LP: #1918303)"""
 +        try:
 +            console_log = class_client.instance.console_log()
 +        except NotImplementedError:
 +            # Assume that an exception here means that we can't use the console
 +            # log
 +            pytest.skip("NotImplementedError when requesting console log")
 +        assert "dick:" in console_log
 +        assert "harry:" in console_log
 +
     def test_explicit_password_set_correctly(self, class_client):
         """Test that an explicitly-specified password is set correctly."""
         shadow_users, _ = self._fetch_and_parse_etc_shadow(class_client)
 diff --git a/tests/integration_tests/test_logging.py b/tests/integration_tests/test_logging.py
 new file mode 100644
 index 00000000..b31a0434
@ -359,10 +350,10 @@ index 00000000..b31a0434
 +        assert "root" == user
 +        assert "adm" == group
 diff --git a/tests/unittests/test_util.py b/tests/unittests/test_util.py
-index fc557469..9c51768d 100644
+index 857629f1..e5292001 100644
 --- a/tests/unittests/test_util.py
 +++ b/tests/unittests/test_util.py
-@@ -695,6 +695,10 @@ class TestMultiLog(helpers.FilesystemMockingTestCase):
+@@ -572,6 +572,10 @@ class TestMultiLog(helpers.FilesystemMockingTestCase):
         util.multi_log(logged_string)
         self.assertEqual(logged_string, self.stdout.getvalue())
--- a/SPECS/cloud-init.spec
+++ b/SPECS/cloud-init.spec
@ -5,8 +5,8 @@
 %global debug_package %{nil}
 Name:           cloud-init
-Version:        20.3
+Version:        21.1
-Release:        10%{?dist}.5.alma
+Release:        7%{?dist}.alma
 Summary:        Cloud instance init scripts
 Group:          System Environment/Base
@ -22,34 +22,18 @@ Patch0004: 0004-sysconfig-Don-t-write-BOOTPROTO-dhcp-for-ipv6-dhcp.patch
 Patch0005: 0005-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch
 Patch0006: 0006-include-NOZEROCONF-yes-in-etc-sysconfig-network.patch
 Patch0007: 0007-Remove-race-condition-between-cloud-init-and-Network.patch
-Patch8: ci-Explicit-set-IPV6_AUTOCONF-and-IPV6_FORCE_ACCEPT_RA-.patch
+Patch0008: 0008-net-exclude-OVS-internal-interfaces-in-get_interface.patch
-Patch9: ci-Add-config-modules-for-controlling-IBM-PowerVM-RMC.-.patch
+Patch0009: 0009-Fix-requiring-device-number-on-EC2-derivatives-836.patch
-# For bz#1881462 - [rhel8][cloud-init] ifup bond0.504 Error: Connection activation failed: No suitable device found for this connection
+# For bz#1957532 - [cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image
-Patch10: ci-network-Fix-type-and-respect-name-when-rendering-vla.patch
+Patch10: ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
-# For bz#1859695 - [Cloud-init] DHCPv6 assigned address is not added to VM's interface
+# For bz#1945891 - CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8]
-Patch11: ci-Adding-BOOTPROTO-dhcp-to-render-sysconfig-dhcp6-stat.patch
+Patch11: ci-write-passwords-only-to-serial-console-lock-down-clo.patch
 # For bz#1898943 - [rhel-8]cloud-final.service fails if NetworkManager not installed.
 Patch12: ci-Fix-unit-failure-of-cloud-final.service-if-NetworkMa.patch
 # For bz#1862967 - [cloud-init]Customize ssh AuthorizedKeysFile causes login failure
-Patch13: ci-ssh_util-handle-non-default-AuthorizedKeysFile-confi.patch
+Patch12: ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch
-# For bz#1859695 - [Cloud-init] DHCPv6 assigned address is not added to VM's interface
+# For bz#1862967 - [cloud-init]Customize ssh AuthorizedKeysFile causes login failure
-Patch14: ci-Missing-IPV6_AUTOCONF-no-to-render-sysconfig-dhcp6-s.patch
+Patch13: ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch
-# For bz#1900892 - [Azure] Update existing user password RHEL8x
+# For bz#1995840 - [cloudinit]  Fix home permissions modified by ssh module
-Patch15: ci-DataSourceAzure-update-password-for-defuser-if-exist.patch
+Patch14: ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch
 # For bz#1919972 - [RHEL-8.4] ssh keys can be shared across users giving potential root access
 Patch16: ci-Revert-ssh_util-handle-non-default-AuthorizedKeysFil.patch
 # For bz#1913127 - A typo in cloud-init man page
 Patch17: ci-fix-a-typo-in-man-page-cloud-init.1-752.patch
 # For bz#1942699 - [Aliyun][RHEL8.4][cloud-init] cloud-init service failed to start with Alibaba instance [rhel-8.4.0.z]
 Patch18: ci-Fix-requiring-device-number-on-EC2-derivatives-836.patch
 # For bz#1957135 - Intermittent failure to start cloud-init due to failure to detect macs [rhel-8.4.0.z]
 Patch19: ci-get_interfaces-don-t-exclude-Open-vSwitch-bridge-bon.patch
 # For bz#1957135 - Intermittent failure to start cloud-init due to failure to detect macs [rhel-8.4.0.z]
 Patch20: ci-net-exclude-OVS-internal-interfaces-in-get_interface.patch
 # For bz#1963981 - [cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image [rhel-8.4.0.z]
 Patch21: ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch
 # For bz#1979252 - CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8] [rhel-8.4.0.z]
 Patch22: ci-write-passwords-only-to-serial-console-lock-down-clo.patch
 # AlmaLinux patches
 Patch100: cloud-init-20.3-add_almalinux.patch
@ -100,6 +84,7 @@ Requires:       python3-six
 Requires:       shadow-utils
 Requires:       util-linux
 Requires:       xfsprogs
 Requires:       dhcp-client
 %{?systemd_requires}
@ -243,32 +228,46 @@ fi
 %config(noreplace) %{_sysconfdir}/rsyslog.d/21-cloudinit.conf
 %changelog
-* Wed Aug 11 2021 Andrew Lukoshko <alukoshko@almalinux.org> - 20.3-10.el8_4.5.alma
+* Fri Oct 08 2021 Andrew Lukoshko <alukoshko@almalinux.org> - 21.1-7.alma
 - AlmaLinux support
-* Thu Jul 15 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.5
+* Fri Aug 27 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-7
- ci-write-passwords-only-to-serial-console-lock-down-clo.patch [bz#1979252]
+- ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch [bz#1995840]
- Resolves: bz#1979252
+- Resolves: bz#1995840
-  (CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8] [rhel-8.4.0.z])
+  ([cloudinit]  Fix home permissions modified by ssh module)
-* Mon Jun 07 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.4
+* Wed Aug 11 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-6
- ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch [bz#1963981]
+- ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch [bz#1862967]
- ci-cloud-init.spec.template-update-systemd_postun-param.patch [bz#1967600]
+- Resolves: bz#1862967
- Resolves: bz#1963981
+  ([cloud-init]Customize ssh AuthorizedKeysFile causes login failure)
  ([cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image [rhel-8.4.0.z])
 - Resolves: bz#1967600
  (cloud-init brew build fails on Fedora 33 [rhel-8.4.0.z])
-* Thu May 13 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.3
+* Fri Aug 06 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-5
- ci-get_interfaces-don-t-exclude-Open-vSwitch-bridge-bon.patch [bz#1957135]
+- ci-Add-dhcp-client-as-a-dependency.patch [bz#1977385]
- ci-net-exclude-OVS-internal-interfaces-in-get_interface.patch [bz#1957135]
+- Resolves: bz#1977385
- Resolves: bz#1957135
+  ([Azure][RHEL-8] cloud-init must require dhcp-client on Azure)
  (Intermittent failure to start cloud-init due to failure to detect macs [rhel-8.4.0.z])
-* Tue Apr 06 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8_4.2
+* Mon Jul 19 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-4
- ci-Fix-requiring-device-number-on-EC2-derivatives-836.patch [bz#1942699]
+- ci-ssh-util-allow-cloudinit-to-merge-all-ssh-keys-into-.patch [bz#1862967]
- Resolves: bz#1942699
+- Resolves: bz#1862967
-  ([Aliyun][RHEL8.4][cloud-init] cloud-init service failed to start with Alibaba instance [rhel-8.4.0.z])
+  ([cloud-init]Customize ssh AuthorizedKeysFile causes login failure)
 * Mon Jul 12 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-3
 - ci-write-passwords-only-to-serial-console-lock-down-clo.patch [bz#1945891]
 - Resolves: bz#1945891
  (CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file [rhel-8])
 * Fri Jun 11 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-2
 - ci-rhel-cloud.cfg-remove-ssh_genkeytypes-in-settings.py.patch [bz#1957532]
 - ci-cloud-init.spec.template-update-systemd_postun-param.patch [bz#1952089]
 - Resolves: bz#1957532
  ([cloud-init] From RHEL 82+ cloud-init no longer displays sshd keys fingerprints from instance launched from a backup image)
 - Resolves: bz#1952089
  (cloud-init brew build fails on Fedora 33)
 * Thu May 27 2021 Miroslav Rezanina <mrezanin@redhat.com> - 21.1-1.el8
 - Rebaes to 21.1 [bz#1958174]
 - Resolves: bz#1958174
  ([RHEL-8.5.0] Rebase cloud-init to 21.1)
 * Tue Feb 02 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20.3-10.el8
 - ci-fix-a-typo-in-man-page-cloud-init.1-752.patch [bz#1913127]
Author	SHA1	Message	Date
eabdullin	2dcb114744	AlmaLinux changes	2021-11-17 14:47:32 +03:00
CentOS Sources	f2b347fb74	import cloud-init-21.1-7.el8	2021-11-09 09:53:06 +00:00
`@ -1 +1 @@`
	`cbde66f717b7883c4ab64b145042de54f131afab SOURCES/cloud-init-20.3.tar.gz`	`2ae378aa2ae23b34b0ff123623ba5e2fbdc4928d SOURCES/cloud-init-21.1.tar.gz`
`@ -1 +1 @@`
	`SOURCES/cloud-init-20.3.tar.gz`	`SOURCES/cloud-init-21.1.tar.gz`