Repository: lima-vm/lima
Pull request #2266 (2024-04-04 19:45:03)

Fix cidata user-data ca_certs yaml content
This is failing the cloud-config jsonschema validation, later.

```  $ sudo cloud-init schema --system
  Error: Cloud config schema errors:
    ca_certs.trusted: None is not of type 'array'
```

* #2265

----

There are some additional fixes, to be followed up in another PR:

* Cloud config schema deprecations: users.0.uid:  Changed in version 22.3. The use of ``string`` type is deprecated. Use an ``integer`` instead.

```diff
-    uid: '1000'
+    uid: 1000
```

* Error: Cloud config schema errors: users.0: Additional properties are not allowed ('ssh-authorized-keys' was unexpected

```diff
-    ssh-authorized-keys:
+    ssh_authorized_keys:
```

These are either version-dependent (on the runtime cloud-init version, which we don't know just yet)

Or depends on the implementation, where the canonical python implementation does a magic `replace`.

afbjorklund: The initial attempt got a bit confusing, since it was trying to validate the config from the test cases...

The _actual_ user-data in the default template looked like:

```yaml
ca_certs:
    remove_defaults: false
    trusted: null
```

Better to fail validation, if the boolean pointer is still `nil`

Patch:
diff --git a/pkg/cidata/cidata.TEMPLATE.d/user-data b/pkg/cidata/cidata.TEMPLATE.d/user-data
index ada882fd..26060b0c 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/user-data
+++ b/pkg/cidata/cidata.TEMPLATE.d/user-data
@@ -66,6 +66,7 @@ resolv_conf:
 {{ with .CACerts }}
 ca_certs:
   remove_defaults: {{ .RemoveDefaults }}
+  {{- if .Trusted}}
   trusted:
   {{- range $cert := .Trusted }}
   - |
@@ -73,6 +74,7 @@ ca_certs:
     {{ $line }}
     {{- end }}
   {{- end }}
+  {{- end }}
 {{- end }}
 
 {{- if .BootCmds }}
diff --git a/pkg/cidata/template.go b/pkg/cidata/template.go
index dbd17a7c..b9aa9618 100644
--- a/pkg/cidata/template.go
+++ b/pkg/cidata/template.go
@@ -112,6 +112,9 @@ func ValidateTemplateArgs(args TemplateArgs) error {
 			return fmt.Errorf("field mounts[%d] must be absolute, got %q", i, f)
 		}
 	}
+	if args.CACerts.RemoveDefaults == nil {
+		return errors.New("field CACerts.RemoveDefaults must be set")
+	}
 	return nil
 }
 


Test patch:
diff --git a/pkg/cidata/template_test.go b/pkg/cidata/template_test.go
index f09f0225..a8ae1cc8 100644
--- a/pkg/cidata/template_test.go
+++ b/pkg/cidata/template_test.go
@@ -8,6 +8,8 @@ import (
 	"gotest.tools/v3/assert"
 )
 
+var defaultRemoveDefaults = false
+
 func TestTemplate(t *testing.T) {
 	args := TemplateArgs{
 		Name: "default",
@@ -22,6 +24,10 @@ func TestTemplate(t *testing.T) {
 			{MountPoint: "/Users/dummy/lima"},
 		},
 		MountType: "reverse-sshfs",
+		CACerts: CACerts{
+			RemoveDefaults: &defaultRemoveDefaults,
+			Trusted:        []Cert{},
+		},
 	}
 	layout, err := ExecuteTemplate(args)
 	assert.NilError(t, err)
@@ -33,6 +39,8 @@ func TestTemplate(t *testing.T) {
 		if f.Path == "user-data" {
 			// mounted later
 			assert.Assert(t, !strings.Contains(string(b), "mounts:"))
+			// ca_certs:
+			assert.Assert(t, !strings.Contains(string(b), "trusted:"))
 		}
 	}
 }
@@ -51,6 +59,9 @@ func TestTemplate9p(t *testing.T) {
 			{Tag: "mount1", MountPoint: "/Users/dummy/lima", Type: "9p", Options: "rw,trans=virtio"},
 		},
 		MountType: "9p",
+		CACerts: CACerts{
+			RemoveDefaults: &defaultRemoveDefaults,
+		},
 	}
 	layout, err := ExecuteTemplate(args)
 	assert.NilError(t, err)