Bug report

The ssh_import_id field comes in a couple of flavours: as a top-level section applying to (all?) created users, or as a section within a user definition. As a top-level section, ssh_import_id works happily. However, as a section within a user definition, it only works with a user other than the default user.

Steps to reproduce the problem

First we set up three LXD profiles that can used to demonstrate the issue, with the script below. The first, ssh-top, redefines the default user's name as "dave" and uses a top-level ssh_import_id. The second, ssh-additional, defines a user "dave" in addition to the default "ubuntu" user, and uses an ssh_import_id section specific to "dave". The third, ssh-default, redefines the default user's name as "dave" and includes an ssh_import_id section specific to the default user:

lxc profile create ssh-top
lxc profile edit ssh-top << EOF
config:         
  user.user-data: | 
    #cloud-config    
    user:                                           
      name: dave
    ssh_import_id:
      - lp:waveform
description: ssh_import_id at the top level
devices:     
  eth0:
    name: eth0
    network: lxdbr0
    type: nic 
  root:          
    path: /
    pool: default
    type: disk            
name: ssh-top
used_by: []
EOF

lxc profile create ssh-additional
lxc profile edit ssh-additional << EOF
config:
  user.user-data: |
    #cloud-config
    users:
    - default
    - name: dave
      ssh_import_id:
        - lp:waveform
description: ssh_import_id for an additional user
devices:
  eth0:
    name: eth0
    network: lxdbr0
    type: nic
  root:
    path: /
    pool: default
    type: disk
name: ssh-additional
used_by: []
EOF

lxc profile create ssh-default
lxc profile edit ssh-default << EOF
config:
  user.user-data: |
    #cloud-config
    user:
      name: dave
      ssh_import_id:
        - lp:waveform
description: ssh_import_id for the default user
devices:
  eth0:
    name: eth0
    network: lxdbr0
    type: nic
  root:
    path: /
    pool: default
    type: disk
name: ssh-default
used_by: []
EOF

Next, we launch a lunar instance using each profile in turn, wait a bit for cloud-init to finish (is there a better way of doing this? If not, adjust the sleep 10 according to the speed of your system!), asking it to list the SSH authorized_keys file for the user "dave" (whether that's the default or an additional user):

for prof in ssh-top ssh-additional ssh-default; do
    echo $prof
    lxc launch ubuntu:lunar --profile $prof $prof-test
    sleep 10
    lxc exec $prof-test -- ls -l ~dave/.ssh/authorized_keys
    lxc stop $prof-test
    lxc delete $prof-test
done

The results of running this on my system can be seen below:

ssh-top
Creating ssh-top-test
Starting ssh-top-test                     
-rw------- 1 dave dave 2802 Jul 31 15:39 /home/dave/.ssh/authorized_keys
ssh-additional
Creating ssh-additional-test
Starting ssh-additional-test                
-rw------- 1 dave dave 2802 Jul 31 15:39 /home/dave/.ssh/authorized_keys
ssh-default
Creating ssh-default-test
Starting ssh-default-test                 
-rw------- 1 dave dave 0 Jul 31 15:39 /home/dave/.ssh/authorized_keys

Note the final entry, using the ssh-default profile has imported nothing (but reports no errors in the cloud-init log as far as I can see).

Environment details

• Cloud-init version: 23.2.1-0ubuntu0~23.04.1
• Operating System Distribution: Ubuntu Lunar (23.04)
• Cloud provider, platform or installer type: LXD

cloud-init logs

There's not a lot interesting in the cloud-init.log from what I can see. In the ssh-top and ssh-additional examples the following lines appear:

...
2023-07-31 15:40:06,572 - modules.py[DEBUG]: Running module ssh-import-id (<module 'cloudinit.config.cc_ssh_import_id' from '/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh_import_id.py'>) with frequency once-per-instance
2023-07-31 15:40:06,572 - handlers.py[DEBUG]: start: modules-config/config-ssh-import-id: running config-ssh-import-id with frequency once-per-instance
2023-07-31 15:40:06,572 - util.py[DEBUG]: Writing to /var/lib/cloud/instances/3683ea31-11a5-4517-a7b1-a28a8767ac48/sem/config_ssh_import_id - wb: [644] 25 bytes
2023-07-31 15:40:06,573 - helpers.py[DEBUG]: Running config-ssh-import-id using lock (<FileLock using file '/var/lib/cloud/instances/3683ea31-11a5-4517-a7b1-a28a8767ac48/sem/config_ssh_import_id'>)
2023-07-31 15:40:06,573 - cc_ssh_import_id.py[DEBUG]: Importing SSH ids for user dave.
2023-07-31 15:40:06,573 - subp.py[DEBUG]: Running command ['sudo', '--preserve-env=https_proxy', '-Hu', 'dave', 'ssh-import-id', 'lp:waveform'] with allowed return codes [0] (shell=False, capture=False)
2023-07-31 15:40:06,773 - handlers.py[DEBUG]: finish: modules-config/config-ssh-import-id: SUCCESS: config-ssh-import-id ran successfully
...

However, in ssh-default the equivalent lines are rather different:

...
2023-07-31 15:40:34,978 - modules.py[DEBUG]: Running module ssh-import-id (<module 'cloudinit.config.cc_ssh_import_id' from '/usr/lib/python3/dist-packages/cloudinit/config/cc_ssh_import_id.py'>) with frequency once-per-instance
2023-07-31 15:40:34,979 - handlers.py[DEBUG]: start: modules-config/config-ssh-import-id: running config-ssh-import-id with frequency once-per-instance
2023-07-31 15:40:34,979 - util.py[DEBUG]: Writing to /var/lib/cloud/instances/f6d98218-5343-485e-9aae-a282ba4178d1/sem/config_ssh_import_id - wb: [644] 23 bytes
2023-07-31 15:40:34,979 - helpers.py[DEBUG]: Running config-ssh-import-id using lock (<FileLock using file '/var/lib/cloud/instances/f6d98218-5343-485e-9aae-a282ba4178d1/sem/config_ssh_import_id'>)
2023-07-31 15:40:34,979 - handlers.py[DEBUG]: finish: modules-config/config-ssh-import-id: SUCCESS: config-ssh-import-id ran successfully
...

No mention of "Importing SSH ids for user dave". I'm happy to attach any additional logs if required.