From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id C160B1FF161 for ; Tue, 30 Jul 2024 17:16:03 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9A4293F0CF; Tue, 30 Jul 2024 17:16:06 +0200 (CEST) From: Mira Limbeck To: pve-devel@lists.proxmox.com Date: Tue, 30 Jul 2024 17:15:41 +0200 Message-Id: <20240730151540.308217-2-m.limbeck@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240730151540.308217-1-m.limbeck@proxmox.com> References: <20240730151540.308217-1-m.limbeck@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -1.114 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_ASCII_DIVIDERS 0.8 Email that uses ascii formatting dividers and possible spam tricks KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH v3 docs] cloudinit: add Windows cloudbase-init section X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Signed-off-by: Mira Limbeck --- v3: - fixed list continuity/indentation v2: - added metadata_services config option - added Sysprep section - fixed typos and clarified some parts qm-cloud-init.adoc | 154 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 154 insertions(+) diff --git a/qm-cloud-init.adoc b/qm-cloud-init.adoc index 8686ed7..4e44fc0 100644 --- a/qm-cloud-init.adoc +++ b/qm-cloud-init.adoc @@ -169,6 +169,160 @@ qm cloudinit dump 9000 user The same command exists for `network` and `meta`. +Cloud-Init on Windows +~~~~~~~~~~~~~~~~~~~~~ + +There is a reimplementation of Cloud-Init available for Windows called +https://cloudbase.it/[cloudbase-init]. Not every feature of Cloud-Init is +available with Cloudbase-Init, and some features differ compared to Cloud-Init. + +Cloudbase-Init requires both `ostype` set to any Windows version and the +`citype` set to `configdrive2`, which is the default with any Windows +`ostype`. + +There are no ready-made cloud images for Windows available for free. Using +Cloudbase-Init requires manually installing and configuring a Windows guest. + + +Preparing Cloudbase-Init Templates +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The first step is to install Windows in a VM. Download and install +Cloudbase-Init in the guest. It may be necessary to install the Beta version. +Don't run Sysprep at the end of the installation. Instead configure +Cloudbase-Init first. + +A few common options to set would be: + +* 'username': This sets the username of the administrator + +* 'groups': This allows one to add the user to the `Administrators` group + +* 'inject_user_password': Set this to `true` to allow setting the password +in the VM config + +* 'first_logon_behaviour': Set this to `no` to not require a new password on +login + +* 'rename_admin_user': Set this to `true` to allow renaming the default +`Administrator` user to the username specified with `username` + +* 'metadata_services': Set this to +`cloudbaseinit.metadata.services.configdrive.ConfigDriveService` for +Cloudbase-Init to first check this serivce. Otherwise it may take a few minutes +for Cloudbase-Init to configure the system after boot. + +Some plugins, for example the SetHostnamePlugin, require reboots and will do +so automatically. To disable automatic reboots by Cloudbase-Init, you can set +`allow_reboot` to `false`. + +A full set of configuration options can be found in the +https://cloudbase-init.readthedocs.io/en/latest/config.html[official +cloudbase-init documentation]. + +It can make sense to make a snapshot after configuring in case some parts of +the config still need adjustments. +After configuring Cloudbase-Init you can start creating the template. Shutdown +the Windows guest, add a Cloud-Init disk and make it into a template. + +---- +qm set 9000 --ide2 local-lvm:cloudinit +qm template 9000 +---- + +Clone the template into a new VM: + +---- +qm clone 9000 123 --name windows123 +---- + +Then set the password, network config and SSH key: + +---- +qm set 123 --cipassword +qm set 123 --ipconfig0 ip=10.0.10.123/24,gw=10.0.10.1 +qm set 123 --sshkey ~/.ssh/id_rsa.pub +---- + +Make sure that the `ostype` is set to any Windows version before setting the +password. Otherwise the password will be encrypted and Cloudbase-Init will use +the encrypted password as plaintext password. + +When everything is set, start the cloned guest. On the first boot the login +won't work and it will reboot automatically for the changed hostname. +After the reboot the new password should be set and login should work. + + +Cloudbase-Init and Sysprep +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Sysprep is a feature to reset the configuration of Windows and provide a `new` +system. This can be used in conjunction with Cloudbase-Init to create a clean +template. + + +When using Sysprep there are 2 configuration files that need to be adapted. +The first one is the normal configuration file, the second one is the one +ending in `-unattend.conf`. + +Cloudbase-Init runs in 2 steps, first the Sysprep step using the +`-unattend.conf` and then the regular step using the primary config file. + +For `Windows Server` running Sysprep with the provided `Unattend.xml` file +should work out of the box. Normal Windows versions however require additional +steps: + +. Open a PowerShell instance + +. Enable the Administrator user: ++ +---- +net user Administrator /active:yes` +---- + +. Install Cloudbase-Init using the Administrator user + +. Modify `Unattend.xml` to include the command to enable the Administrator user +on the first boot after sysprepping: ++ +---- + + net user administrator /active:yes + 1 + Enable Administrator User + +---- ++ +Make sure the `` does not conflict with other synchronous commands. +Modify `` of the Cloudbase-Init command to run after this one by +increasing the number to a higher value: `2` + +. (Windows 11 only) Remove the conflicting Microsoft.OneDriveSync package: ++ +---- +Get-AppxPackage -AllUsers Microsoft.OneDriveSync | Remove-AppxPackage -AllUsers +---- + +. `cd` into the Cloudbase-Init config directory: ++ +---- +cd 'C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf' +---- + +. (optional) Create a snapshot of the VM before Sysprep in case of a +misconfiguration + +. Run Sysprep: ++ +---- +C:\Windows\System32\Sysprep\sysprep.exe /generalize /oobe /unattend:Unattend.xml +---- + +After following the above steps the VM should be in shut down state due to +the Sysprep. Now you can make it into a template, clone it and configure +it as needed. + + Cloud-Init specific Options ~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel