Issues with scripts-user Execution and Hashed User Passwords in Kairos Cloud-Config (Yip)

[AlexanderTheGrey]

I'm experiencing two issues with Kairos using cloud-config (Yip):

1. scripts-user Not Executing:
   The script provided under the scripts-user section isn’t running at all. For example:

   write_files:
     - path: /run/scripts/setup.sh
       content: |
         #!/usr/bin/env bash
         
         exec &> /tmp/setup.log # Log file to debug this script
         set -euo pipefail
         set -x  # Enable debug tracing
   
         echo test > /home/ubuntu/test.txt
   
         systemctl restart sshd
       owner: root:root
       permissions: '0755'
   
     scripts-user:
       - /run/scripts/setup.sh

   The above script does not execute after installation during the final boot process.

2. Hashed Passwords Not Applied:
   When using hashed passwords (via passwd or hashed_passwd) in the users section, the password doesn't get set correctly. For example:

   users:
     - name: user1
       sudo:
         - ALL=(ALL) NOPASSWD:ALL
       groups:
         - sudo
         - admin
       lock_passwd: false
       passwd: $6$rounds=4096$4jkSvf7d8eq0FQiy$rtPzT.nzaKKBEL/JTO4CTk4VIpwDOuPKHfU210M4O8QVhtFYXHhpKjcDkVhqVolMyXc5Auvv4vMXGGW8v4Qr50

   Despite the hashed password being specified (generated using mkpasswd --method=SHA-512 --rounds=4096), it doesn't apply as expected.

Has anyone encountered these issues or found a workaround?

I'm using Kairos ubuntu:24.04-core-amd64-generic-v3.3.2 and auroraboot:v0.6.3.

The cloud-config is being applied using Kairos' WebUI.

Additional Question:
What is the easiest way to debug cloud-config scripts? I can see logs in /var/log/cloud-config, but I'm not entirely sure if this is where all the information about cloud-config's execution is stored. Also, the documentation on Cloud-Init and Yip is quite sparse, so any insights on better debugging methods or pointers to more comprehensive docs would be greatly appreciated!

[AlexanderTheGrey]

I forgot to update this a few weeks ago, but I was able to work around the cloud-config issues by better understanding the fact that Yip is completely different than Cloud-Init (this is made clear in the documentation, but there's still some room for conflating the two), and what I was doing here with scripts-user is probably wrong, and should instead use Yip stages with a first boot condition etc. (there should probably be a built-in mechanism for this in Yip, similar to scripts-user).

I'm still having issues with the user password hashes not working though, so I'm not sure what I'm doing wrong there.

[Itxaka]

I tested this with the following cloud config:

#cloud-config

install:
  grub_options:
    extra_cmdline: "rd.immucore.debug"

stages:
  initramfs:
    - name: "Set user and password"
      users:
        kairos:
          passwd: "kairos"
          groups:
            - "admin"
        itxaka:
          passwd: "$6$rounds=4096$eADOyQ/G/S1sYWEf$PUR3VuGXV1tCyq4JZk30dNmSQ/GHLBD0gadeduuzsdyNTDVncU1m0KMac7iRC2H35ZBiKWQ8NFewhQFKLezUv0"
          groups:
            - "admin"
    - name: "Set hostname"
      hostname: kairos-{{ trunc 4 .Random }}

The passwd for itxaka is kairos generated with mkpasswd --method=SHA-512 --rounds=4096
I can login as expected with the user and password.

the shadow file contains the expected content:

kairos:$6$8HLATo5w$UXA28F8R6RIpavFG0SoxIug.OUHTBuyjqO.CUooGaTxyfpVd88m8nfjNyTjUH9YO6H5PEq6YB5pHQZLXkxL51/:20189::::::
itxaka:$6$rounds=4096$eADOyQ/G/S1sYWEf$PUR3VuGXV1tCyq4JZk30dNmSQ/GHLBD0gadeduuzsdyNTDVncU1m0KMac7iRC2H35ZBiKWQ8NFewhQFKLezUv0:20189::::::

What is the easiest way to debug cloud-config scripts? I can see logs in /var/log/cloud-config, but I'm not entirely sure if this is where all the information about cloud-config's execution is stored. Also, the documentation on Cloud-Init and Yip is quite sparse, so any insights on better debugging methods or pointers to more comprehensive docs would be greatly appreciated!

It depends on what stage you are setting the users entry. If its under rootfs or initramfs they are run via immucore, so logs should be under /run/immucore/{rootfs,initramfs}_stage.log
If you want you can append rd.immucore.debug to the grub cmdline manually on boot to enable debug mode and the logs will have a LOT of info

If you are setting them in other stages like boot or fs they are run via systemd services so they should appear in journald.

If you are still having issues with it please open a ticket and provide:

• full cloud config used
• contents of /etc/shadow
• stage logs that run the user creation, with debug enabled for them (we recommend users are created in initramfs stage)

[AlexanderTheGrey]

Thanks for the extra information, it's very useful.

The password hashes do indeed work. I believe the issues was my cloud-config silently failing, preventing the creation of users.

You said that users should be created in the initramfs stage. However, when validating the cloud-config schema using kairos-agent validate, it says:

jsonschema: '' does not validate with file:///schema.json#/required: missing properties: 'users'

So should there still be a top-level users key like in traditional Cloud-Init?

Also, is rd.immucore.debug equivalent to setting debug: true in the cloud-config?