pkg/userdata owns the API-boundary contract for cloud-init user-data
validation: which payloads a create request may carry, and the exact HTTP 422
(status and message) returned when one is rejected.
It exists as a standalone package — rather than living in a handler — because
the contract is shared across services: this repository's v2 server handler
and the compute service's instances handler both call Validate, so the
behaviour is identical everywhere by construction rather than by convention.
Behaviour
Absent user-data is valid.
Unmanaged payloads (no SSH certificate authority) must be recognizable
cloud-init; gzip is additionally permitted because it is passed to the
platform unmodified.
Managed payloads (an SSH certificate authority is referenced) must support
managed cloud-init augmentation, which excludes gzip.
Rejections carry the parser's specific reason, recovered structurally from
the parser's typed error — never by parsing message strings.
Cross-Package Context
../provisioners/managers/server
owns the underlying cloud-init parser, so the boundary check and provisioning
behaviour cannot drift apart.
Package userdata owns the API-boundary contract for cloud-init user-data
validation. It is deliberately importable by other services (the compute
instances API consumes it alongside this repository's own server handler) so
the HTTP status and message for rejected user-data are identical everywhere
by construction rather than by convention.
Validate is the canonical boundary check for user-data carried on create
requests. Absent user-data is valid. managed selects the stricter check for
payloads that will receive managed cloud-init augmentation (an SSH
certificate authority is referenced), which excludes gzip. Malformed
payloads yield the ready HTTP 422 carrying the parser's specific reason.