Keep UDF support when cloud-init provisioning needs passwords or custom data

Source facts

From cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. Microsoft Learn.

Applicability

Use this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.

DSE recommendation

List the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.

Verification

Build a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.

Official references

Microsoft Learn: cloud-init support for virtual machines in Azure. Source reviewed September 9, 2026.