From 45ea695f9b4fce180c662ab4211575d64912634e Mon Sep 17 00:00:00 2001
From: Pavel Zakharov <pavel.zakharov@delphix.com>
Date: Thu, 31 Oct 2019 16:26:54 +0000
Subject: Add config for ssh-key import and consuming user-data

This patch enables control over SSH public-key import and
discarding supplied user-data (both disabled by default).

  allow-userdata: false
  ssh:
    allow_public_ssh_keys: false

This feature enables closed appliances to prevent customers
from unintentionally breaking the appliance which were
not designed for user interaction.

The downstream change for this is here:
  https://github.com/delphix/cloud-init/pull/4
---
 tests/unittests/test_data.py | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

(limited to 'tests/unittests/test_data.py')

diff --git a/tests/unittests/test_data.py b/tests/unittests/test_data.py
index 22cf8f28..e55feb22 100644
--- a/tests/unittests/test_data.py
+++ b/tests/unittests/test_data.py
@@ -525,6 +525,46 @@ c: 4
         self.assertEqual(cfg.get('password'), 'gocubs')
         self.assertEqual(cfg.get('locale'), 'chicago')
 
+    @mock.patch('cloudinit.util.read_conf_with_confd')
+    def test_dont_allow_user_data(self, mock_cfg):
+        mock_cfg.return_value = {"allow_userdata": False}
+
+        # test that user-data is ignored but vendor-data is kept
+        user_blob = '''
+#cloud-config-jsonp
+[
+     { "op": "add", "path": "/baz", "value": "qux" },
+     { "op": "add", "path": "/bar", "value": "qux2" }
+]
+'''
+        vendor_blob = '''
+#cloud-config-jsonp
+[
+     { "op": "add", "path": "/baz", "value": "quxA" },
+     { "op": "add", "path": "/bar", "value": "quxB" },
+     { "op": "add", "path": "/foo", "value": "quxC" }
+]
+'''
+        self.reRoot()
+        initer = stages.Init()
+        initer.datasource = FakeDataSource(user_blob, vendordata=vendor_blob)
+        initer.read_cfg()
+        initer.initialize()
+        initer.fetch()
+        initer.instancify()
+        initer.update()
+        initer.cloudify().run('consume_data',
+                              initer.consume_data,
+                              args=[PER_INSTANCE],
+                              freq=PER_INSTANCE)
+        mods = stages.Modules(initer)
+        (_which_ran, _failures) = mods.run_section('cloud_init_modules')
+        cfg = mods.cfg
+        self.assertIn('vendor_data', cfg)
+        self.assertEqual('quxA', cfg['baz'])
+        self.assertEqual('quxB', cfg['bar'])
+        self.assertEqual('quxC', cfg['foo'])
+
 
 class TestConsumeUserDataHttp(TestConsumeUserData, helpers.HttprettyTestCase):
 
-- 
cgit v1.2.3