{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "slug": "dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data", "url": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/" }, "title": "Keep UDF support when cloud-init provisioning needs passwords or custom data", "summary": "Can an Azure Linux image drop its UDF driver without changing the provisioning inputs it accepts?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:12+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 242, "potentially_affected": "Linux image maintainers evaluating the documented cloud-init provisioning path in Azure.", "dse_recommendation": "List the required provisioning inputs before deciding to remove UDF support from an image.", "primary_source": { "name": "Overview of cloud-init support for Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

From cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. Microsoft Learn.

\n

Applicability

\n

Use this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.

\n

DSE recommendation

\n

List the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.

\n

Verification

\n

Build a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.

\n

Official references

\n

Microsoft Learn: cloud-init support for virtual machines in Azure. Source reviewed September 9, 2026.

", "content_text": "Source facts\nFrom cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. Microsoft Learn.\nApplicability\nUse this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.\nDSE recommendation\nList the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.\nVerification\nBuild a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.\nOfficial references\nMicrosoft Learn: cloud-init support for virtual machines in Azure. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nFrom cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init).\n\n## Applicability\n\nUse this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.\n\n## DSE recommendation\n\nList the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.\n\n## Verification\n\nBuild a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.\n\n## Official references\n\n[Microsoft Learn: cloud-init support for virtual machines in Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "url": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep UDF support when cloud-init provisioning needs passwords or custom data", "item": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "url": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/", "headline": "Keep UDF support when cloud-init provisioning needs passwords or custom data", "description": "Can an Azure Linux image drop its UDF driver without changing the provisioning inputs it accepts?", "abstract": "Can an Azure Linux image drop its UDF driver without changing the provisioning inputs it accepts?", "articleBody": "Source facts\nFrom cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. Microsoft Learn.\nApplicability\nUse this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.\nDSE recommendation\nList the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.\nVerification\nBuild a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.\nOfficial references\nMicrosoft Learn: cloud-init support for virtual machines in Azure. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:22:12+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep UDF support when cloud-init provisioning needs passwords or custom data" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Overview of cloud-init support for Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init" } } ] } }