Describe the bug
Azure VMs can read Ignition as custom data. This does not work with CVMs, even though those still work with user data.
Reproduction steps
following FCOS docs:
gallery_name="mygallery"
az sig create --resource-group "${az_resource_group}" --gallery-name "${gallery_name}"
gallery_image_definition="mygallery-def"
az sig image-definition create \
--resource-group "${az_resource_group}" \
--gallery-name "${gallery_name}" \
--gallery-image-definition "${gallery_image_definition}" \
--publisher azure \
--offer example \
--sku standard \
--features SecurityType=ConfidentialVmSupported \
--os-type Linux \
--hyper-v-generation V2
os_vhd_storage_account=$(az storage account list -g ${az_resource_group} | jq -r '.[0].id')
gallery_image_version="1.0.0"
az sig image-version create \
--resource-group "${az_resource_group}" \
--gallery-name "${gallery_name}" \
--gallery-image-definition "${gallery_image_definition}" \
--gallery-image-version "${gallery_image_version}" \
--os-vhd-storage-account "${os_vhd_storage_account}" \
--os-vhd-uri "https://${az_storage_account}.blob.core.windows.net/${az_container}/fedora-coreos-44.20260707.1.1-azure.x86_64.vhd"
vm_name="my-fcos-cvm"
ignition_path="./config.ign"
vm_size="Standard_DC2as_v5"
gallery_image_id=$(az sig image-version show \
--gallery-image-definition "${gallery_image_definition}" \
--gallery-image-version "${gallery_image_version}" \
--gallery-name "${gallery_name}" \
--resource-group $az_resource_group | \
jq -r .id)
az vm create \
--name "${vm_name}" \
--resource-group $az_resource_group \
--size "${vm_size}" \
--image "${gallery_image_id}" \
--admin-username core \
--generate-ssh-keys \
--custom-data "$(cat ${ignition_path})" \
--public-ip-sku Standard \
--enable-vtpm true \
--security-type ConfidentialVM \
--os-disk-security-encryption-type VMGuestStateOnly \
--enable-secure-boot true
ssh core@<ip address>Expected behavior
(as tested without the last 4 VM creation options, and size Standard_B2s)
core@my-fcos-vm:~$ cat /etc/canary
ok
Actual behavior
core@my-fcos-cvm:~$ cat /etc/canary
cat: /etc/canary: No such file or directory
System details
- Azure
- fedora-coreos-44.20260707.1.1-azure.x86_64.vhd (next)
State: idle
AutomaticUpdatesDriver: Zincati
DriverState: active; periodically polling for updates (last checked Fri 2026-07-10 13:52:59 UTC)
BootedDeployment:
● ostree-image-signed:docker://quay.io/fedora/fedora-coreos:next
Digest: sha256:5089844802a74362869a1160f30e4be8c91be4dc6ede54468f01bc48078ce18c
Version: 44.20260707.1.1 (2026-07-07T18:26:24Z)
Butane or Ignition config
{
"ignition": {
"version": "3.4.0"
},
"storage": {
"files": [
{
"path": "/etc/canary",
"contents": {
"source": "data:,ok%0A"
},
"mode": 420
}
]
}
}Additional information
- Passing e.g. cloud-init custom data to Ubuntu CVMs (like
Canonical:ubuntu-24_04-lts:cvm:latest) still works.
- I noticed because we're using Azure CVMs with CoreOS as part of Trusted Execution Clusters, where passing custom data to CVMs still worked around ~April. IME there was, with no updated image, a period where it still worked sometimes, and today it doesn't work at all. Passing Ignition as user data still works, which has been our workaround, but e.g. OpenShift MAPI relies on custom data and the FCOS docs also suggest using custom data.
cc @travier @alicefr
Describe the bug
Azure VMs can read Ignition as custom data. This does not work with CVMs, even though those still work with user data.
Reproduction steps
following FCOS docs:
Expected behavior
(as tested without the last 4 VM creation options, and size
Standard_B2s)Actual behavior
System details
Butane or Ignition config
Additional information
Canonical:ubuntu-24_04-lts:cvm:latest) still works.cc @travier @alicefr