Skip to content

How-to

cloudbase-init

Run a PowerShell script on a Windows instance at its first boot, with user data. Breqwatr Cloud's Windows Server images include cloudbase-init, the Windows counterpart of cloud-init, which runs it.

How it works

  • You pass a script as user data when you launch the instance.
  • cloudbase-init runs it once, at the instance's first boot. Changing the user data later means launching a new instance.
  • The script's first line tells cloudbase-init how to run it. #ps1_sysnative runs the rest as PowerShell.
  • cloudbase-init doesn't set the Administrator password. You set it on the console at first sign-in, as in Windows images.

Before you start

  • A Windows Server image and what it needs to launch: see Windows images.
  • A script. The example below adds a WinRM listener on HTTPS, with a self-signed certificate, and opens TCP 5986 in the Windows firewall, which is what Configuration with Ansible needs. Save it as winrm-https.ps1:
#ps1_sysnative
$cert = New-SelfSignedCertificate -DnsName $env:COMPUTERNAME -CertStoreLocation Cert:\LocalMachine\My
New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $cert.Thumbprint -Force
New-NetFirewallRule -DisplayName "WinRM over HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

Launch with user data

On New instance in the Breqwatr Cloud Portal (Strata), choose the Windows Server image, then paste the script into User data (optional).

openstack --os-cloud <cloud-name> server create win-01 \
  --flavor v1.c2r8 --network app-net --security-group <security-group> \
  --block-device source_type=image,uuid=<image-id>,destination_type=volume,volume_size=80,boot_index=0,delete_on_termination=true \
  --user-data winrm-https.ps1 \
  --wait

In the openstack_compute_instance_v2 resource:

user_data = file("${path.module}/winrm-https.ps1")

A change to the script makes OpenTofu plan to replace the instance, because user data only runs at first boot.

Check it worked

The first boot takes several minutes. For the example script, port 5986 then answers, if the instance's security group allows it from your IP address:

Test-NetConnection <floating-ip> -Port 5986

nc -z -w 5 <floating-ip> 5986 && echo open

nc -z -w 5 <floating-ip> 5986 && echo open