First-boot configuration
Cloud-init does the handful of things that have to happen before anything else can: a user, a key, a network, enough packages to be managed.
What it is for
A machine arrives with a fresh operating system. Someone has to create an account, install your key, set the hostname and open a path for your automation. Cloud-init does exactly that, once, on the first boot, from a file you supply.
What it is not for is ongoing configuration. That belongs to Ansible or similar, which runs repeatedly and converges. Cloud-init runs once and is done.
A user-data file that earns its keep
#cloud-config
hostname: web-prod-01
users:
- name: admin
groups: [sudo]
shell: /bin/bash
sudo: ['ALL=(ALL) NOPASSWD:ALL']
ssh_authorized_keys:
- ssh-ed25519 AAAA...
disable_root: true
ssh_pwauth: false
package_update: true
packages: [ufw, fail2ban, python3]
Those last two lines about root and password authentication are the whole security argument of securing a new server, applied before the machine is ever exposed.
Keep it small
The temptation is to configure everything here. Resist it: cloud-init has no idea whether it succeeded in a way you can act on, it does not re-run, and debugging it means reading a log after the fact.
Do four things and stop:
- A user with your key
- Root login and password authentication off
- A firewall that allows SSH
- Whatever your configuration management needs to connect
Checking what happened
cloud-init status --long
journalctl -u cloud-init -b
cat /var/log/cloud-init-output.log
That last file contains the output of everything it ran, which is where the answer usually is when a machine comes up not quite right.
No secrets in user-data
It is readable on the machine afterwards and often logged. Put a key in it that can fetch the real secrets, not the secrets themselves — see managing secrets.
With our provisioning
If you provision through the API, cloud-init is the natural companion: the API creates or reinstalls the machine, cloud-init makes it reachable, Ansible makes it yours. For a reseller that is the whole pipeline with no human in it — see starting as a reseller.
Ask support what is supported on the image you are using; not every operating system we offer ships cloud-init by default, and it is a two-minute answer rather than an afternoon of finding out.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base