When a cloud provider configures ConfigDrive meta_data.json with a files array, the specified files are written to the guest without the guest administrator having the ability to enable/disable/whitelist/blacklist the files.
Hacks to work-around this lack of granularity:
- In some cases, the guest administrator may be able to configure a different data source without a files array. This remains dependent on the cloud provider providing such a data source, and does not provide the guest administrator the granularity to whitelist some set of files, or to blacklist some set of files.
- Identify the files in the files array, confirm that each of the files is configured as desired, then make them immuatable using
chattr +i. As long as the file exists and is immutable, that blocks the file from being clobbered (and logs a warning). However, if the same file would later be rendered, writing the rendered file would also be blocked.
- Custom python module to modify DataSourceConfigDrive to remove/modify the files array.
- Disable cloud-init and configure the machine manually.
When a cloud provider configures ConfigDrive meta_data.json with a files array, the specified files are written to the guest without the guest administrator having the ability to enable/disable/whitelist/blacklist the files.
Hacks to work-around this lack of granularity:
chattr +i. As long as the file exists and is immutable, that blocks the file from being clobbered (and logs a warning). However, if the same file would later be rendered, writing the rendered file would also be blocked.