All cloud config examples

Note

This page is a summary containing all the cloud config YAML examples together. If you would like to explore examples by operation or process instead, refer to the examples library.

Including users and groups

#cloud-config # Add groups to the system # The following example adds the 'admingroup' group with members 'root' and 'sys' # and the empty group cloud-users. groups:  - admingroup: [root,sys]  - cloud-users  # Add users to the system. Users are added after groups are added. # Note: Most of these configuration options will not be honored if the user # already exists. Following options are the exceptions and they are # applicable on already-existing users: # - 'plain_text_passwd', 'hashed_passwd', 'lock_passwd', 'sudo', # 'ssh_authorized_keys', 'ssh_redirect_user'. users:  - default  - name: foobar  gecos: Foo B. Bar  primary_group: foobar  groups: users  selinux_user: staff_u  expiredate: '2032-09-01'  ssh_import_id:  - lp:falcojr  - gh:TheRealFalcon  lock_passwd: false  passwd: $6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/  - name: barfoo  gecos: Bar B. Foo  sudo: "ALL=(ALL) NOPASSWD:ALL"  groups: users, admin  ssh_import_id:  - lp:falcojr  - gh:TheRealFalcon  lock_passwd: true  ssh_authorized_keys:  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSL7uWGj8cgWyIOaspgKdVy0cKJ+UTjfv7jBOjG2H/GN8bJVXy72XAvnhM0dUM+CCs8FOf0YlPX+Frvz2hKInrmRhZVwRSL129PasD12MlI3l44u6IwS1o/W86Q+tkQYEljtqDOo0a+cOsaZkvUNzUyEXUwz/lmYa6G4hMKZH4NBj7nbAAF96wsMCoyNwbWryBnDYUr6wMbjRR1J9Pw7Xh7WRC73wy4Va2YuOgbD3V/5ZrFPLbWZW/7TFXVrql04QVbyei4aiFR5n//GvoqwQDNe58LmbzX/xvxyKJYdny2zXmdAhMxbrpFQsfpkJ9E/H5w0yOdSvnWbUoG5xNGoOB csmith@fringe  - name: testuser  gecos: Mr. Test  homedir: /local/testdir  sudo: ["ALL=(ALL) NOPASSWD:ALL"]  - name: cloudy  gecos: Magic Cloud App Daemon User  inactive: '5'  system: true  - name: fizzbuzz  shell: /bin/bash  ssh_authorized_keys:  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSL7uWGj8cgWyIOaspgKdVy0cKJ+UTjfv7jBOjG2H/GN8bJVXy72XAvnhM0dUM+CCs8FOf0YlPX+Frvz2hKInrmRhZVwRSL129PasD12MlI3l44u6IwS1o/W86Q+tkQYEljtqDOo0a+cOsaZkvUNzUyEXUwz/lmYa6G4hMKZH4NBj7nbAAF96wsMCoyNwbWryBnDYUr6wMbjRR1J9Pw7Xh7WRC73wy4Va2YuOgbD3V/5ZrFPLbWZW/7TFXVrql04QVbyei4aiFR5n//GvoqwQDNe58LmbzX/xvxyKJYdny2zXmdAhMxbrpFQsfpkJ9E/H5w0yOdSvnWbUoG5xNGoOB csmith@fringe  - snapuser: joe@joeuser.io  - name: nosshlogins  ssh_redirect_user: true  # Valid Values: # name: The user's login name # expiredate: Date on which the user's account will be disabled. # gecos: The user name's real name, i.e. "Bob B. Smith" # homedir: Optional. Set to the local path you want to use. Defaults to # /home/<username> # primary_group: define the primary group. Defaults to a new group created # named after the user. # groups: Optional. Additional groups to add the user to. Defaults to none # selinux_user: Optional. The SELinux user for the user's login, such as # "staff_u". When this is omitted the system will select the default # SELinux user. # lock_passwd: Defaults to true. Lock the password to disable password login # inactive: Number of days after password expires until account is disabled # passwd: The hash -- not the password itself -- of the password you want # to use for this user. You can generate a hash via: # mkpasswd --method=SHA-512 --rounds=4096 # (the above command would create from stdin an SHA-512 password hash # with 4096 salt rounds) # # Please note: while the use of a hashed password is better than # plain text, the use of this feature is not ideal. Also, # using a high number of salting rounds will help, but it should # not be relied upon. # # To highlight this risk, running John the Ripper against the # example hash above, with a readily available wordlist, revealed # the true password in 12 seconds on a i7-2620QM. # # In other words, this feature is a potential security risk and is # provided for your convenience only. If you do not fully trust the # medium over which your cloud-config will be transmitted, then you # should not use this feature. # # no_create_home: When set to true, do not create home directory. # no_user_group: When set to true, do not create a group named after the user. # no_log_init: When set to true, do not initialize lastlog and faillog database. # ssh_import_id: Optional. Import SSH ids # ssh_authorized_keys: Optional. [list] Add keys to user's authorized keys file # An error will be raised if no_create_home or system is # also set. # ssh_redirect_user: Optional. [bool] Set true to block ssh logins for cloud # ssh public keys and emit a message redirecting logins to # use <default_username> instead. This option only disables cloud # provided public-keys. An error will be raised if ssh_authorized_keys # or ssh_import_id is provided for the same user. # # sudo: Defaults to none. Accepts a sudo rule string, a list of sudo rule # strings or False to explicitly deny sudo usage. Examples: # # Allow a user unrestricted sudo access. # sudo: "ALL=(ALL) NOPASSWD:ALL" # or # sudo: ["ALL=(ALL) NOPASSWD:ALL"] # # Adding multiple sudo rule strings. # sudo: # - "ALL=(ALL) NOPASSWD:/bin/mysql" # - "ALL=(ALL) ALL" # # Note: Please double check your syntax and make sure it is valid. # cloud-init does not parse/check the syntax of the sudo # directive. # system: Create the user as a system user. This means no home directory. # snapuser: Create a Snappy (Ubuntu-Core) user via the snap create-user # command available on Ubuntu systems. If the user has an account # on the Ubuntu SSO, specifying the email will allow snap to # request a username and any public ssh keys and will import # these into the system with username specified by SSO account. # If 'username' is not set in SSO, then username will be the # shortname before the email domain. #  # Default user creation: # # Unless you define users, you will get a 'ubuntu' user on Ubuntu systems with the # legacy permission (no password sudo, locked user, etc). If however, you want # to have the 'ubuntu' user in addition to other users, you need to instruct # cloud-init that you also want the default user. To do this use the following # syntax: # users: # - default # - bob # - .... # foobar: ... # # users[0] (the first user in users) overrides the user directive. # # The 'default' user above references the distro's config set in # /etc/cloud/cloud.cfg. 

Writing out arbitrary files

#cloud-config # vim: syntax=yaml # # This is the configuration syntax that the write_files module # will know how to understand. Encoding can be given b64 or gzip or (gz+b64). # The content will be decoded accordingly and then written to the path that is # provided.  # # Note: Content strings here are truncated for example purposes. write_files: - encoding: b64  content: CiMgVGhpcyBmaWxlIGNvbnRyb2xzIHRoZSBzdGF0ZSBvZiBTRUxpbnV4...  owner: root:root  path: /etc/sysconfig/selinux  permissions: '0644' - content: |  # My new /etc/sysconfig/samba file   SMBDOPTIONS="-D"  path: /etc/sysconfig/samba - content: !!binary |  f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAwARAAAAAAABAAAAAAAAAAJAVAAAAAAAAAAAAAEAAOAAI  AEAAHgAdAAYAAAAFAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAwAEAAAAAAADAAQAAAAAAAAgA  AAAAAAAAAwAAAAQAAAAAAgAAAAAAAAACQAAAAAAAAAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA  ....  path: /bin/arch  permissions: '0555' - encoding: gzip  content: !!binary |  H4sIAIDb/U8C/1NW1E/KzNMvzuBKTc7IV8hIzcnJVyjPL8pJ4QIA6N+MVxsAAAA=  path: /usr/bin/hello  permissions: '0755' 

Adding a yum repository

#cloud-config # vim: syntax=yaml # # Add yum repository configuration to the system # # The following example adds the file /etc/yum.repos.d/epel_testing.repo # which can then subsequently be used by yum for later operations. yum_repos:  # The name of the repository  epel-testing:  # Any repository configuration options  # See: man yum.conf  #  # At least one of 'baseurl' or 'metalink' or 'mirrorlist' is required!  baseurl: http://download.fedoraproject.org/pub/epel/testing/5/$basearch  metalink: https://mirrors.fedoraproject.org/metalink?repo=epel-$releasever&arch=$basearch&infra=$infra&content=$contentdir  mirrorlist: https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&  enabled: false  failovermethod: priority  gpgcheck: true  gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL  name: Extra Packages for Enterprise Linux 5 - Testing 

Configure an instance’s trusted CA certificates

#cloud-config # # This is an example file to configure an instance's trusted CA certificates # system-wide for SSL/TLS trust establishment when the instance boots for the # first time. # # Make sure that this file is valid yaml before starting instances. # It should be passed as user-data when starting the instance.  ca_certs:  # If present and set to True, the 'remove_defaults' parameter will either  # disable all the trusted CA certifications normally shipped with  # Alpine, Debian or Ubuntu. On RedHat, this action will delete those  # certificates.  # This is mainly for very security-sensitive use cases - most users will not  # need this functionality.  remove_defaults: true   # If present, the 'trusted' parameter should contain a certificate (or list  # of certificates) to add to the system as trusted CA certificates.  # Pay close attention to the YAML multiline list syntax. The example shown  # here is for a list of multiline certificates.  trusted:   - |  -----BEGIN CERTIFICATE-----  YOUR-ORGS-TRUSTED-CA-CERT-HERE  -----END CERTIFICATE-----  - |  -----BEGIN CERTIFICATE-----  YOUR-ORGS-TRUSTED-CA-CERT-HERE  -----END CERTIFICATE----- 

Install and run chef recipes

#cloud-config # # This is an example file to automatically install chef-client and run a # list of recipes when the instance boots for the first time. # Make sure that this file is valid yaml before starting instances. # It should be passed as user-data when starting the instance.  # The default is to install from packages.  # Key from https://packages.chef.io/chef.asc apt:  sources:  source1:  source: "deb http://packages.chef.io/repos/apt/stable $RELEASE main"  key: |  -----BEGIN PGP PUBLIC KEY BLOCK-----  Version: GnuPG v1.4.12 (Darwin)  Comment: GPGTools - http://gpgtools.org   mQGiBEppC7QRBADfsOkZU6KZK+YmKw4wev5mjKJEkVGlus+NxW8wItX5sGa6kdUu  twAyj7Yr92rF+ICFEP3gGU6+lGo0Nve7KxkN/1W7/m3G4zuk+ccIKmjp8KS3qn99  dxy64vcji9jIllVa+XXOGIp0G8GEaj7mbkixL/bMeGfdMlv8Gf2XPpp9vwCgn/GC  JKacfnw7MpLKUHOYSlb//JsEAJqao3ViNfav83jJKEkD8cf59Y8xKia5OpZqTK5W  ShVnNWS3U5IVQk10ZDH97Qn/YrK387H4CyhLE9mxPXs/ul18ioiaars/q2MEKU2I  XKfV21eMLO9LYd6Ny/Kqj8o5WQK2J6+NAhSwvthZcIEphcFignIuobP+B5wNFQpe  DbKfA/0WvN2OwFeWRcmmd3Hz7nHTpcnSF+4QX6yHRF/5BgxkG6IqBIACQbzPn6Hm  sMtm/SVf11izmDqSsQptCrOZILfLX/mE+YOl+CwWSHhl+YsFts1WOuh1EhQD26aO  Z84HuHV5HFRWjDLw9LriltBVQcXbpfSrRP5bdr7Wh8vhqJTPjrQnT3BzY29kZSBQ  YWNrYWdlcyA8cGFja2FnZXNAb3BzY29kZS5jb20+iGAEExECACAFAkppC7QCGwMG  CwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRApQKupg++Caj8sAKCOXmdG36gWji/K  +o+XtBfvdMnFYQCfTCEWxRy2BnzLoBBFCjDSK6sJqCu0IENIRUYgUGFja2FnZXMg  PHBhY2thZ2VzQGNoZWYuaW8+iGIEExECACIFAlQwYFECGwMGCwkIBwMCBhUIAgkK  CwQWAgMBAh4BAheAAAoJEClAq6mD74JqX94An26z99XOHWpLN8ahzm7cp13t4Xid  AJ9wVcgoUBzvgg91lKfv/34cmemZn7kCDQRKaQu0EAgAg7ZLCVGVTmLqBM6njZEd  Zbv+mZbvwLBSomdiqddE6u3eH0X3GuwaQfQWHUVG2yedyDMiG+EMtCdEeeRebTCz  SNXQ8Xvi22hRPoEsBSwWLZI8/XNg0n0f1+GEr+mOKO0BxDB2DG7DA0nnEISxwFkK  OFJFebR3fRsrWjj0KjDxkhse2ddU/jVz1BY7Nf8toZmwpBmdozETMOTx3LJy1HZ/  Te9FJXJMUaB2lRyluv15MVWCKQJro4MQG/7QGcIfrIZNfAGJ32DDSjV7/YO+IpRY  IL4CUBQ65suY4gYUG4jhRH6u7H1p99sdwsg5OIpBe/v2Vbc/tbwAB+eJJAp89Zeu  twADBQf/ZcGoPhTGFuzbkcNRSIz+boaeWPoSxK2DyfScyCAuG41CY9+g0HIw9Sq8  DuxQvJ+vrEJjNvNE3EAEdKl/zkXMZDb1EXjGwDi845TxEMhhD1dDw2qpHqnJ2mtE  WpZ7juGwA3sGhi6FapO04tIGacCfNNHmlRGipyq5ZiKIRq9mLEndlECr8cwaKgkS  0wWu+xmMZe7N5/t/TK19HXNh4tVacv0F3fYK54GUjt2FjCQV75USnmNY4KPTYLXA  dzC364hEMlXpN21siIFgB04w+TXn5UF3B4FfAy5hevvr4DtV4MvMiGLu0oWjpaLC  MpmrR3Ny2wkmO0h+vgri9uIP06ODWIhJBBgRAgAJBQJKaQu0AhsMAAoJEClAq6mD  74Jq4hIAoJ5KrYS8kCwj26SAGzglwggpvt3CAJ0bekyky56vNqoegB+y4PQVDv4K  zA==  =IxPr  -----END PGP PUBLIC KEY BLOCK-----  chef:   # Valid values are 'accept' and 'accept-no-persist'  chef_license: "accept"   # Valid values are 'gems' and 'packages' and 'omnibus'  install_type: "packages"   # Boolean: run 'install_type' code even if chef-client  # appears already installed.  force_install: false   # Chef settings  server_url: "https://chef.yourorg.com"   # Node Name  # Defaults to the instance-id if not present  node_name: "your-node-name"   # Environment  # Defaults to '_default' if not present  environment: "production"   # Default validation name is chef-validator  validation_name: "yourorg-validator"  # if validation_cert's value is "system" then it is expected  # that the file already exists on the system.  validation_cert: |  -----BEGIN RSA PRIVATE KEY-----  YOUR-ORGS-VALIDATION-KEY-HERE  -----END RSA PRIVATE KEY-----   # A run list for a first boot json, an example (not required)  run_list:  - "recipe[apache2]"  - "role[db]"   # Specify a list of initial attributes used by the cookbooks  initial_attributes:  apache:  prefork:  maxclients: 100  keepalive: "off"   # if install_type is 'omnibus', change the url to download  omnibus_url: "https://www.chef.io/chef/install.sh"   # if install_type is 'omnibus', pass pinned version string  # to the install script  omnibus_version: "12.3.0"   # If encrypted data bags are used, the client needs to have a secrets file  # configured to decrypt them  encrypted_data_bag_secret: "/etc/chef/encrypted_data_bag_secret" 

Install and run ansible-pull

#cloud-config package_update: true package_upgrade: true  # if you're already installing other packages, you may # wish to manually install ansible to avoid multiple calls # to your package manager packages:  - git ansible:  install_method: pip  pull:  - url: "https://github.com/holmanb/vmboot.git"  playbook_names: [ubuntu.yml] 

Configure instance to be managed by Ansible

#cloud-config # # A common use-case for cloud-init is to bootstrap user and ssh # settings to be managed by a remote configuration management tool, # such as ansible. # # This example assumes a default Ubuntu cloud image, which should contain # the required software to be managed remotely by Ansible. # ssh_pwauth: false  users: - name: ansible  gecos: Ansible User  groups: users,admin,wheel  sudo: "ALL=(ALL) NOPASSWD:ALL"  shell: /bin/bash  lock_passwd: true  ssh_authorized_keys:  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRCJCQ1UD9QslWDSw5Pwsvba0Wsf1pO4how5BtNaZn0xLZpTq2nqFEJshUkd/zCWF7DWyhmNphQ8c+U+wcmdNVcg2pI1kPxq0VZzBfZ7cDwhjgeLsIvTXvU+HVRtsXh4c5FlUXpRjf/x+a3vqFRvNsRd1DE+5ZqQHbOVbnsStk3PZppaByMg+AZZMx56OUk2pZCgvpCwj6LIixqwuxNKPxmJf45RyOsPUXwCwkq9UD4me5jksTPPkt3oeUWw1ZSSF8F/141moWsGxSnd5NxCbPUWGoRfYcHc865E70nN4WrZkM7RFI/s5mvQtuj8dRL67JUEwvdvEDO0EBz21FV/iOracXd2omlTUSK+wYrWGtiwQwEgr4r5bimxDKy9L8UlaJZ+ONhLTP8ecTHYkaU1C75sLX9ZYd5YtqjiNGsNF+wdW6WrXrQiWeyrGK7ZwbA7lagSxIa7yeqnKDjdkcJvQXCYGLM9AMBKWeJaOpwqZ+dOunMDLd5VZrDCU2lpCSJ1M="   # use the following passwordless demonstration key for testing or # replace with your own key pair # # -----BEGIN OPENSSH PRIVATE KEY----- # b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn # NhAAAAAwEAAQAAAYEA0QiQkNVA/ULJVg0sOT8LL22tFrH9aTuIaMOQbTWmZ9MS2aU6tp6h # RCbIVJHf8wlhew1soZjaYUPHPlPsHJnTVXINqSNZD8atFWcwX2e3A8IY4Hi7CL0171Ph1U # bbF4eHORZVF6UY3/8fmt76hUbzbEXdQxPuWakB2zlW57ErZNz2aaWgcjIPgGWTMeejlJNq # WQoL6QsI+iyIsasLsTSj8ZiX+OUcjrD1F8AsJKvVA+JnuY5LEzz5Ld6HlFsNWUkhfBf9eN # ZqFrBsUp3eTcQmz1FhqEX2HB3POuRO9JzeFq2ZDO0RSP7OZr0Lbo/HUS+uyVBML3bxAztB # Ac9tRVf4jq2nF3dqJpU1EivsGK1hrYsEMBIK+K+W4psQysvS/FJWiWfjjYS0z/HnEx2JGl # NQu+bC1/WWHeWLao4jRrDRfsHVulq160Ilnsqxiu2cGwO5WoEsSGu8nqpyg43ZHCb0FwmB # izPQDASlniWjqcKmfnTrpzAy3eVWawwlNpaQkidTAAAFgGKSj8diko/HAAAAB3NzaC1yc2 # EAAAGBANEIkJDVQP1CyVYNLDk/Cy9trRax/Wk7iGjDkG01pmfTEtmlOraeoUQmyFSR3/MJ # YXsNbKGY2mFDxz5T7ByZ01VyDakjWQ/GrRVnMF9ntwPCGOB4uwi9Ne9T4dVG2xeHhzkWVR # elGN//H5re+oVG82xF3UMT7lmpAds5VuexK2Tc9mmloHIyD4BlkzHno5STalkKC+kLCPos # iLGrC7E0o/GYl/jlHI6w9RfALCSr1QPiZ7mOSxM8+S3eh5RbDVlJIXwX/XjWahawbFKd3k # 3EJs9RYahF9hwdzzrkTvSc3hatmQztEUj+zma9C26Px1EvrslQTC928QM7QQHPbUVX+I6t # pxd3aiaVNRIr7BitYa2LBDASCvivluKbEMrL0vxSVoln442EtM/x5xMdiRpTULvmwtf1lh # 3li2qOI0aw0X7B1bpatetCJZ7KsYrtnBsDuVqBLEhrvJ6qcoON2Rwm9BcJgYsz0AwEpZ4l # o6nCpn5066cwMt3lVmsMJTaWkJInUwAAAAMBAAEAAAGAEuz77Hu9EEZyujLOdTnAW9afRv # XDOZA6pS7yWEufjw5CSlMLwisR83yww09t1QWyvhRqEyYmvOBecsXgaSUtnYfftWz44apy # /gQYvMVELGKaJAC/q7vjMpGyrxUPkyLMhckALU2KYgV+/rj/j6pBMeVlchmk3pikYrffUX # JDY990WVO194Dm0buLRzJvfMKYF2BcfF4TvarjOXWAxSuR8www050oJ8HdKahW7Cm5S0po # FRnNXFGMnLA62vN00vJW8V7j7vui9ukBbhjRWaJuY5rdG/UYmzAe4wvdIEnpk9xIn6JGCp # FRYTRn7lTh5+/QlQ6FXRP8Ir1vXZFnhKzl0K8Vqh2sf4M79MsIUGAqGxg9xdhjIa5dmgp8 # N18IEDoNEVKUbKuKe/Z5yf8Z9tmexfH1YttjmXMOojBvUHIjRS5hdI9NxnPGRLY2kjAzcm # gV9Rv3vtdF/+zalk3fAVLeK8hXK+di/7XTvYpfJ2EZBWiNrTeagfNNGiYydsQy3zjZAAAA # wBNRak7UrqnIHMZn7pkCTgceb1MfByaFtlNzd+Obah54HYIQj5WdZTBAITReMZNt9S5NAR # M8sQB8UoZPaVSC3ppILIOfLhs6KYj6RrGdiYwyIhMPJ5kRWF8xGCLUX5CjwH2EOq7XhIWt # MwEFtd/gF2Du7HUNFPsZGnzJ3e7pDKDnE7w2khZ8CIpTFgD769uBYGAtk45QYTDo5JroVM # ZPDq08Gb/RhIgJLmIpMwyreVpLLLe8SwoMJJ+rihmnJZxO8gAAAMEA0lhiKezeTshht4xu # rWc0NxxD84a29gSGfTphDPOrlKSEYbkSXhjqCsAZHd8S8kMr3iF6poOk3IWSvFJ6mbd3ie # qdRTgXH9Thwk4KgpjUhNsQuYRHBbI59Mo+BxSI1B1qzmJSGdmCBL54wwzZmFKDQPQKPxiL # n0Mlc7GooiDMjT1tbuW/O1EL5EqTRqwgWPTKhBA6r4PnGF150hZRIMooZkD2zX6b1sGojk # QpvKkEykTwnKCzF5TXO8+wJ3qbcEo9AAAAwQD+Z0r68c2YMNpsmyj3ZKtZNPSvJNcLmyD/ # lWoNJq3djJN4s2JbK8l5ARUdW3xSFEDI9yx/wpfsXoaqWnygP3PoFw2CM4i0EiJiyvrLFU # r3JLfDUFRy3EJ24RsqbigmEsgQOzTl3xfzeFPfxFoOhokSvTG88PQji1AYHz5kA7p6Zfaz # Ok11rJYIe7+e9B0lhku0AFwGyqlWQmS/MhIpnjHIk5tP4heHGSmzKQWJDbTskNWd6aq1G7 # 6HWfDpX4HgoM8AAAALaG9sbWFuYkBhcmM= # -----END OPENSSH PRIVATE KEY----- # 

Configure instance to be an Ansible controller

#cloud-config # # Demonstrate setting up an ansible controller host on boot. # This example installs a playbook repository from a remote private repository # and then runs two of the plays.  package_update: true package_upgrade: true packages:  - git  - python3-pip  # Set up an ansible user # ---------------------- # In this case I give the local ansible user passwordless sudo so that ansible # may write to a local root-only file. users: - name: ansible  gecos: Ansible User  shell: /bin/bash  groups: users,admin,wheel,lxd  sudo: "ALL=(ALL) NOPASSWD:ALL"  # Initialize lxd using cloud-init. # -------------------------------- # In this example, a lxd container is # started using ansible on boot, so having lxd initialized is required. lxd:  init:  storage_backend: dir  # Configure and run ansible on boot # --------------------------------- # Install ansible using pip, ensure that community.general collection is # installed [1]. # Use a deploy key to clone a remote private repository then run two playbooks. # The first playbook starts a lxd container and creates a new inventory file. # The second playbook connects to and configures the container using ansible. # The public version of the playbooks can be inspected here [2] # # [1] community.general is likely already installed by pip # [2] https://github.com/holmanb/ansible-lxd-public # ansible:  install_method: pip  package_name: ansible  run_user: ansible  galaxy:  actions:  - ["ansible-galaxy", "collection", "install", "community.general"]   setup_controller:  repositories:  - path: /home/ansible/my-repo/  source: git@github.com:holmanb/ansible-lxd-private.git  run_ansible:  - playbook_dir: /home/ansible/my-repo  playbook_name: start-lxd.yml  timeout: 120  forks: 1  private_key: /home/ansible/.ssh/id_rsa  - playbook_dir: /home/ansible/my-repo  playbook_name: configure-lxd.yml  become_user: ansible  timeout: 120  forks: 1  private_key: /home/ansible/.ssh/id_rsa  inventory: new_ansible_hosts  # Write a deploy key to the filesystem for ansible. # ------------------------------------------------- # This deploy key is tied to a private github repository [1] # This key exists to demonstrate deploy key usage in ansible # a duplicate public copy of the repository exists here[2] # # [1] https://github.com/holmanb/ansible-lxd-private # [2] https://github.com/holmanb/ansible-lxd-public # write_files:  - path: /home/ansible/.ssh/known_hosts  owner: ansible:ansible  permissions: 0o600  defer: true  content: |  |1|YJEFAk6JjnXpUjUSLFiBQS55W9E=|OLNePOn3eBa1PWhBBmt5kXsbGM4= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl  |1|PGGnpCpqi0aakERS4BWnYxMkMwM=|Td0piZoS4ZVC0OzeuRwKcH1MusM= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==  |1|OJ89KrsNcFTOvoCP/fPGKpyUYFo=|cu7mNzF+QB/5kR0spiYmUJL7DAI= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=   - path: /home/ansible/.ssh/id_rsa  owner: ansible:ansible  permissions: 0o600  defer: true  encoding: base64  content: |  LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFB  QUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFB  d0VBQVFBQUFZRUEwUWlRa05WQS9VTEpWZzBzT1Q4TEwyMnRGckg5YVR1SWFNT1FiVFdtWjlNUzJh  VTZ0cDZoClJDYklWSkhmOHdsaGV3MXNvWmphWVVQSFBsUHNISm5UVlhJTnFTTlpEOGF0Rldjd1gy  ZTNBOElZNEhpN0NMMDE3MVBoMVUKYmJGNGVIT1JaVkY2VVkzLzhmbXQ3NmhVYnpiRVhkUXhQdVdh  a0IyemxXNTdFclpOejJhYVdnY2pJUGdHV1RNZWVqbEpOcQpXUW9MNlFzSStpeUlzYXNMc1RTajha  aVgrT1VjanJEMUY4QXNKS3ZWQStKbnVZNUxFeno1TGQ2SGxGc05XVWtoZkJmOWVOClpxRnJCc1Vw  M2VUY1FtejFGaHFFWDJIQjNQT3VSTzlKemVGcTJaRE8wUlNQN09acjBMYm8vSFVTK3V5VkJNTDNi  eEF6dEIKQWM5dFJWZjRqcTJuRjNkcUpwVTFFaXZzR0sxaHJZc0VNQklLK0srVzRwc1F5c3ZTL0ZK  V2lXZmpqWVMwei9IbkV4MkpHbApOUXUrYkMxL1dXSGVXTGFvNGpSckRSZnNIVnVscTE2MElsbnNx  eGl1MmNHd081V29Fc1NHdThucXB5ZzQzWkhDYjBGd21CCml6UFFEQVNsbmlXanFjS21mblRycHpB  eTNlVldhd3dsTnBhUWtpZFRBQUFGZ0dLU2o4ZGlrby9IQUFBQUIzTnphQzF5YzIKRUFBQUdCQU5F  SWtKRFZRUDFDeVZZTkxEay9DeTl0clJheC9XazdpR2pEa0cwMXBtZlRFdG1sT3JhZW9VUW15RlNS  My9NSgpZWHNOYktHWTJtRkR4ejVUN0J5WjAxVnlEYWtqV1EvR3JSVm5NRjludHdQQ0dPQjR1d2k5  TmU5VDRkVkcyeGVIaHprV1ZSCmVsR04vL0g1cmUrb1ZHODJ4RjNVTVQ3bG1wQWRzNVZ1ZXhLMlRj  OW1tbG9ISXlENEJsa3pIbm81U1RhbGtLQytrTENQb3MKaUxHckM3RTBvL0dZbC9qbEhJNnc5UmZB  TENTcjFRUGlaN21PU3hNOCtTM2VoNVJiRFZsSklYd1gvWGpXYWhhd2JGS2QzawozRUpzOVJZYWhG  OWh3ZHp6cmtUdlNjM2hhdG1RenRFVWorem1hOUMyNlB4MUV2cnNsUVRDOTI4UU03UVFIUGJVVlgr  STZ0CnB4ZDNhaWFWTlJJcjdCaXRZYTJMQkRBU0N2aXZsdUtiRU1yTDB2eFNWb2xuNDQyRXRNL3g1  eE1kaVJwVFVMdm13dGYxbGgKM2xpMnFPSTBhdzBYN0IxYnBhdGV0Q0paN0tzWXJ0bkJzRHVWcUJM  RWhydko2cWNvT04yUndtOUJjSmdZc3owQXdFcFo0bApvNm5DcG41MDY2Y3dNdDNsVm1zTUpUYVdr  SkluVXdBQUFBTUJBQUVBQUFHQUV1ejc3SHU5RUVaeXVqTE9kVG5BVzlhZlJ2ClhET1pBNnBTN3lX  RXVmanc1Q1NsTUx3aXNSODN5d3cwOXQxUVd5dmhScUV5WW12T0JlY3NYZ2FTVXRuWWZmdFd6NDRh  cHkKL2dRWXZNVkVMR0thSkFDL3E3dmpNcEd5cnhVUGt5TE1oY2tBTFUyS1lnVisvcmovajZwQk1l  VmxjaG1rM3Bpa1lyZmZVWApKRFk5OTBXVk8xOTREbTBidUxSekp2Zk1LWUYyQmNmRjRUdmFyak9Y  V0F4U3VSOHd3dzA1MG9KOEhkS2FoVzdDbTVTMHBvCkZSbk5YRkdNbkxBNjJ2TjAwdkpXOFY3ajd2  dWk5dWtCYmhqUldhSnVZNXJkRy9VWW16QWU0d3ZkSUVucGs5eEluNkpHQ3AKRlJZVFJuN2xUaDUr  L1FsUTZGWFJQOElyMXZYWkZuaEt6bDBLOFZxaDJzZjRNNzlNc0lVR0FxR3hnOXhkaGpJYTVkbWdw  OApOMThJRURvTkVWS1ViS3VLZS9aNXlmOFo5dG1leGZIMVl0dGptWE1Pb2pCdlVISWpSUzVoZEk5  TnhuUEdSTFkya2pBemNtCmdWOVJ2M3Z0ZEYvK3phbGszZkFWTGVLOGhYSytkaS83WFR2WXBmSjJF  WkJXaU5yVGVhZ2ZOTkdpWXlkc1F5M3pqWkFBQUEKd0JOUmFrN1VycW5JSE1abjdwa0NUZ2NlYjFN  ZkJ5YUZ0bE56ZCtPYmFoNTRIWUlRajVXZFpUQkFJVFJlTVpOdDlTNU5BUgpNOHNRQjhVb1pQYVZT  QzNwcElMSU9mTGhzNktZajZSckdkaVl3eUloTVBKNWtSV0Y4eEdDTFVYNUNqd0gyRU9xN1hoSVd0  Ck13RUZ0ZC9nRjJEdTdIVU5GUHNaR256SjNlN3BES0RuRTd3MmtoWjhDSXBURmdENzY5dUJZR0F0  azQ1UVlURG81SnJvVk0KWlBEcTA4R2IvUmhJZ0pMbUlwTXd5cmVWcExMTGU4U3dvTUpKK3JpaG1u  Slp4TzhnQUFBTUVBMGxoaUtlemVUc2hodDR4dQpyV2MwTnh4RDg0YTI5Z1NHZlRwaERQT3JsS1NF  WWJrU1hoanFDc0FaSGQ4UzhrTXIzaUY2cG9PazNJV1N2Rko2bWJkM2llCnFkUlRnWEg5VGh3azRL  Z3BqVWhOc1F1WVJIQmJJNTlNbytCeFNJMUIxcXptSlNHZG1DQkw1NHd3elptRktEUVBRS1B4aUwK  bjBNbGM3R29vaURNalQxdGJ1Vy9PMUVMNUVxVFJxd2dXUFRLaEJBNnI0UG5HRjE1MGhaUklNb29a  a0Qyelg2YjFzR29qawpRcHZLa0V5a1R3bktDekY1VFhPOCt3SjNxYmNFbzlBQUFBd1FEK1owcjY4  YzJZTU5wc215ajNaS3RaTlBTdkpOY0xteUQvCmxXb05KcTNkakpONHMySmJLOGw1QVJVZFczeFNG  RURJOXl4L3dwZnNYb2FxV255Z1AzUG9GdzJDTTRpMEVpSml5dnJMRlUKcjNKTGZEVUZSeTNFSjI0  UnNxYmlnbUVzZ1FPelRsM3hmemVGUGZ4Rm9PaG9rU3ZURzg4UFFqaTFBWUh6NWtBN3A2WmZhegpP  azExckpZSWU3K2U5QjBsaGt1MEFGd0d5cWxXUW1TL01oSXBuakhJazV0UDRoZUhHU216S1FXSkRi  VHNrTldkNmFxMUc3CjZIV2ZEcFg0SGdvTThBQUFBTGFHOXNiV0Z1WWtCaGNtTT0KLS0tLS1FTkQg  T1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg== 

Add primary apt repositories

#cloud-config  # Add primary apt repositories # # To add 3rd party repositories, see cloud-config-apt.txt or the # Additional apt configuration and repositories section. # # # Default: auto select based on instance-data # in ec2, the default is <region>.archive.ubuntu.com # apt: # primary: # - arches: [default] # uri: # use the provided mirror # search: # search the list for the first mirror. # this is currently very limited, only verifying that # the mirror is dns resolvable or an IP address # # if neither mirror is set (the default) # then use the mirror provided by the DataSource found. # In EC2, that means using <region>.ec2.archive.ubuntu.com # # if no mirror is provided by the DataSource, but 'search_dns' is # true, then search for dns names '<distro>-mirror' in each of # - fqdn of this host per meta-data # - localdomain # - no domain (which would search domains listed in /etc/resolv.conf) # If there is a dns entry for <distro>-mirror, then it is assumed that there # is a distro mirror at http://<distro>-mirror.<domain>/<distro> # # That gives the cloud provider the opportunity to set mirrors of a distro # up and expose them only by creating dns entries. # # if none of that is found, then the default distro mirror is used apt:  primary:  - arches: [default]  uri: http://us.archive.ubuntu.com/ubuntu/ # or apt:  primary:  - arches: [default]  search:  - http://local-mirror.mydomain  - http://archive.ubuntu.com # or apt:  primary:  - arches: [default]  search_dns: True 

Run commands on first boot

#cloud-config  # boot commands # default: none # This is very similar to runcmd, but commands run very early # in the boot process, only slightly after a 'boothook' would run. # - bootcmd will run on every boot # - 'cloud-init-per' command can be used to make bootcmd run exactly once bootcmd:  - echo 192.168.1.130 us.archive.ubuntu.com >> /etc/hosts  - [ cloud-init-per, once, mymkfs, mkfs, /dev/vdb ] 

#cloud-config  # run commands # default: none # runcmd contains a list of either lists or a string # each item will be executed in order at rc.local like level with # output to the console # - runcmd only runs during the first boot # - if the item is a list, the items will be properly executed as if # passed to execve(3) (with the first arg as the command). # - if the item is a string, it will be simply written to the file and # will be interpreted by 'sh' # # Note, that the list has to be proper yaml, so you have to quote # any characters yaml would eat (':' can be problematic) runcmd:  - [ ls, -l, / ]  - [ sh, -xc, "echo $(date) ': hello world!'" ]  - [ sh, -c, echo "=========hello world=========" ]  - ls -l /root  # Note: Don't write files to /tmp from cloud-init use /run/somedir instead.  # Early boot environments can race systemd-tmpfiles-clean LP: #1707222.  - mkdir /run/mydir  - [ wget, "http://slashdot.org", -O, /run/mydir/index.html ] 

Run commands on very early at every boot

#cloud-boothook #!/bin/sh echo 192.168.1.130 us.archive.ubuntu.com > /etc/hosts 

Install arbitrary packages

#cloud-config  # Install additional packages on first boot # # Default: none # # if packages are specified, then package_update will be set to true # # packages may be supplied as a single package name or as a list # with the format [<package>, <version>] wherein the specific # package version will be installed. packages:  - pwgen  - pastebinit  - [libpython2.7, 2.7.3-0ubuntu3.1] 

Update apt database on first boot

#cloud-config # Update apt database on first boot (run 'apt-get update'). # Note, if packages are given, or package_upgrade is true, then # update will be done independent of this setting. # # Default: false package_update: true 

Run apt or yum upgrade

#cloud-config  # Upgrade the instance on first boot # # Default: false package_upgrade: true 

Adjust mount points mounted

#cloud-config  # set up mount points # 'mounts' contains a list of lists # the inner list are entries for an /etc/fstab line # ie : [ fs_spec, fs_file, fs_vfstype, fs_mntops, fs_freq, fs_passno ] # # default: # mounts: # - [ ephemeral0, /mnt ] # - [ swap, none, swap, sw, 0, 0 ] # # in order to remove a previously listed mount (ie, one from defaults) # list only the fs_spec. For example, to override the default, of # mounting swap: # - [ swap ] # or # - [ swap, null ] # # - if a device does not exist at the time, an entry will still be # written to /etc/fstab. # - '/dev' can be omitted for device names that begin with: xvd, sd, hd, vd # - if an entry does not have all 6 fields, they will be filled in # with values from 'mount_default_fields' below. # # Note, that you should set 'nofail' (see man fstab) for volumes that may not # be attached at instance boot (or reboot). # mounts:  - [ ephemeral0, /mnt, auto, "defaults,noexec" ]  - [ sdc, /opt/data ]  - [ xvdh, /opt/data, "auto", "defaults,nofail", "0", "0" ]  - [ dd, /dev/zero ]  # mount_default_fields # These values are used to fill in any entries in 'mounts' that are not # complete. This must be an array, and must have 6 fields. mount_default_fields: [ None, None, "auto", "defaults,nofail", "0", "2" ]   # swap can also be set up by the 'mounts' module # default is to not create any swap files, because 'size' is set to 0 swap:  filename: /swap.img  size: "auto" # or size in bytes  maxsize: 10485760 # size in bytes 

Configure instance’s SSH keys

#cloud-config  # add each entry to ~/.ssh/authorized_keys for the configured user or the # first user defined in the user definition directive. ssh_authorized_keys:  - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEA3FSyQwBI6Z+nCSjUUk8EEAnnkhXlukKoUPND/RRClWz2s5TCzIkd3Ou5+Cyz71X0XmazM3l5WgeErvtIwQMyT1KjNoMhoJMrJnWqQPOt5Q8zWd9qG7PBl9+eiH5qV7NZ mykey@host  - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3I7VUf2l5gSn5uavROsc5HRDpZdQueUq5ozemNSj8T7enqKHOEaFoU2VoPgGEWC9RyzSQVeyD6s7APMcE82EtmW4skVEgEGSbDc1pvxzxtchBj78hJP6Cf5TCMFSXw+Fz5rF1dR23QDbN1mkHs7adr8GW4kSWqU7Q7NDwfIrJJtO7Hi42GyXtvEONHbiRPOe8stqUly7MvUoN+5kfjBM8Qqpfl2+FNhTYWpMfYdPUnE7u536WqzFmsaqJctz3gBxH9Ex7dFtrxR4qiqEr9Qtlu3xGn7Bw07/+i1D+ey3ONkZLN+LQ714cgj8fRS4Hj29SCmXp5Kt5/82cD/VN3NtHw== smoser@brickies  # Send pre-generated SSH private keys to the server # If these are present, they will be written to /etc/ssh and # new random keys will not be generated # in addition to 'rsa' as shown below, 'ecdsa' is also supported ssh_keys:  rsa_private: |  -----BEGIN RSA PRIVATE KEY-----  MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qcon2LZS/x  1cydPZ4pQpfjEha6WxZ6o8ci/Ea/w0n+0HGPwaxlEG2Z9inNtj3pgFrYcRztfECb  1j6HCibZbAzYtwIBIwJgO8h72WjcmvcpZ8OvHSvTwAguO2TkR6mPgHsgSaKy6GJo  PUJnaZRWuba/HX0KGyhz19nPzLpzG5f0fYahlMJAyc13FV7K6kMBPXTRR6FxgHEg  L0MPC7cdqAwOVNcPY6A7AjEA1bNaIjOzFN2sfZX0j7OMhQuc4zP7r80zaGc5oy6W  p58hRAncFKEvnEq2CeL3vtuZAjEAwNBHpbNsBYTRPCHM7rZuG/iBtwp8Rxhc9I5w  ixvzMgi+HpGLWzUIBS+P/XhekIjPAjA285rVmEP+DR255Ls65QbgYhJmTzIXQ2T9  luLvcmFBC6l35Uc4gTgg4ALsmXLn71MCMGMpSWspEvuGInayTCL+vEjmNBT+FAdO  W7D4zCpI43jRS9U06JVOeSc9CDk2lwiA3wIwCTB/6uc8Cq85D9YqpM10FuHjKpnP  REPPOyrAspdeOAV+6VKRavstea7+2DZmSUgE  -----END RSA PRIVATE KEY-----   rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7XdewmZ3h8eIXJD7TRHtVW7aJX1ByifYtlL/HVzJ09nilCl+MSFrpbFnqjxyL8Rr/DSf7QcY/BrGUQbZn2Kc22PemAWthxHO18QJvWPocKJtlsDNi3 smoser@localhost  # By default, the fingerprints of the authorized keys for the users # cloud-init adds are printed to the console. Setting # no_ssh_fingerprints to true suppresses this output. no_ssh_fingerprints: false  # By default, (most) ssh host keys are printed to the console. Setting # emit_keys_to_console to false suppresses this output. ssh:  emit_keys_to_console: false 

Additional apt configuration and repositories

#cloud-config # apt_pipelining (configure Acquire::http::Pipeline-Depth) # Default: disables HTTP pipelining. Certain web servers, such # as S3 do not pipeline properly (LP: #948461). # Valid options: # False/default: Disables pipelining for APT # None/Unchanged: Use OS default # Number: Set pipelining to some number (not recommended) apt_pipelining: False  # Install additional packages on first boot # # Default: none # # if packages are specified, then package_update will be set to true  packages: ['pastebinit']  apt:  # The apt config consists of two major "areas".  #  # On one hand there is the global configuration for the apt feature.  #  # On one hand (down in this file) there is the source dictionary which allows  # to define various entries to be considered by apt.   ##############################################################################  # Section 1: global apt configuration  #  # The following examples number the top keys to ease identification in  # discussions.   # 1.1 preserve_sources_list  #  # Preserves the existing /etc/apt/sources.list  # Default: false - do overwrite sources_list. If set to true then any  # "mirrors" configuration will have no effect.  # Set to true to avoid affecting sources.list. In that case only  # "extra" source specifications will be written into  # /etc/apt/sources.list.d/*  preserve_sources_list: true   # 1.2 disable_suites  #  # This is an empty list by default, so nothing is disabled.  #  # If given, those suites are removed from sources.list after all other  # modifications have been made.  # Suites are even disabled if no other modification was made,  # but not if is preserve_sources_list is active.  # There is a special alias "$RELEASE" as in the sources that will be replace  # by the matching release.  #  # To ease configuration and improve readability the following common ubuntu  # suites will be automatically mapped to their full definition.  # updates => $RELEASE-updates  # backports => $RELEASE-backports  # security => $RELEASE-security  # proposed => $RELEASE-proposed  # release => $RELEASE  #  # There is no harm in specifying a suite to be disabled that is not found in  # the source.list file (just a no-op then)  #  # Note: Lines don't get deleted, but disabled by being converted to a comment.  # The following example disables all usual defaults except $RELEASE-security.  # On top it disables a custom suite called "mysuite"  disable_suites: [$RELEASE-updates, backports, $RELEASE, mysuite]   # 1.3 primary/security archives  #  # Default: none - instead it is auto select based on instance-data  # so if neither "uri" nor "search", nor "search_dns" is set (the default)  # then use the mirror provided by the DataSource found.  # In EC2, that means using <region>.ec2.archive.ubuntu.com  #  # define a custom (e.g. localized) mirror that will be used in sources.list  # and any custom sources entries for deb / deb-src lines.  #  # One can set primary and security mirror to different uri's  # the child elements to the keys primary and secondary are equivalent  primary:  # arches is list of architectures the following config applies to  # the special keyword "default" applies to any architecture not explicitly  # listed.  - arches: [amd64, i386, default]  # uri is just defining the target as-is  uri: http://us.archive.ubuntu.com/ubuntu  #  # via search one can define lists that are tried one by one.  # The first with a working DNS resolution (or if it is an IP) will be  # picked. That way one can keep one configuration for multiple  # subenvironments that select the working one.  search:  - http://cool.but-sometimes-unreachable.com/ubuntu  - http://us.archive.ubuntu.com/ubuntu  # if no mirror is provided by uri or search but 'search_dns' is  # true, then search for dns names '<distro>-mirror' in each of  # - fqdn of this host per meta-data  # - localdomain  # - no domain (which would search domains listed in /etc/resolv.conf)  # If there is a dns entry for <distro>-mirror, then it is assumed that  # there is a distro mirror at http://<distro>-mirror.<domain>/<distro>  #  # That gives the cloud provider the opportunity to set mirrors of a distro  # up and expose them only by creating dns entries.  #  # if none of that is found, then the default distro mirror is used  search_dns: true  #  # If multiple of a category are given  # 1. uri  # 2. search  # 3. search_dns  # the first defining a valid mirror wins (in the order as defined here,  # not the order as listed in the config).  #  # Additionally, if the repository requires a custom signing key, it can be  # specified via the same fields as for custom sources:  # 'keyid': providing a key to import via shortid or fingerprint  # 'key': providing a raw PGP key  # 'keyserver': specify an alternate keyserver to pull keys from that  # were specified by keyid  - arches: [s390x, arm64]  # as above, allowing to have one config for different per arch mirrors  # security is optional, if not defined it is set to the same value as primary  security:  - uri: http://security.ubuntu.com/ubuntu  arches: [default]  # If search_dns is set for security the searched pattern is:  # <distro>-security-mirror   # if no mirrors are specified at all, or all lookups fail it will try  # to get them from the cloud datasource and if those neither provide one fall  # back to:  # primary: http://archive.ubuntu.com/ubuntu  # security: http://security.ubuntu.com/ubuntu   # 1.4 sources_list  #  # Provide a custom template for rendering sources.list  # without one provided cloud-init uses builtin templates for  # ubuntu and debian.  # Within these sources.list templates you can use the following replacement  # variables (all have sane Ubuntu defaults, but mirrors can be overwritten  # as needed (see above)):  # => $RELEASE, $MIRROR, $PRIMARY, $SECURITY  sources_list: | # written by cloud-init custom template  deb $MIRROR $RELEASE main restricted  deb-src $MIRROR $RELEASE main restricted  deb $PRIMARY $RELEASE universe restricted  deb $SECURITY $RELEASE-security multiverse   # 1.5 conf  #  # Any apt config string that will be made available to apt  # see the APT.CONF(5) man page for details what can be specified  conf: | # APT config  APT {  Get {  Assume-Yes "true";  Fix-Broken "true";  };  };   # 1.6 (http_|ftp_|https_)proxy  #  # Proxies are the most common apt.conf option, so that for simplified use  # there is a shortcut for those. Those get automatically translated into the  # correct Acquire::*::Proxy statements.  #  # note: proxy actually being a short synonym to http_proxy  proxy: http://[[user][:pass]@]host[:port]/  http_proxy: http://[[user][:pass]@]host[:port]/  ftp_proxy: ftp://[[user][:pass]@]host[:port]/  https_proxy: https://[[user][:pass]@]host[:port]/   # 1.7 add_apt_repo_match  #  # 'source' entries in apt-sources that match this python regex  # expression will be passed to add-apt-repository  # The following example is also the builtin default if nothing is specified  add_apt_repo_match: '^[\w-]+:\w'    ##############################################################################  # Section 2: source list entries  #  # This is a dictionary (unlike most block/net which are lists)  #  # The key of each source entry is the filename and will be prepended by  # /etc/apt/sources.list.d/ if it doesn't start with a '/'.  # If it doesn't end with .list it will be appended so that apt picks up its  # configuration.  #  # Whenever there is no content to be written into such a file, the key is  # not used as filename - yet it can still be used as index for merging  # configuration.  #  # The values inside the entries consist of the following optional entries:  # 'source': a sources.list entry (some variable replacements apply)  # 'keyid': providing a key to import via shortid or fingerprint  # 'key': providing a raw PGP key  # 'keyserver': specify an alternate keyserver to pull keys from that  # were specified by keyid   # This allows merging between multiple input files than a list like:  # cloud-config1  # sources:  # s1: {'key': 'key1', 'source': 'source1'}  # cloud-config2  # sources:  # s2: {'key': 'key2'}  # s1: {'keyserver': 'foo'}  # This would be merged to  # sources:  # s1:  # keyserver: foo  # key: key1  # source: source1  # s2:  # key: key2  #  # The following examples number the subfeatures per sources entry to ease  # identification in discussions.    sources:  curtin-dev-ppa.list:  # 2.1 source  #  # Creates a file in /etc/apt/sources.list.d/ for the sources list entry  # based on the key: "/etc/apt/sources.list.d/curtin-dev-ppa.list"  source: "deb http://ppa.launchpad.net/curtin-dev/test-archive/ubuntu bionic main"   # 2.2 keyid  #  # Importing a gpg key for a given key id. Used keyserver defaults to  # keyserver.ubuntu.com  keyid: F430BBA5 # GPG key ID published on a key server   ignored1:  # 2.3 PPA shortcut  #  # Setup correct apt sources.list line and Auto-Import the signing key  # from LP  #  # See https://help.launchpad.net/Packaging/PPA for more information  # this requires 'add-apt-repository'. This will create a file in  # /etc/apt/sources.list.d automatically, therefore the key here is  # ignored as filename in those cases.  source: "ppa:curtin-dev/test-archive" # Quote the string   my-repo2.list:  # 2.4 replacement variables  #  # sources can use $MIRROR, $PRIMARY, $SECURITY, $RELEASE and $KEY_FILE  # replacement variables.  # They will be replaced with the default or specified mirrors and the  # running release.  # The entry below would be possibly turned into:  # source: deb http://archive.ubuntu.com/ubuntu bionic multiverse  source: deb [signed-by=$KEY_FILE] $MIRROR $RELEASE multiverse  keyid: F430BBA5   my-repo3.list:  # this would have the same end effect as 'ppa:curtin-dev/test-archive'  source: "deb http://ppa.launchpad.net/curtin-dev/test-archive/ubuntu bionic main"  keyid: F430BBA5 # GPG key ID published on the key server  filename: curtin-dev-ppa.list   ignored2:  # 2.5 key only  #  # this would only import the key without adding a ppa or other source spec  # since this doesn't generate a source.list file the filename key is ignored  keyid: F430BBA5 # GPG key ID published on a key server   ignored3:  # 2.6 key id alternatives  #  # Keyid's can also be specified via their long fingerprints  keyid: B59D 5F15 97A5 04B7 E230 6DCA 0620 BBCF 0368 3F77   ignored4:  # 2.7 alternative keyservers  #  # One can also specify alternative keyservers to fetch keys from.  keyid: B59D 5F15 97A5 04B7 E230 6DCA 0620 BBCF 0368 3F77  keyserver: pgp.mit.edu   ignored5:  # 2.8 signed-by  #  # One can specify [signed-by=$KEY_FILE] in the source definition, which  # will make the key be installed in the directory /etc/cloud-init.gpg.d/  # and the $KEY_FILE replacement variable will be replaced with the path  # to the specified key. If $KEY_FILE is used, but no key is specified,  # apt update will (rightfully) fail due to an invalid value.  source: deb [signed-by=$KEY_FILE] $MIRROR $RELEASE multiverse  keyid: B59D 5F15 97A5 04B7 E230 6DCA 0620 BBCF 0368 3F77   my-repo4.list:  # 2.9 raw key  #  # The apt signing key can also be specified by providing a pgp public key  # block. Providing the PGP key this way is the most robust method for  # specifying a key, as it removes dependency on a remote key server.  #  # As with keyid's this can be specified with or without some actual source  # content.  key: | # The value needs to start with -----BEGIN PGP PUBLIC KEY BLOCK-----  -----BEGIN PGP PUBLIC KEY BLOCK-----  Version: SKS 1.0.10   mI0ESpA3UQEEALdZKVIMq0j6qWAXAyxSlF63SvPVIgxHPb9Nk0DZUixn+akqytxG4zKCONz6  qLjoBBfHnynyVLfT4ihg9an1PqxRnTO+JKQxl8NgKGz6Pon569GtAOdWNKw15XKinJTDLjnj  9y96ljJqRcpV9t/WsIcdJPcKFR5voHTEoABE2aEXABEBAAG0GUxhdW5jaHBhZCBQUEEgZm9y  IEFsZXN0aWOItgQTAQIAIAUCSpA3UQIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEA7H  5Qi+CcVxWZ8D/1MyYvfj3FJPZUm2Yo1zZsQ657vHI9+pPouqflWOayRR9jbiyUFIn0VdQBrP  t0FwvnOFArUovUWoKAEdqR8hPy3M3APUZjl5K4cMZR/xaMQeQRZ5CHpS4DBKURKAHC0ltS5o  uBJKQOZm5iltJp15cgyIkBkGe8Mx18VFyVglAZey  =Y2oI  -----END PGP PUBLIC KEY BLOCK----- 

Disk setup

#cloud-config # Cloud-init supports the creation of simple partition tables and filesystems # on devices.  # Default disk definitions for AWS # -------------------------------- # (Not implemented yet, but provided for future documentation)  disk_setup:  ephemeral0:  table_type: 'mbr'  layout: True  overwrite: False  fs_setup:  - label: None,  filesystem: ext3  device: ephemeral0  partition: auto  # Default disk definitions for Microsoft Azure # ------------------------------------------  device_aliases: {'ephemeral0': '/dev/sdb'} disk_setup:  ephemeral0:  table_type: mbr  layout: True  overwrite: False  fs_setup:  - label: ephemeral0  filesystem: ext4  device: ephemeral0.1  replace_fs: ntfs   # Data disks definitions for Microsoft Azure # ------------------------------------------  disk_setup:  /dev/disk/azure/scsi1/lun0:  table_type: gpt  layout: True  overwrite: True  fs_setup:  - device: /dev/disk/azure/scsi1/lun0  partition: 1  filesystem: ext4   # Default disk definitions for SmartOS # ------------------------------------  device_aliases: {'ephemeral0': '/dev/vdb'} disk_setup:  ephemeral0:  table_type: mbr  layout: False  overwrite: False  fs_setup:  - label: ephemeral0  filesystem: ext4  device: ephemeral0.0  # Caveat for SmartOS: if ephemeral disk is not defined, then the disk will # not be automatically added to the mounts.   # The default definition is used to make sure that the ephemeral storage is # setup properly.  # "disk_setup": disk partitioning # --------------------------------  # The disk_setup directive instructs Cloud-init to partition a disk. The format is:  disk_setup:  ephemeral0:  table_type: 'mbr'  layout: true  /dev/xvdh:  table_type: 'gpt'  layout:  - 33  - [33, 82]  - [33, '44479540-F297-41B2-9AF7-D131D5F0458A']  overwrite: True  # The format is a list of dicts of dicts. The first value is the name of the # device and the subsequent values define how to create and layout the # partition. # The general format is: # disk_setup: # <DEVICE>: # table_type: 'mbr'|'gpt' # layout: <LAYOUT|BOOL> # overwrite: <BOOL> # # Where: # <DEVICE>: The name of the device. 'ephemeralX' and 'swap' are special # values which are specific to the cloud. For these devices # Cloud-init will look up what the real devices is and then # use it. # # For other devices, the kernel device name is used. At this # time only simply kernel devices are supported, meaning # that device mapper and other targets may not work. # # Note: At this time, there is no handling or setup of # device mapper targets. # # table_type=<TYPE>: Currently the following are supported: # 'mbr': default and setups a MS-DOS partition table # 'gpt': setups a GPT partition table # # Note: At this time only 'mbr' and 'gpt' partition tables # are allowed. It is anticipated in the future that # we'll also have "RAID" to create a mdadm RAID. # # layout={...}: The device layout. This is a list of values, with the # percentage of disk that partition will take. # Valid options are: # [<SIZE>, [<SIZE>, <PART_TYPE]] # # Where <SIZE> is the _percentage_ of the disk to use, while # <PART_TYPE> is either the numerical value of the partition type # (two digit code from fdisk, four digit code from gdisk) or a full # GPT partition GUID. # # The following setups two partitions, with the first # partition having a swap label, taking 1/3 of the disk space # and the remainder being used as the second partition. # /dev/xvdh': # table_type: 'mbr' # layout: # - [33,82] # - 66 # overwrite: True # # When layout is "true" it means single partition the entire # device. # # When layout is "false" it means don't partition or ignore # existing partitioning. # # If layout is set to "true" and overwrite is set to "false", # it will skip partitioning the device without a failure. # # overwrite=<BOOL>: This describes whether to ride with safetys on and # everything holstered. # # 'false' is the default, which means that: # 1. The device will be checked for a partition table # 2. The device will be checked for a filesystem # 3. If either a partition of filesystem is found, then # the operation will be _skipped_. # # 'true' is cowboy mode. There are no checks and things are # done blindly. USE with caution, you can do things you # really, really don't want to do. # # # fs_setup: Setup the filesystem # ------------------------------ # # fs_setup describes the how the filesystems are supposed to look.  fs_setup:  - label: ephemeral0  filesystem: 'ext3'  device: 'ephemeral0'  partition: 'auto'  - label: mylabl2  filesystem: 'ext4'  device: '/dev/xvda1'  - cmd: mkfs -t %(filesystem)s -L %(label)s %(device)s  label: mylabl3  filesystem: 'btrfs'  device: '/dev/xvdh'  # The general format is: # fs_setup: # - label: <LABEL> # filesystem: <FS_TYPE> # device: <DEVICE> # partition: <PART_VALUE> # overwrite: <OVERWRITE> # replace_fs: <FS_TYPE> # # Where: # <LABEL>: The filesystem label to be used. If set to None, no label is # used. # # <FS_TYPE>: The filesystem type. It is assumed that the there # will be a "mkfs.<FS_TYPE>" that behaves likes "mkfs". On a standard # Ubuntu Cloud Image, this means that you have the option of ext{2,3,4}, # and vfat by default. # # <DEVICE>: The device name. Special names of 'ephemeralX' or 'swap' # are allowed and the actual device is acquired from the cloud datasource. # When using 'ephemeralX' (i.e. ephemeral0), make sure to leave the # label as 'ephemeralX' otherwise there may be issues with the mounting # of the ephemeral storage layer. # # If you define the device as 'ephemeralX.Y' then Y will be interpetted # as a partition value. However, ephemeralX.0 is the _same_ as ephemeralX. # # <PART_VALUE>: # Partition definitions are overwritten if you use the '<DEVICE>.Y' notation. # # The valid options are: # "auto|any": tell cloud-init not to care whether there is a partition # or not. Auto will use the first partition that does not contain a # filesystem already. In the absence of a partition table, it will # put it directly on the disk. # # "auto": If a filesystem that matches the specification in terms of # label, filesystem and device, then cloud-init will skip the creation # of the filesystem. # # "any": If a filesystem that matches the filesystem type and device, # then cloud-init will skip the creation of the filesystem. # # Devices are selected based on first-detected, starting with partitions # and then the raw disk. Consider the following: # NAME FSTYPE LABEL # xvdb # |-xvdb1 ext4 # |-xvdb2 # |-xvdb3 btrfs test # \-xvdb4 ext4 test # # If you ask for 'auto', label of 'test, and filesystem of 'ext4' # then cloud-init will select the 2nd partition, even though there # is a partition match at the 4th partition. # # If you ask for 'any' and a label of 'test', then cloud-init will # select the 1st partition. # # If you ask for 'auto' and don't define label, then cloud-init will # select the 1st partition. # # In general, if you have a specific partition configuration in mind, # you should define either the device or the partition number. 'auto' # and 'any' are specifically intended for formatting ephemeral storage # or for simple schemes. # # "none": Put the filesystem directly on the device. # # <NUM>: where NUM is the actual partition number. # # <OVERWRITE>: Defines whether or not to overwrite any existing # filesystem. # # "true": Indiscriminately destroy any pre-existing filesystem. Use at # your own peril. # # "false": If an existing filesystem exists, skip the creation. # # <REPLACE_FS>: This is a special directive, used for Microsoft Azure that # instructs cloud-init to replace a filesystem of <FS_TYPE>. NOTE: # unless you define a label, this requires the use of the 'any' partition # directive. # # Behavior Caveat: The default behavior is to _check_ if the filesystem exists. # If a filesystem matches the specification, then the operation is a no-op. 

Configure data sources

#cloud-config  # Documentation on data sources configuration options datasource:  # Ec2   Ec2:  # timeout: the timeout value for a request at metadata service  timeout : 50  # The length in seconds to wait before giving up on the metadata  # service. The actual total wait could be up to   # len(resolvable_metadata_urls)*timeout  max_wait : 240   #metadata_url: a list of URLs to check for metadata services  metadata_urls:  - http://169.254.169.254:80  - http://instance-data:8773   MAAS:  timeout : 50  max_wait : 120   # there are no default values for metadata_url or oauth credentials  # If no credentials are present, non-authed attempts will be made.  metadata_url: http://mass-host.localdomain/source  consumer_key: Xh234sdkljf  token_key: kjfhgb3n  token_secret: 24uysdfx1w4   NoCloud:  # default seedfrom is None  # if found, then it should contain a url with:  # <url>/user-data and <url>/meta-data  # seedfrom: http://my.example.com/i-abcde/  seedfrom: None   # fs_label: the label on filesystems to be searched for NoCloud source  fs_label: cidata   # these are optional, but allow you to basically provide a datasource  # right here  user-data: |  # This is the user-data verbatim  meta-data: |  instance-id: i-87018aed  local-hostname: myhost.internal   SmartOS:  # For KVM guests:  # Smart OS datasource works over a serial console interacting with  # a server on the other end. By default, the second serial console is the  # device. SmartOS also uses a serial timeout of 60 seconds.  serial_device: /dev/ttyS1  serial_timeout: 60   # For LX-Brand Zones guests:  # Smart OS datasource works over a socket interacting with  # the host on the other end. By default, the socket file is in  # the native .zoncontrol directory.  metadata_sockfile: /native/.zonecontrol/metadata.sock   # a list of keys that will not be base64 decoded even if base64_all  no_base64_decode: ['root_authorized_keys', 'motd_sys_info',  'iptables_disable']  # a plaintext, comma delimited list of keys whose values are b64 encoded  base64_keys: []  # a boolean indicating that all keys not in 'no_base64_decode' are encoded  base64_all: False 

Create partitions and filesystems

#cloud-config # Cloud-init supports the creation of simple partition tables and filesystems # on devices.  # Default disk definitions for AWS # -------------------------------- # (Not implemented yet, but provided for future documentation)  disk_setup:  ephemeral0:  table_type: 'mbr'  layout: True  overwrite: False  fs_setup:  - label: None,  filesystem: ext3  device: ephemeral0  partition: auto  # Default disk definitions for Microsoft Azure # ------------------------------------------  device_aliases: {'ephemeral0': '/dev/sdb'} disk_setup:  ephemeral0:  table_type: mbr  layout: True  overwrite: False  fs_setup:  - label: ephemeral0  filesystem: ext4  device: ephemeral0.1  replace_fs: ntfs   # Data disks definitions for Microsoft Azure # ------------------------------------------  disk_setup:  /dev/disk/azure/scsi1/lun0:  table_type: gpt  layout: True  overwrite: True  fs_setup:  - device: /dev/disk/azure/scsi1/lun0  partition: 1  filesystem: ext4   # Default disk definitions for SmartOS # ------------------------------------  device_aliases: {'ephemeral0': '/dev/vdb'} disk_setup:  ephemeral0:  table_type: mbr  layout: False  overwrite: False  fs_setup:  - label: ephemeral0  filesystem: ext4  device: ephemeral0.0  # Caveat for SmartOS: if ephemeral disk is not defined, then the disk will # not be automatically added to the mounts.   # The default definition is used to make sure that the ephemeral storage is # setup properly.  # "disk_setup": disk partitioning # --------------------------------  # The disk_setup directive instructs Cloud-init to partition a disk. The format is:  disk_setup:  ephemeral0:  table_type: 'mbr'  layout: true  /dev/xvdh:  table_type: 'gpt'  layout:  - 33  - [33, 82]  - [33, '44479540-F297-41B2-9AF7-D131D5F0458A']  overwrite: True  # The format is a list of dicts of dicts. The first value is the name of the # device and the subsequent values define how to create and layout the # partition. # The general format is: # disk_setup: # <DEVICE>: # table_type: 'mbr'|'gpt' # layout: <LAYOUT|BOOL> # overwrite: <BOOL> # # Where: # <DEVICE>: The name of the device. 'ephemeralX' and 'swap' are special # values which are specific to the cloud. For these devices # Cloud-init will look up what the real devices is and then # use it. # # For other devices, the kernel device name is used. At this # time only simply kernel devices are supported, meaning # that device mapper and other targets may not work. # # Note: At this time, there is no handling or setup of # device mapper targets. # # table_type=<TYPE>: Currently the following are supported: # 'mbr': default and setups a MS-DOS partition table # 'gpt': setups a GPT partition table # # Note: At this time only 'mbr' and 'gpt' partition tables # are allowed. It is anticipated in the future that # we'll also have "RAID" to create a mdadm RAID. # # layout={...}: The device layout. This is a list of values, with the # percentage of disk that partition will take. # Valid options are: # [<SIZE>, [<SIZE>, <PART_TYPE]] # # Where <SIZE> is the _percentage_ of the disk to use, while # <PART_TYPE> is either the numerical value of the partition type # (two digit code from fdisk, four digit code from gdisk) or a full # GPT partition GUID. # # The following setups two partitions, with the first # partition having a swap label, taking 1/3 of the disk space # and the remainder being used as the second partition. # /dev/xvdh': # table_type: 'mbr' # layout: # - [33,82] # - 66 # overwrite: True # # When layout is "true" it means single partition the entire # device. # # When layout is "false" it means don't partition or ignore # existing partitioning. # # If layout is set to "true" and overwrite is set to "false", # it will skip partitioning the device without a failure. # # overwrite=<BOOL>: This describes whether to ride with safetys on and # everything holstered. # # 'false' is the default, which means that: # 1. The device will be checked for a partition table # 2. The device will be checked for a filesystem # 3. If either a partition of filesystem is found, then # the operation will be _skipped_. # # 'true' is cowboy mode. There are no checks and things are # done blindly. USE with caution, you can do things you # really, really don't want to do. # # # fs_setup: Setup the filesystem # ------------------------------ # # fs_setup describes the how the filesystems are supposed to look.  fs_setup:  - label: ephemeral0  filesystem: 'ext3'  device: 'ephemeral0'  partition: 'auto'  - label: mylabl2  filesystem: 'ext4'  device: '/dev/xvda1'  - cmd: mkfs -t %(filesystem)s -L %(label)s %(device)s  label: mylabl3  filesystem: 'btrfs'  device: '/dev/xvdh'  # The general format is: # fs_setup: # - label: <LABEL> # filesystem: <FS_TYPE> # device: <DEVICE> # partition: <PART_VALUE> # overwrite: <OVERWRITE> # replace_fs: <FS_TYPE> # # Where: # <LABEL>: The filesystem label to be used. If set to None, no label is # used. # # <FS_TYPE>: The filesystem type. It is assumed that the there # will be a "mkfs.<FS_TYPE>" that behaves likes "mkfs". On a standard # Ubuntu Cloud Image, this means that you have the option of ext{2,3,4}, # and vfat by default. # # <DEVICE>: The device name. Special names of 'ephemeralX' or 'swap' # are allowed and the actual device is acquired from the cloud datasource. # When using 'ephemeralX' (i.e. ephemeral0), make sure to leave the # label as 'ephemeralX' otherwise there may be issues with the mounting # of the ephemeral storage layer. # # If you define the device as 'ephemeralX.Y' then Y will be interpetted # as a partition value. However, ephemeralX.0 is the _same_ as ephemeralX. # # <PART_VALUE>: # Partition definitions are overwritten if you use the '<DEVICE>.Y' notation. # # The valid options are: # "auto|any": tell cloud-init not to care whether there is a partition # or not. Auto will use the first partition that does not contain a # filesystem already. In the absence of a partition table, it will # put it directly on the disk. # # "auto": If a filesystem that matches the specification in terms of # label, filesystem and device, then cloud-init will skip the creation # of the filesystem. # # "any": If a filesystem that matches the filesystem type and device, # then cloud-init will skip the creation of the filesystem. # # Devices are selected based on first-detected, starting with partitions # and then the raw disk. Consider the following: # NAME FSTYPE LABEL # xvdb # |-xvdb1 ext4 # |-xvdb2 # |-xvdb3 btrfs test # \-xvdb4 ext4 test # # If you ask for 'auto', label of 'test, and filesystem of 'ext4' # then cloud-init will select the 2nd partition, even though there # is a partition match at the 4th partition. # # If you ask for 'any' and a label of 'test', then cloud-init will # select the 1st partition. # # If you ask for 'auto' and don't define label, then cloud-init will # select the 1st partition. # # In general, if you have a specific partition configuration in mind, # you should define either the device or the partition number. 'auto' # and 'any' are specifically intended for formatting ephemeral storage # or for simple schemes. # # "none": Put the filesystem directly on the device. # # <NUM>: where NUM is the actual partition number. # # <OVERWRITE>: Defines whether or not to overwrite any existing # filesystem. # # "true": Indiscriminately destroy any pre-existing filesystem. Use at # your own peril. # # "false": If an existing filesystem exists, skip the creation. # # <REPLACE_FS>: This is a special directive, used for Microsoft Azure that # instructs cloud-init to replace a filesystem of <FS_TYPE>. NOTE: # unless you define a label, this requires the use of the 'any' partition # directive. # # Behavior Caveat: The default behavior is to _check_ if the filesystem exists. # If a filesystem matches the specification, then the operation is a no-op.