fix: restore saved SSH public-key authentication policy by abigailliang-aks-sig-node · Pull Request #10053 · Azure/AgentBaker

Abigail Liang (abigailliang-aks-sig-node) · 2026-11-11T01:07:50Z

What this PR does / why we need it:

Follow-up to #10021. This PR targets its branch so the diff contains only the authentication and legacy-recovery extension, not the preparation layers or persistent-disable production wiring.

Save the effective global PubkeyAuthentication value before Entra disables it, and restore the saved yes/no value when returning to LocalUser. Preserve Match sections.
Parameterize configuration separately from activation. Validate syntax and effective policy, including Include precedence and case-insensitive sshd -T field names, before installing and starting/reloading SSH.
For LocalUser, restoring authentication alone must not enable/start an unmarked administrator-disabled or masked service.
Intentionally expand the lower layer's activation contract for legacy recovery: capture an unambiguous stopped endpoint; allow explicit Entra recovery without an owned marker; resolve aliases and infer boot activation only in the legacy fallback. External masks are never removed.
Keep the saved authentication value on configuration/reload failure.
Reuse the lower-layer systemd fixture, socket backing-service validation and cached-node dispatch guard. Adapt inherited activation tests to this explicitly broader legacy contract.

The stricter owned-record-only restore contract belongs to #10056/#10021. This broader legacy behavior needs its own review here and is not required to land those lower layers.

Which issue(s) this PR fixes:

None linked. Depends on #10021.

Validation:

SSH configuration, activation helpers and PIS ShellSpec: 86 examples, 0 failures, including the lower layers.
ShellCheck with repository exclusions, targeted POSIX checks for policy helpers/fixture, Bash syntax and git diff --check pass. The inherited cse_main has two unchanged SC3014 warnings in unrelated API-server checks.
Preserved the original authentication implementation; production differences from its fixed source are only the lower-layer backing-service validator and cached-node dispatch guard.
Tests use isolated systemctl/sshd models on macOS. No new PR-built VHD or real Linux image E2E has been run.

Save and restore the effective global public-key authentication setting across Entra and LocalUser transitions. Validate and install authentication configuration before activating SSH. Keep LocalUser activation limited to an owned disable marker, and never start an otherwise inactive service solely to reload its authentication setting. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c815829b-19d2-4af1-8269-5d704d14325c

github-actions · 2026-11-11T01:10:35Z

Windows Unit Test Results

3 files 21 suites 1m 17s ⏱️
789 tests 789 ✅ 0 💤 0 ❌
815 runs 815 ✅ 0 💤 0 ❌

Results for commit 7eb60cf.

♻️ This comment has been updated with latest results.

Normalize only sshd -T field names when saving and validating the public-key policy. Exercise lowercase, mixed-case, and uppercase output through the authentication restore flow. Target Linux VHD output casing remains unconfirmed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c815829b-19d2-4af1-8269-5d704d14325c

Sync the narrowed SSH lifecycle base without rewriting existing commits. Preserve the verified authentication and historical-state compatibility snapshot in this layer, so legacy activation inference remains part of the follow-up diff rather than the core PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c815829b-19d2-4af1-8269-5d704d14325c

Copilot

🟡 Changes recommended

The SSH configuration round trip can silently enable public-key authentication for restricted users, and the LocalUser reload path can restart an administratively stopped SSH service.

2 open issues

What changed in this PR

This follow-up to #10021 adds SSH public-key authentication policy restoration to Linux node provisioning, alongside the persistent SSH-disable lifecycle handling.

Changes:

Save the effective global authentication setting before Entra disables it, then restore it for LocalUser.
Validate and install authentication configuration before service activation, retaining backups when reconciliation fails.
Extend ShellSpec coverage for restoration, activation ownership, external masks, and validation failures.

File	Description
`spec/parts/linux/cloud-init/artifacts/cse_config_spec.sh`	Adds authentication restoration and failure-path tests; updates legacy recovery expectations.
`parts/linux/cloud-init/artifacts/cse_config.sh`	Adds policy backup/restoration, effective-policy validation, and separate activation handling.

_{Review effort: Balanced}

-  awk -v desired="no" '
+  awk -v desired="$desired" '
    BEGIN { in_match=0; replaced=0; inserted=0 }
    /^Match([[:space:]]|$)/ {


+      return 0
+    fi
+  fi
+  systemctl reload-or-restart "$ssh_service"


Retain the legacy activation and authentication extension, reuse the shared systemd fixture, and inherit backing-service validation and the cached-node dispatch guard. Adapt inherited helper tests to the explicitly broader legacy contract. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c815829b-19d2-4af1-8269-5d704d14325c

github-actions · 2026-11-11T02:15:15Z

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	71%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	39% (1983 / 7220)	❌

github-actions · 2026-11-11T02:17:37Z

Package	Line Rate	Health
shellspec spec	30%	❌
Summary	30% (5069 / 16766)	❌

Copilot

🟡 Changes recommended

SSH policy restoration can inadvertently enable public-key authentication for restricted users, while failed backup writes can prevent restoration on provisioning retries.

3 open issues

_{Review effort: Balanced}

+      yes|no) ;;
+      *) echo "Cannot determine the original SSH public-key policy" >&2; exit "$ERR_CONFIG_PUBKEY_AUTH_SSH" ;;
+    esac
+    printf '%s\n' "$original" > "$policy_dir/pubkey-auth" || exit "$ERR_CONFIG_PUBKEY_AUTH_SSH"


github-actions · 2026-11-11T02:20:18Z

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	73%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	92%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	35%	❌
github.com/Azure/agentbaker/pkg/agent	79%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	76% (6097 / 8043)	➖

Abigail Liang (abigailliang-aks-sig-node) requested review from a team as code owners November 11, 2026 01:07

Abigail Liang (abigailliang-aks-sig-node) mentioned this pull request Nov 11, 2026

fix: reconcile Linux SSH access policy across node lifecycle #10021

Open

Abigail Liang (abigailliang-aks-sig-node) added this pull request to stack #10054 November 11, 2026 01:10

Abigail Liang (abigailliang-aks-sig-node) and others added 2 commits November 10, 2026 17:29

Copilot AI balanced review requested due to automatic review settings November 11, 2026 01:33

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) November 11, 2026 01:33

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 11, 2026 02:12

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) November 11, 2026 02:12

View session

Abigail Liang (abigailliang-aks-sig-node) removed this pull request from stack #10054 November 11, 2026 02:13

Abigail Liang (abigailliang-aks-sig-node) added this pull request to stack #10057 November 11, 2026 02:14

Copilot AI reviewed Nov 11, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/cse_config.sh

yes|no) ;;

*) echo "Cannot determine the original SSH public-key policy" >&2; exit "$ERR_CONFIG_PUBKEY_AUTH_SSH" ;;

esac

printf '%s\n' "$original" > "$policy_dir/pubkey-auth" || exit "$ERR_CONFIG_PUBKEY_AUTH_SSH"

Navigation Menu

Repository navigation

fix: restore saved SSH public-key authentication policy - #10053

fix: restore saved SSH public-key authentication policy#10053
Abigail Liang (abigailliang-aks-sig-node) wants to merge 4 commits into
abigailliang/ssh-policy-lifecyclefrom
abigailliang/ssh-auth-policy-followup

Abigail Liang (abigailliang-aks-sig-node) commented Nov 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Abigail Liang (abigailliang-aks-sig-node) commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Abigail Liang (abigailliang-aks-sig-node) commented Nov 11, 2026 •

edited

Loading

github-actions Bot commented Nov 11, 2026 •

edited

Loading