feat: enable cloud-init write_files module for OSGuard images by awesomenix · Pull Request #7937 · Azure/AgentBaker

awesomenix · 2026-02-24T21:15:33Z

Summary

Enable the write_files cloud-init module on OSGuard images so that custom data write_files entries are delivered during node provisioning.

Problem

OSGuard's 10-users-ssh-enable.cfg explicitly lists cloud_init_modules with only users_groups and ssh. This causes cloud-init to skip the write_files module entirely, preventing any files from the custom data write_files section from being written during provisioning.

Changes

10-users-ssh-enable.cfg: Add write_files to cloud_init_modules list
baker.go: Add IsOSGuard template function (IsAzureLinuxOSGuardDistro() || CustomizedImageLinuxGuard) for guarding future /usr/ path entries
nodecustomdata.yml: Add block comment documenting that OSGuard has /usr/ read-only (dm-verity) and how to use IsOSGuard guard
baker_test.go: Add regression test asserting no write_files entries target /usr/ paths for OSGuard

Context

OSGuard uses dm-verity (UKI + reinitialize-verity) which makes /usr/ read-only. All current write_files entries target /opt/ or /etc/ (both writable), so enabling the module is safe. The IsOSGuard function and regression test prevent future regressions if someone adds a /usr/ path entry.

Testing

Unit tests pass
E2E validated with Test_AzureLinux3OSGuard

Copilot

Pull request overview

This PR enables the cloud-init write_files module for OSGuard images to support custom data file delivery during node provisioning. Previously, OSGuard's cloud-init configuration only enabled users_groups and ssh modules, preventing any write_files entries from being written. The change is safe because all current write_files entries target /opt/ or /etc/ paths (both writable on OSGuard), avoiding the read-only /usr/ partition protected by dm-verity.

Changes:

Enable write_files module in OSGuard cloud-init configuration
Add IsAzlOSGuard template function to guard OSGuard-specific logic
Add OSGuard-specific CSE helper and install script constants and variable mappings
Document /usr/ write restriction and add regression test to prevent future violations
Remove EnableScriptlessCSECmd = false overrides in OSGuard e2e tests (now works with default behavior)

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`parts/linux/cloud-init/artifacts/azlosguard/10-users-ssh-enable.cfg`	Adds `write_files` to the `cloud_init_modules` list to enable file delivery on OSGuard
`pkg/agent/baker.go`	Adds `IsAzlOSGuard` template function to detect OSGuard distros (both official and customized images)
`parts/linux/cloud-init/nodecustomdata.yml`	Adds OSGuard-specific distro script blocks and documents `/usr/` read-only restriction with guard pattern
`pkg/agent/baker_test.go`	Adds regression test ensuring no `write_files` entries target `/usr/` paths for OSGuard
`pkg/agent/const.go`	Adds OSGuard-specific CSE helper and install script file path constants
`pkg/agent/variables.go`	Adds OSGuard-specific script variable mappings for template rendering
`e2e/scenario_test.go`	Removes `EnableScriptlessCSECmd = false` overrides and fixes whitespace alignment

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Copilot · 2026-02-25T17:03:52Z

parts/linux/cloud-init/artifacts/azlosguard/10-users-ssh-enable.cfg

 cloud_init_modules:
+  - write_files
  - users_groups
  - ssh


Enabling the write_files module at the OS image level is a behavioral change for all customData versions. Older AgentBaker customData templates treated OSGuard as IsMariner and would write Mariner distro scripts + package/snapshot update units into write_files; with /usr read-only on OSGuard, that older customData could now overwrite the baked OSGuard-safe scripts and/or enable update flows that aren’t OSGuard-compatible. Please confirm backward compatibility with older customData (6‑month VHD window), or add an image-side mitigation (e.g., prevent overwriting OSGuard distro scripts / disable update units when OSGuard is detected).

this behaviour change is only with new OSGuard VHD, which means they also get new CSE + CustomData, i wouldnt worry about this scenario

Copilot · 2026-02-25T17:03:53Z

pkg/agent/baker_test.go

+		Entry("CustomizedImageLinuxGuard write_files should not target /usr/ paths", "CustomizedImageLinuxGuard", "1.24.2",
+			func(c *datamodel.NodeBootstrappingConfiguration) {
+				c.ContainerService.Properties.AgentPoolProfiles[0].KubernetesConfig = &datamodel.KubernetesConfig{
+					ContainerRuntime: datamodel.Containerd,
+				}
+				c.ContainerService.Properties.AgentPoolProfiles[0].Distro = datamodel.CustomizedImageLinuxGuard
+			}, func(o *nodeBootstrappingOutput) {
+				for path := range o.files {
+					Expect(path).NotTo(HavePrefix("/usr/"), "OSGuard has /usr/ read-only (dm-verity), write_files must not target /usr/ paths: %s", path)
+				}
+			},


This regression test only covers CustomizedImageLinuxGuard, but IsAzlOSGuard also returns true for the actual OSGuard VHD distro(s) via IsAzureLinuxOSGuardDistro(). Consider adding a second table entry for an OSGuard SIG distro (e.g., AKSAzureLinuxV3OSGuardGen2FIPSTL) so template changes can’t accidentally reintroduce /usr write_files paths for non-custom images. Also, if the intent is “no writes to /usr at all”, you may want to fail on path == "/usr" in addition to HavePrefix("/usr/").

Enable the write_files cloud-init module in OSGuard 10-users-ssh-enable.cfg so that custom data write_files entries are delivered during provisioning. Add IsOSGuard template function to guard future /usr/ path entries, since OSGuard has /usr/ mounted read-only via dm-verity. Add regression test ensuring no write_files entries target /usr/ paths for OSGuard.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

awesomenix requested review from AbelHu, Devinwong, SriHarsha001, cameronmeissner, djsly, ganeshkumarashok, juan-lee, junjiezhang1997, lilypan26, phealy, r2k1, timmy-wright, yagmurbaydogan, yewmsft and zachary-bailey as code owners February 24, 2026 21:15

awesomenix force-pushed the nishp/no_sudo branch from bba01dc to d12017e Compare February 25, 2026 00:15

awesomenix changed the base branch from master to main February 25, 2026 01:17

awesomenix requested review from calvin197, mxj220 and pdamianov-dev as code owners February 25, 2026 01:17

awesomenix force-pushed the nishp/no_sudo branch from d12017e to 7637557 Compare February 25, 2026 06:19

Copilot AI review requested due to automatic review settings February 25, 2026 06:19

awesomenix temporarily deployed to test February 25, 2026 06:19 — with GitHub Actions Inactive

Copilot started reviewing on behalf of awesomenix February 25, 2026 06:19 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

awesomenix force-pushed the nishp/no_sudo branch from 7637557 to f787373 Compare February 25, 2026 06:48

awesomenix requested a review from YaoC as a code owner February 25, 2026 06:48

awesomenix temporarily deployed to test February 25, 2026 06:48 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings February 25, 2026 16:50

awesomenix force-pushed the nishp/no_sudo branch from f787373 to 7e0d606 Compare February 25, 2026 16:50

awesomenix temporarily deployed to test February 25, 2026 16:50 — with GitHub Actions Inactive

Copilot started reviewing on behalf of awesomenix February 25, 2026 16:51 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

awesomenix force-pushed the nishp/no_sudo branch from 7e0d606 to 51608c9 Compare February 25, 2026 18:59

awesomenix temporarily deployed to test February 25, 2026 18:59 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings February 25, 2026 20:47

awesomenix force-pushed the nishp/no_sudo branch from 51608c9 to 3e8d49c Compare February 25, 2026 20:47

awesomenix temporarily deployed to test February 25, 2026 20:47 — with GitHub Actions Inactive

Copilot started reviewing on behalf of awesomenix February 25, 2026 20:48 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

mxj220 approved these changes Feb 26, 2026

View reviewed changes

lilypan26 approved these changes Feb 26, 2026

View reviewed changes

awesomenix merged commit 4adc93f into main Feb 26, 2026
33 of 35 checks passed

awesomenix deleted the nishp/no_sudo branch February 26, 2026 18:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: enable cloud-init write_files module for OSGuard images#7937

feat: enable cloud-init write_files module for OSGuard images#7937
awesomenix merged 1 commit intomainfrom
nishp/no_sudo

awesomenix commented Feb 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

awesomenix Feb 25, 2026

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

awesomenix commented Feb 24, 2026

Summary

Problem

Changes

Context

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

awesomenix Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants