microsoft · mayankfz · Sep 10, 2026
@@ -0,0 +1,13 @@
+# Drop-in for multi-user.target on Azure Container Linux (ACL).
+#
+# WALinuxAgent is delivered as a systemd-sysext image.  Sysext units are
+# only visible after systemd-sysext.service merges the overlay, which
+# happens *after* the default target is already queued.  Without an
+# explicit "Upholds=", systemd has no dependency edge to pull
+# waagent.service into the boot transaction.
+#
+# "Upholds=" (systemd 249+) is a soft requirement: it starts the unit
+# whenever multi-user.target is active but does not fail the target if
+# waagent.service cannot start.
+[Unit]
+Upholds=waagent.service
@@ -0,0 +1,37 @@
+#
+# Microsoft Azure Linux Agent Configuration (ACL)
+#
+
+Extensions.Enabled=y
+
+# Auto-detect the provisioning agent (coreos-cloudinit or waagent).
+Provisioning.Agent=auto
+Provisioning.DeleteRootPassword=n
+Provisioning.RegenerateSshHostKeyPair=n
+Provisioning.SshHostKeyPairType=auto
+Provisioning.MonitorHostName=y
+Provisioning.DecodeCustomData=y
+Provisioning.ExecuteCustomData=n
+Provisioning.AllowResetSysUser=n
+
+ResourceDisk.Format=y
+ResourceDisk.Filesystem=ext4
+ResourceDisk.MountPoint=/mnt/resource
+ResourceDisk.EnableSwap=n
+ResourceDisk.SwapSizeMB=0
+ResourceDisk.MountOptions=None
+
+LBProbeResponder=y
+
+Logs.Verbose=n
+# Logs.Console=y
+
+OS.EnableFIPS=n
+OS.SshDir=/etc/ssh
+OS.RootDeviceScsiTimeout=300
+OS.OpensslPath=None
+
+AutoUpdate.Enabled=n
+
+# Add firewall rules to protect access to Azure host node services
+OS.EnableFirewall=y
@@ -0,0 +1,18 @@
+[Unit]
+Description=Microsoft Azure Linux Agent (ACL)
+Wants=network-online.target sshd-keygen.service
+After=network-online.target sshd-keygen.service systemd-sysext.service
+
+ConditionFileIsExecutable=/usr/bin/waagent
+ConditionPathExists=/etc/waagent.conf
+
+[Service]
+Type=simple
+
+ExecStart=/usr/bin/python -u /usr/bin/waagent -daemon
+
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,8 @@
+{
+ "Signatures": {
+  "10-waagent-sysext.conf": "4210ac2f6fe8b11bf011a0c855351423d69554bc84dc9d5609f6555d49c5c627",
+  "waagent.conf": "b2513218733467d0d7938514e245dfa83d99f16802d3cd97bb57916f0a071ce1",
+  "waagent.service": "218ab311af0af9ad8298510d4efd6cc793e4ad1318189010cf8453b408c2dc14",
+  "walinuxagent-acl-config-1.0.1.tar.gz": "7043a0faa53dca26a499a26623e665148c49e2aebc0d2335c3d13d45eb7e9ede"
+ }
+}
@@ -0,0 +1,58 @@
+Summary:        ACL-specific configuration overlay for WALinuxAgent
+Name:           walinuxagent-acl-config
+Version:        1.0.1
+Release:        2%{?dist}
+License:        MIT
+Vendor:         Microsoft Corporation
+Distribution:   Azure Linux
+Group:          System/Configuration
+URL:            https://github.com/microsoft/azurelinux
+
+Source0:        %{_distro_sources_url}/%{name}-%{version}.tar.gz
+Source1:        waagent.conf
+Source2:        waagent.service
+Source3:        10-waagent-sysext.conf
+
+BuildRequires:  systemd-rpm-macros
+Requires:       WALinuxAgent
+BuildArch:      noarch
+
+%description
+Overrides the default Azure Linux WALinuxAgent configuration with
+ACL-specific settings:
+- waagent.conf tuned for Azure Container Linux provisioning
+- waagent.service ordered after systemd-sysext.service
+- multi-user.target drop-in to pull waagent.service on sysext boot
+
+%prep
+# Nothing to prep - config files are shipped as local sources.
+
+%build
+# Nothing to build.
+
+%install
+install -Dm 644 %{SOURCE1} %{buildroot}%{_datadir}/walinuxagent-acl-config/waagent.conf
+install -Dm 644 %{SOURCE2} %{buildroot}%{_datadir}/walinuxagent-acl-config/waagent.service
+install -Dm 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/systemd/system/multi-user.target.d/10-waagent-sysext.conf
+
+%posttrans
+cp %{_datadir}/walinuxagent-acl-config/waagent.conf %{_sysconfdir}/waagent.conf
+cp %{_datadir}/walinuxagent-acl-config/waagent.service %{_unitdir}/waagent.service
+systemctl daemon-reload 2>/dev/null || :
+
+%files
+%{_datadir}/walinuxagent-acl-config/waagent.conf
+%{_datadir}/walinuxagent-acl-config/waagent.service
+%{_sysconfdir}/systemd/system/multi-user.target.d/10-waagent-sysext.conf
+
+%changelog
+* Thu Sep 10 2026 Mayank Singh <mayansingh@microsoft.com> - 1.0.1-2
+- Stop WALinuxAgent from activating sshd.service after SSH is disabled.
+
+* Thu Apr 23 2026 Mayank Singh <mayansingh@microsoft.com> - 1.0.1-1
+- Initial package: ACL-specific WALinuxAgent config overlay
+- waagent.conf with ACL provisioning defaults
+- waagent.service ordered after systemd-sysext.service
+- multi-user.target drop-in (Upholds=waagent.service)
+- Original version for Azure Linux.
+- License verified.
@@ -31,3 +31,4 @@ packages:
   - bootengine          # Flatcar bootengine (glob-based firstboot addon removal for UAPI UKI naming)
   - microcode_ctl       # CPU microcode updater (Fedora import)
   - selinux-policy      # SELinux reference policy (ACL-specific modules)
+  - walinuxagent-acl-config # Prevent waagent from activating sshd.service