yahoo-eng-team team mailing list archive

[Peter Surda <1931392@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

The documentation doesn't explain well how to use sanitized metadata
(that will show up in instance-data-sensitive.json rather than instance-
data.json) with jinja templates inside user-data. As far as I can see,
it doesn't work. The source code mentions two magic keys that are
sanitized: "merged_cfg" and "security-credentials". Defining variables
with these names inside meta-data correctly sanitizes them and only puts
them inside files only readable by root, however then they don't work
inside user-data as jinja templates (as "{{ds.meta_data.security-
credentials}}", for example), they are instead replaced by
CI_MISSING_JINJA_VAR. Using differently named variables makes the
template work, but they aren't sanitized in the logs/runtime files.

In what way, if any, this is supposed to work? Should I instead just
chmod the relevant log/runtime files through an entry in bootcmd?

** Affects: cloud-init
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to cloud-init.
https://bugs.launchpad.net/bugs/1931392

Title:
  sensitive metadata and jinja templates

Status in cloud-init:
  New

Bug description:
  The documentation doesn't explain well how to use sanitized metadata
  (that will show up in instance-data-sensitive.json rather than
  instance-data.json) with jinja templates inside user-data. As far as I
  can see, it doesn't work. The source code mentions two magic keys that
  are sanitized: "merged_cfg" and "security-credentials". Defining
  variables with these names inside meta-data correctly sanitizes them
  and only puts them inside files only readable by root, however then
  they don't work inside user-data as jinja templates (as
  "{{ds.meta_data.security-credentials}}", for example), they are
  instead replaced by CI_MISSING_JINJA_VAR. Using differently named
  variables makes the template work, but they aren't sanitized in the
  logs/runtime files.

  In what way, if any, this is supposed to work? Should I instead just
  chmod the relevant log/runtime files through an entry in bootcmd?

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-init/+bug/1931392/+subscriptions