如何在 nova 引导期间将 file/meta/ssh 密钥/root 密码/用户数据/配置驱动器注入 VM

- May 27, 2022

在 nova 启动期间，有可能将某些内容注入 VM，让我们逐个介绍它们：

以上测试是在Openstack Havana 2012.2.1 @CentOS 6.5 x86_64上完成的。

1. 前提条件

为了实现注入，需要在 nova 计算主机上使用 libguestfs。

yum install libguestfs python-libguestfs libguestfs-tools-c

配置nova.conf

libvirt_inject_password=true  
libvirt_inject_key=true  
libvirt_inject_partition=-1

重新启动新星计算

service openstack-nova-compute restart

2. 文件注入

让我们尝试注入 VM 作为/root/keystonerc/fileinject

[root@lcc-controller-1 ~]$ cat /root/keystonerc  
export OS_TENANT_NAME=admin  
export OS_USERNAME=admin  
export OS_PASSWORD=admin_pass  
export OS_AUTH_URL=”http://169.254.0.10:5000/v2.0/”
 
$nova boot  –flavor 1 –image cirros  –nic net-id=d58bbcac-1908-4cda-a9da-a13cfbbf4e77  –file /fileinject=/root/keystonerc vm-file-inject
 
#Loging to VM to check
 
$ ip netns exec qrouter-d667f653-c087-45b8-8c9c-e353f88a2c3d ssh cirros@10.0.0.2  
$ cat /fileinject
export OS_TENANT_NAME=admin  
export OS_USERNAME=admin  
export OS_PASSWORD=admin_pass  
export OS_AUTH_URL=”http://169.254.0.10:5000/v2.0/”

3. 元注入

让我们尝试注入 2 个元数据对，key1=test，key2=hello

nova boot  –flavor 1 –image cirros  –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74  –meta key1=test –meta key2=hello    vm-meta-inject
 
#Loging to VM to check
 
ip netns exec qrouter-d667f653-c087-45b8-8c9c-e353f88a2c3d ssh cirros@10.0.0.4
 
$ cat /meta.js  
{“key2”: “hello”, “key1”: “test”}

我们可以看到元数据键值对存储在 VM 中。/meta.js

4. 根密码注入

您可以通过libvirt密码注入或通过cloud-init + Nova元数据服务来执行此操作

4.1 Libvirt 密码注入。

这种方式需求在中配置。libvirt_inject_password=truenova.conf

默认情况下，创建root的随机密码并将其注入VM，从nova引导输出中，我们可以看到这个root密码：

$ nova boot –flavor 1 –image cirros –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74 –meta key1=test –meta key2=hello vm-meta-inject  
+————————————–+—————————————+  
| Property | Value |  
+————————————–+—————————————+  
| OS-EXT-STS:task_state | scheduling |  
| image | cirros |  
| OS-EXT-STS:vm_state | building |  
| OS-EXT-SRV-ATTR:instance_name | instance-0000001d |  
| OS-SRV-USG:launched_at | None |  
| flavor | m1.tiny |  
| id | e82bf7a2-176e-4f9f-83d5-c3542a7ed48e |  
| security_groups | [{u’name’: u’default’}] |  
| user_id | 25b9f5570f034feebf16e5f85e0fcc6b |  
| OS-DCF:diskConfig | MANUAL |  
| accessIPv4 | |  
| accessIPv6 | |  
| progress | 0 |  
| OS-EXT-STS:power_state | 0 |  
| OS-EXT-AZ:availability_zone | nova |  
| config_drive | |  
| status | BUILD |  
| updated | 2014-03-14T07:00:48Z |  
| hostId | |  
| OS-EXT-SRV-ATTR:host | None |  
| OS-SRV-USG:terminated_at | None |  
| key_name | None |  
| OS-EXT-SRV-ATTR:hypervisor_hostname | None |  
| name | vm-meta-inject |  
| adminPass | aPduEQ56Yu3t | 
| tenant_id | 1e888eccf99845f8bcf9a9730c83a669 |  
| created | 2014-03-14T07:00:48Z |  
| os-extended-volumes:volumes_attached | [] |  
| metadata | {u’key2′: u’hello’, u’key1′: u’test’} |  
+————————————–+—————————————+

随机生成的密码也可以从配置驱动器中检索，这将在本文后面提到。

启动VM时，我们还可以在Horizon GUI上自由设置root密码。

我们需要启用在地平线中设置管理员密码。local_settings.py

OPENSTACK_HYPERVISOR_FEATURES = {  
…  
‘can_set_password’: True,  
}

根密码地平线

注意：Nova CLI似乎不支持在nova启动期间设置root密码，如果Heat支持或以后不支持。

4.2 云初始化根密码注入

如果设置，root密码仍可由 cloud-init + Nova 元数据服务注入。这需要映像预安装云初始化。libvirt_inject_password=false

不过，如果您没有指定 root 密码，则会生成一个随机密码，并从 nova 引导输出中显示。

5. SSH密钥注入

两种方式注入SSH密钥，通过虚拟机管理程序或元数据服务+云初始化服务。

注意：只应使用两种方式中的一种，不应同时使用它们

5.1 通过虚拟机管理程序注入 SSH 密钥

如果 VM 中没有云初始化，则此方法有效。

创建密钥对：

nova keypair-add sshkey

Launch a VM with the keypair created above:

 nova boot –flavor 2 –image centos2 –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74 –key-name sshkey  centos-vm

Now try to login the VM with SSH key:

[root@lcc-controller-1 ~]$ ip netns exec qrouter-d667f653-c087-45b8-8c9c-e353f88a2c3d ssh -i sshkey.pem 10.0.0.9  
Last login: Fri Mar 14 15:36:25 2014 from 10.0.0.1  
[root@centos65cloudimage ~]#

5.2 SSH key injection by metadata service + cloudinit

To make this work, you need disable SSH key injection from nova.conf, and have cloud-init installed in VM.

Launch a VM with the keypair:

nova boot –flavor 2 –image centos2 –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74  –key-name sshkey  centos-metadata

Try to login to the VM with SSH key, since cloud-init only insert ssh key to user , we need to use this user to login:cloud-user

[root@lcc-controller-1 ~]$ ip netns exec qrouter-d667f653-c087-45b8-8c9c-e353f88a2c3d ssh -i sshkey.pem cloud-user@10.0.0.10  
[cloud-user@centos-metadata ~]$

Actually the SSH key is retrieved from Nova metadata service:

[cloud-user@centos-metadata ~]$ curl http://169.254.169.254/2009-04-04/meta-data/public-keys/0/openssh-key  
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvc9IUAlGukTLzaXgUMOZElGR8nMZlQ1TFppNrStQSMHd2rpqq/h2ZYHv/3Cz09zFTadO0QTWlqA9ZPnGgSWytjwvdfIQJb47jh/RZzyo1mJZYCkneE5wpviZ7Txe2BTFFNX8qUQksvg8plR4tGZFmWXc1SceMpwBoOdRFEcdjIXHOPPfU4J4NvpOJPrN9xEDMQmLsU5Sun7t1Gkg8UTnVZTweg79QXQfmXewTMx2LPwxXtsthS1hDoXYLulyxFpyVhZPOMZOipYcmr5wumpQhdBAPHRx0eocT5+6bkPtg2pBd1aKyl4oYUpuIW4b6md7TUINHE3qlqD3JNi49C1Oqw== Generated by Nova

Compare with , they are the same:~/.ssh/authorized_keys

[cloud-user@centos-metadata ~]$ cat .ssh/authorized_keys  
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvc9IUAlGukTLzaXgUMOZElGR8nMZlQ1TFppNrStQSMHd2rpqq/h2ZYHv/3Cz09zFTadO0QTWlqA9ZPnGgSWytjwvdfIQJb47jh/RZzyo1mJZYCkneE5wpviZ7Txe2BTFFNX8qUQksvg8plR4tGZFmWXc1SceMpwBoOdRFEcdjIXHOPPfU4J4NvpOJPrN9xEDMQmLsU5Sun7t1Gkg8UTnVZTweg79QXQfmXewTMx2LPwxXtsthS1hDoXYLulyxFpyVhZPOMZOipYcmr5wumpQhdBAPHRx0eocT5+6bkPtg2pBd1aKyl4oYUpuIW4b6md7TUINHE3qlqD3JNi49C1Oqw== Generated by Nova

6. Userdata injection

Userdata injection in also done by Nova metadata service

Launch a VM with a userdata file:

nova boot –flavor 2 –image centos2 –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74  –user-data /root/keystonerc  centos-userdata

Inside VM, retrieve the userdata by Nova metadata service:

[cloud-user@centos-user-data ~]$ curl http://169.254.169.254/2009-04-04/user-data  
export OS_TENANT_NAME=admin  
export OS_USERNAME=admin  
export OS_PASSWORD=admin_pass  
export OS_AUTH_URL=”http://169.254.0.10:5000/v2.0/”

With help of cloud-init or Heat, the userdata can be used in many ways to achieve some post-config steps when a VM is launched.

7. Config drive as alternative of metadata service

Config drive is an alternative of Nova metadata service, the metadata contents are written on a special drive attached to VM, inside VM, you can mount and read metadata from it.

Launch a VM with config drive:

nova boot –flavor 2 –image centos2 –nic net-id=8b052b4a-840c-4b45-b96e-7980f7fa4a74  –user-data /root/keystonerc –meta key1=value1 –meta key2=value2 –file /root/fileinject-ks-pre.log=/root/ks-pre.log  –key-name sshkey –config-drive true  centos-configdrive

#Check the config drive ID:
 
[root@centos-configdrive ~]$ blkid  
/dev/sr0: LABEL=”config-2″ TYPE=”iso9660″
/dev/vda1: UUID=”59b7c317-c842-4e4b-88fc-97ca78f733cf” TYPE=”ext4″  
/dev/vda2: UUID=”gEZmmF-veNb-Tzzw-6cjq-XxZa-S4Dk-BmWw56″ TYPE=”LVM2_member”  
/dev/mapper/vg_osclone-lv_root: UUID=”40d88bae-21b2-48da-8b8d-00cbe8f4944f” TYPE=”ext4″  
/dev/mapper/vg_osclone-lv_swap: UUID=”8760f3c0-1630-4770-bfe0-027ac3189d66″ TYPE=”swap”
 
#Config drive is labeled as “config-2”, mount it to a directory
[root@centos-configdrive ~]$ mount /dev/sr0 /mnt/

From the config drive, we can find same information as metadata service, plus the injected file.

#Check whole “meta” data set of the VM, including root password, SSH key, meta key/value pairs.
 
[root@centos-configdrive mnt]$ cat /mnt/openstack/latest/meta_data.json  
{“files”: [{“path”: “/root/fileinject-ks-pre.log”, “content_path”: “/content/0000”}], “admin_pass”: “sx2dGQot5z7J”,  
 “random_seed”:”iXm+6uR8kVZ4nn01+bYPtQ2+QFUU541nye4Ni4XxSMEQOtUQJzjqT2Ylneu5hRY2Wd30d8ub34BFUKOOZKzIyfdylYzKLbue3DBzDbG1henyYcbAnjfLDF9W5IK8ediMsjWU9QyiRUlAUFEq9vkBJVFd3153iurcdk/ZUX3SeFoICU2ZgmPtOTr8H7OM00nRXE2c+zST2GpsEMQr5KC91pCmshE9LXyya1nSsgpk5ZR+idZlysudQ1ofzaeqoEiBSQm7vBYjZX1hUIP9nm1TZ8MWrIQptUFuz6TJ54Qzo43H+pNWGPvVPDkCQ+L+veCEky6/ADNan28jJndOLmN+8M+NT3m/IOSPxc0chQxYe2dRAXkwHbwvBTf0UalA6mIaklbfRr7Tb8iLV8Xhr6lNSpomJHKh7ti2geWb4BhshwdfzpIG7NfSJrEzlRTxE+dHUsdTZRZI4vsSv7cOLBkdu3ASQPrzY27Xd9DgUqkyFuuTuwJ75kdJBOiiexWsfriOu29ZcWFVJ5st2RJ7Ka3wRy9rFnT+QkY1iBBlpBR7UX/eeT/Jp+/M0euTdYTRaLIL5mSPkkmOmVKDFovhHv6BCzmoBTCM6xb7/FU3H/U8jBvLhqXZGk9IjhjdlG9FOsmEJvU2QCVSriLEvrHXRtV0QACe6XTh+pE5EDWerq6hSQw=”,  
“uuid”: “22fd49a3-5087-4dae-9b52-39f737ebf0a1”,  
“availability_zone”: “nova”,  
“hostname”: “centos-configdrive.novalocal”,  
“launch_index”: 0,  
“meta”: {“key2”: “value2”, “key1”: “value1”},  
“public_keys”: {“sshkey”: “ssh-rsa AAB3NzaC1yc2EAAAABIwAAAQEAvc9IUAlGukTLzaXgUMOZElGR8nMZlQ1TFppNrStQSMHd2rpqq/h2ZYHv/3Cz09zFTadO0QTWlqA9ZPnGgSWytjwvdfIQJb47jh/RZzyo1mJZYCkneE5wpviZ7Txe2BTFFNX8qUQksvg8plR4tGZFmWXc1SceMpwBoOdRFEcdjIXHOPPfU4J4NvpOJPrN9xEDMQmLsU5Sun7t1Gkg8UTnVZTweg79QXQfmXewTMx2LPwxXtsthS1hDoXYLulyxFpyVhZPOMZOipYcmr5wumpQhdBAPHRx0eocT5+6bkPtg2pBd1aKyl4oYUpuIW4b6md7TUINHE3qlqD3JNi49C1Oqw== Generated by Novan”},  
“name”: “centos-configdrive”}
 
#Check userdata
 
[root@centos-configdrive mnt]$ cat /mnt/openstack/latest/user_data  
export OS_TENANT_NAME=admin  
export OS_USERNAME=admin  
export OS_PASSWORD=admin_pass  
export OS_AUTH_URL=”http://169.254.0.10:5000/v2.0/”
 
#Check injected file  
#The first injected file is placed as /mnt/openstack/content/0000, the 2nd is 0001, and so on.
 
[root@centos-configdrive ~]$ ls -l /mnt/openstack/content/  
total 1  
-r–r–r–. 1 root root 582 Mar 17 16:55 0000

Search This Blog

ToolsBook

干翻 nio ，王炸 io_uring 来了，史上最详细说明及最全图解！！