From 655ba919425647db740ac282f26d3898f216f4f3 Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Thu, 10 Sep 2026 10:19:20 +0000 Subject: [PATCH] fix ACL SSH after reboot --- .../10-waagent-sysext.conf | 13 +++++ .../walinuxagent-acl-config/waagent.conf | 37 ++++++++++++ .../walinuxagent-acl-config/waagent.service | 18 ++++++ .../walinuxagent-acl-config.signatures.json | 8 +++ .../walinuxagent-acl-config.spec | 58 +++++++++++++++++++ acl/packages.yaml | 1 + 6 files changed, 135 insertions(+) create mode 100644 acl/SPECS/walinuxagent-acl-config/10-waagent-sysext.conf create mode 100644 acl/SPECS/walinuxagent-acl-config/waagent.conf create mode 100644 acl/SPECS/walinuxagent-acl-config/waagent.service create mode 100644 acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.signatures.json create mode 100644 acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec diff --git a/acl/SPECS/walinuxagent-acl-config/10-waagent-sysext.conf b/acl/SPECS/walinuxagent-acl-config/10-waagent-sysext.conf new file mode 100644 index 00000000000..af929741801 --- /dev/null +++ b/acl/SPECS/walinuxagent-acl-config/10-waagent-sysext.conf @@ -0,0 +1,13 @@ +# Drop-in for multi-user.target on Azure Container Linux (ACL). +# +# WALinuxAgent is delivered as a systemd-sysext image. Sysext units are +# only visible after systemd-sysext.service merges the overlay, which +# happens *after* the default target is already queued. Without an +# explicit "Upholds=", systemd has no dependency edge to pull +# waagent.service into the boot transaction. +# +# "Upholds=" (systemd 249+) is a soft requirement: it starts the unit +# whenever multi-user.target is active but does not fail the target if +# waagent.service cannot start. +[Unit] +Upholds=waagent.service diff --git a/acl/SPECS/walinuxagent-acl-config/waagent.conf b/acl/SPECS/walinuxagent-acl-config/waagent.conf new file mode 100644 index 00000000000..2c775d80b80 --- /dev/null +++ b/acl/SPECS/walinuxagent-acl-config/waagent.conf @@ -0,0 +1,37 @@ +# +# Microsoft Azure Linux Agent Configuration (ACL) +# + +Extensions.Enabled=y + +# Auto-detect the provisioning agent (coreos-cloudinit or waagent). +Provisioning.Agent=auto +Provisioning.DeleteRootPassword=n +Provisioning.RegenerateSshHostKeyPair=n +Provisioning.SshHostKeyPairType=auto +Provisioning.MonitorHostName=y +Provisioning.DecodeCustomData=y +Provisioning.ExecuteCustomData=n +Provisioning.AllowResetSysUser=n + +ResourceDisk.Format=y +ResourceDisk.Filesystem=ext4 +ResourceDisk.MountPoint=/mnt/resource +ResourceDisk.EnableSwap=n +ResourceDisk.SwapSizeMB=0 +ResourceDisk.MountOptions=None + +LBProbeResponder=y + +Logs.Verbose=n +# Logs.Console=y + +OS.EnableFIPS=n +OS.SshDir=/etc/ssh +OS.RootDeviceScsiTimeout=300 +OS.OpensslPath=None + +AutoUpdate.Enabled=n + +# Add firewall rules to protect access to Azure host node services +OS.EnableFirewall=y diff --git a/acl/SPECS/walinuxagent-acl-config/waagent.service b/acl/SPECS/walinuxagent-acl-config/waagent.service new file mode 100644 index 00000000000..c4368425d54 --- /dev/null +++ b/acl/SPECS/walinuxagent-acl-config/waagent.service @@ -0,0 +1,18 @@ +[Unit] +Description=Microsoft Azure Linux Agent (ACL) +Wants=network-online.target sshd-keygen.service +After=network-online.target sshd-keygen.service systemd-sysext.service + +ConditionFileIsExecutable=/usr/bin/waagent +ConditionPathExists=/etc/waagent.conf + +[Service] +Type=simple + +ExecStart=/usr/bin/python -u /usr/bin/waagent -daemon + +Restart=always +RestartSec=5s + +[Install] +WantedBy=multi-user.target diff --git a/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.signatures.json b/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.signatures.json new file mode 100644 index 00000000000..3348f3fadb3 --- /dev/null +++ b/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.signatures.json @@ -0,0 +1,8 @@ +{ + "Signatures": { + "10-waagent-sysext.conf": "4210ac2f6fe8b11bf011a0c855351423d69554bc84dc9d5609f6555d49c5c627", + "waagent.conf": "b2513218733467d0d7938514e245dfa83d99f16802d3cd97bb57916f0a071ce1", + "waagent.service": "218ab311af0af9ad8298510d4efd6cc793e4ad1318189010cf8453b408c2dc14", + "walinuxagent-acl-config-1.0.1.tar.gz": "7043a0faa53dca26a499a26623e665148c49e2aebc0d2335c3d13d45eb7e9ede" + } +} diff --git a/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec b/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec new file mode 100644 index 00000000000..5c47e777046 --- /dev/null +++ b/acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec @@ -0,0 +1,58 @@ +Summary: ACL-specific configuration overlay for WALinuxAgent +Name: walinuxagent-acl-config +Version: 1.0.1 +Release: 2%{?dist} +License: MIT +Vendor: Microsoft Corporation +Distribution: Azure Linux +Group: System/Configuration +URL: https://github.com/microsoft/azurelinux + +Source0: %{_distro_sources_url}/%{name}-%{version}.tar.gz +Source1: waagent.conf +Source2: waagent.service +Source3: 10-waagent-sysext.conf + +BuildRequires: systemd-rpm-macros +Requires: WALinuxAgent +BuildArch: noarch + +%description +Overrides the default Azure Linux WALinuxAgent configuration with +ACL-specific settings: +- waagent.conf tuned for Azure Container Linux provisioning +- waagent.service ordered after systemd-sysext.service +- multi-user.target drop-in to pull waagent.service on sysext boot + +%prep +# Nothing to prep - config files are shipped as local sources. + +%build +# Nothing to build. + +%install +install -Dm 644 %{SOURCE1} %{buildroot}%{_datadir}/walinuxagent-acl-config/waagent.conf +install -Dm 644 %{SOURCE2} %{buildroot}%{_datadir}/walinuxagent-acl-config/waagent.service +install -Dm 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/systemd/system/multi-user.target.d/10-waagent-sysext.conf + +%posttrans +cp %{_datadir}/walinuxagent-acl-config/waagent.conf %{_sysconfdir}/waagent.conf +cp %{_datadir}/walinuxagent-acl-config/waagent.service %{_unitdir}/waagent.service +systemctl daemon-reload 2>/dev/null || : + +%files +%{_datadir}/walinuxagent-acl-config/waagent.conf +%{_datadir}/walinuxagent-acl-config/waagent.service +%{_sysconfdir}/systemd/system/multi-user.target.d/10-waagent-sysext.conf + +%changelog +* Thu Sep 10 2026 Mayank Singh - 1.0.1-2 +- Stop WALinuxAgent from activating sshd.service after SSH is disabled. + +* Thu Apr 23 2026 Mayank Singh - 1.0.1-1 +- Initial package: ACL-specific WALinuxAgent config overlay +- waagent.conf with ACL provisioning defaults +- waagent.service ordered after systemd-sysext.service +- multi-user.target drop-in (Upholds=waagent.service) +- Original version for Azure Linux. +- License verified. diff --git a/acl/packages.yaml b/acl/packages.yaml index bd6fb20543b..786e78a3b23 100644 --- a/acl/packages.yaml +++ b/acl/packages.yaml @@ -31,3 +31,4 @@ packages: - bootengine # Flatcar bootengine (glob-based firstboot addon removal for UAPI UKI naming) - microcode_ctl # CPU microcode updater (Fedora import) - selinux-policy # SELinux reference policy (ACL-specific modules) + - walinuxagent-acl-config # Prevent waagent from activating sshd.service