fix: Stop waagent from pulling in sshd.service on ACL

[mayankfz]

Summary

fix: Stop waagent from pulling in sshd.service on ACL

Change Log

In ACL nodes where AgentBaker turns SSH off, SSH came back after a reboot.

ACL uses socket-activated SSH, but waagent.service still listed the old-style daemon as a dependency:

Normally that line is inert, sshd.socket is enabled and declares Conflicts=sshd.service, and since the socket is pulled in strongly by sockets.target while waagent only wants the service, systemd drops the service job. But once AgentBaker disables sshd.socket, the conflict is gone, so on the next boot waagent starts sshd.service and SSH is back on a node that's meant to have it off.

This adds walinuxagent-acl-config as a local override package with sshd.service removed from Wants=.
Nothing else changes: waagent doesn't otherwise touch SSH on ACL (AclOSUtil.restart_ssh_service() and conf_sshd() are both no-ops), and normal nodes are unaffected since sshd.socket serves SSH on its own.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

https://dev.azure.com/mariner-org/ACL/_workitems/edit/22659

Test Methodology

• Test details:
  https://dev.azure.com/msazure/CloudNativeCompute/_build/results?buildId=180699839&view=results

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

🟡 Changes recommended

Unresolved service executable, package ownership, sysext installation, and package integration issues remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds an ACL-specific WALinuxAgent package overlay to prevent sshd.service from being activated when SSH is disabled.

Changes:

• Adds ACL WALinuxAgent configuration and systemd overrides.
• Registers the package and source signatures.
• Removes the SSH daemon dependency from the custom unit.

File summaries

File	Description
acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec	Defines the ACL configuration RPM.
acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.signatures.json	Provides source signatures.
acl/SPECS/walinuxagent-acl-config/waagent.service	Provides the modified WALinuxAgent systemd unit.
acl/SPECS/walinuxagent-acl-config/waagent.conf	Supplies ACL-specific agent settings.
acl/SPECS/walinuxagent-acl-config/10-waagent-sysext.conf	Configures WALinuxAgent startup ordering.
acl/packages.yaml	Includes the package in ACL builds.

Review details

Suppressed comments (1)

acl/SPECS/walinuxagent-acl-config/walinuxagent-acl-config.spec:36

• oem-azure is built as a sysext, and the sysext builder removes every directory except /usr before creating the image. Installing this drop-in under %{_sysconfdir} means it is discarded, so this package does not actually ship the Upholds= edge it documents; the currently bundled WALinuxAgent copy happens to mask that omission. Install it under %{_unitdir}/multi-user.target.d (as the upstream WALinuxAgent unit does) or arrange for this file to be installed in the base layer.

install -Dm 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/systemd/system/multi-user.target.d/10-waagent-sysext.conf

• Files reviewed: 6/6 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The systemd drop-in may be omitted from the sysext image, preventing the fix from working at runtime.

1 open finding

• Systemd drop-in omitted from sysext, disabling the Upholds dependency · New

3 resolved since last review

• Adding this RPM to acl/packages.yaml relies on the app-emulation/wa-linux-agent catalog entry…
• The Azure Linux WALinuxAgent RPM installs the agent as /usr/sbin/waagent (%{_sbindir}), so this…
• These copies are not included in this package's %files manifest, so /etc/waagent.conf and…

🧠 Review effort: Lite

[Jiri Appl (jiria)]

Could the SSH dependency removal use the existing OEM RPM mangle step, which already edits waagent.service, rather than copying the entire vendor unit into a local package? Copying the unit can obscure future upstream changes. A targeted edit could check for the expected Wants= entry, remove only sshd.service, and preserve sshd-keygen.service. I realize this package also supplies ACL configuration and sysext ordering, so it cannot simply be dropped; if the unit copy must remain, documenting how it will track upstream changes would help address the maintenance risk.

[Jiri Appl (jiria)]

Could we add a regression check for the disabled-SSH reboot case? Checking that the final post-mangle waagent.service does not want sshd.service would catch packaging drift. An Azure VM test could also disable sshd.socket, reboot, and verify that waagent starts while sshd.service and sshd.socket remain inactive. This is a coverage suggestion, not a claim that the current image fails.

[mayankfz]

Could we add a regression check for the disabled-SSH reboot case? Checking that the final post-mangle waagent.service does not want sshd.service would catch packaging drift. An Azure VM test could also disable sshd.socket, reboot, and verify that waagent starts while sshd.service and sshd.socket remain inactive. This is a coverage suggestion, not a claim that the current image fails.

The guard is that packaging-drift check, the build fails if post-mangle waagent.service still wants sshd.service or lost sshd-keygen.service. Will add the reboot-on-Azure test too, would put it in the kola suite. Will take it later.

[mayankfz]

Could the SSH dependency removal use the existing OEM RPM mangle step, which already edits waagent.service, rather than copying the entire vendor unit into a local package? Copying the unit can obscure future upstream changes. A targeted edit could check for the expected Wants= entry, remove only sshd.service, and preserve sshd-keygen.service. I realize this package also supplies ACL configuration and sysext ordering, so it cannot simply be dropped; if the unit copy must remain, documenting how it will track upstream changes would help address the maintenance risk.

moved it to the OEM mangle step as a targeted with guards. Removed the package, but eventually will it be better to push it upstream, since its only config package with our control on it.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

0 open findings

1 resolved since last review

• Systemd drop-in omitted from sysext, disabling the Upholds dependency

🧠 Review effort: Lite

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.