fix(windows): enforce SSH access policy during node provisioning by titilambert · Pull Request #9710 · Azure/AgentBaker

Thibault Cohen (titilambert) · 2026-10-06T19:17:03Z

What this PR does / why we need it:

When Windows SSH access is disabled, provisioning currently skips OpenSSH configuration without explicitly stopping or disabling an existing sshd service. On Windows Server 2025 images where sshd is running after boot, SSH therefore remains active despite the requested policy.

This change:

Stops and disables sshd when SSH access is disabled, without installing OpenSSH if it is absent.
Consolidates SSH policy handling in Install-OpenSSH. When enabling SSH, it keeps the service stopped and disabled while replacing inherited authorized keys and applying ACLs, then enables and starts it only after those steps succeed. Key/ACL preparation errors fail provisioning without reactivating the service.
Preserves OpenSSH installation and configuration in BasePrep when SSH is enabled. NodePrep reapplies the current policy and keys on every real node, including PIS-cached nodes that skip BasePrep; this does not depend on an SSH-only change triggering a rebake.
Ships the same implementation in the CSE package and CustomData, loading the inline copy after cached CSE scripts for compatibility with older packages.
Adds Windows2025_DisableSSH, which checks that sshd is stopped and its startup type is Disabled. SSH-enabled Windows bakes retain SSH validation; Windows scenarios that explicitly skip SSH connectivity use RunCommand for guest checks in both PIS stages. Linux behavior is unchanged.

Validation:

Passed 51 targeted Pester tests for SSH behavior and PIS phase placement, plus the existing cross-directory logger guard. These ran with PowerShell 7.6.7 and Pester 5.7.1 on Linux, with Windows service operations mocked. Regression coverage includes key-preparation and ACL failures, fresh installation, and re-enabling a cached disabled service.
Passed go test ./pkg/agent -run '^TestWindowsCustomData' -count=1 and git diff --check.
For commit 35536a0c92, GitHub Pester, Windows Unit Test Results, and Go unit-test checks have passed. Azure E2E runs and Windows VHD builds are still pending/in progress; end-to-end validation of this revision is not yet complete.

Which issue(s) this PR fixes:

Fixes Windows SSH access remaining enabled when the requested SSH policy is disabled. No linked GitHub issue.

Thibault Cohen (titilambert) · 2026-10-06T19:17:06Z

This change is part of the following stack:

fix(windows): enforce SSH access policy during node provisioning #9710 ◀

_{Change managed by git-spice.}

github-actions · 2026-10-06T19:19:55Z

Windows Unit Test Results

3 files 19 suites 1m 17s ⏱️
594 tests 594 ✅ 0 💤 0 ❌
619 runs 619 ✅ 0 💤 0 ❌

Results for commit f9b40b9.

♻️ This comment has been updated with latest results.

Copilot

Copilot review overview

🟡 Changes recommended

Existing bake-time administrator keys remain authorized because the installation helper appends live keys without replacing stale ones.

Review effort: Balanced
Findings: 1

Open (1)

Stale bake-time SSH key remains authorized after live key update · New

What changed in this PR

Moves Windows SSH policy enforcement into NodePrep for PIS compatibility.

Changes:

Enables, disables, or installs OpenSSH based on live policy.
Adds Pester coverage for SSH behavior and phase placement.
Embeds enforcement through the CustomData helper.

File	Description
`parts/windows/windowscsehelper.ps1`	Adds SSH policy enforcement.
`parts/windows/windowscsehelper.tests.ps1`	Tests enforcement and failures.
`parts/windows/kuberneteswindowssetup.ps1.template`	Moves SSH handling to NodePrep.
`parts/windows/kuberneteswindowssetup.pisphases.tests.ps1`	Verifies PIS phase placement.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🔵 Needs a closer look

Existing PIS-baked SSH keys remain authorized because the live keys are appended rather than replacing stale keys.

1 open finding

Stale bake-time SSH key remains authorized after live key update

🧠 Review effort: Balanced

Copilot

🟡 Changes recommended

The Windows PIS bake flow still requires SSH authentication but no longer installs its test key.

1 open finding

Windows PIS bake tests fail after SSH key installation moves to NodePrep · New

1 resolved since last review

Stale bake-time SSH key remains authorized after live key update

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Native Windows service behavior is only mock-tested, and Windows Server 2025 and PIS Azure E2E validation remains pending.

1 open finding

Windows PIS bake tests fail after SSH key installation moves to NodePrep

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Windows service operations have only mocked validation, and Windows 2025 and PIS Azure E2E validation remains pending.

1 open issue

Windows PIS bake tests fail after SSH key installation moves to NodePrep

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Windows service operations are mock-tested, but live Windows 2025 and PIS validation remains pending.

No open issues 🎉

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Starting sshd before replacing inherited keys can leave stale credentials usable after provisioning fails.

1 open issue

Keep sshd stopped until authorized keys and ACLs are applied · New

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Windows service operations are mocked, and Windows 2025/PIS Azure validation remains pending.

No open issues 🎉

1 resolved since last review

Keep sshd stopped until authorized keys and ACLs are applied

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Security-sensitive Windows provisioning and cached-image compatibility need human review after pending Azure E2E and VHD-build validation completes.

No open issues 🎉

_{Review effort: Balanced}

Apply SSH policy in NodePrep for both standard and PIS-cached nodes. Stop and disable sshd when SSH access is disabled, and allow previously disabled services to start when SSH is enabled. Keep the policy helper embedded in CustomData for compatibility with older CSE packages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Preserve the authorized keys file and its ACL while removing stale PIS keys. Cover repeated configuration and cleanup failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Limit RunCommand guest validation to Windows scenarios that skip SSH connectivity, and restore existing SSH startup ordering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Stop and disable sshd before replacing inherited authorized keys. Enable it only after key and ACL preparation succeeds, including on fresh installations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-10-21T19:39:48Z

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1670 / 6844)	❌

github-actions · 2026-10-21T19:40:47Z

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	72%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	0%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	74% (5836 / 7828)	➖

Copilot

🔵 Needs a closer look

Security-sensitive Windows provisioning and cached-image compatibility changes need completed Azure E2E and Windows VHD validation before human approval.

No open issues 🎉

_{Review effort: Balanced}

github-actions · 2026-10-21T19:41:18Z

Package	Line Rate	Health
shellspec spec	28%	❌
Summary	28% (4556 / 15971)	❌

Copilot AI balanced review requested due to automatic review settings October 6, 2026 19:17

Thibault Cohen (titilambert) requested review from a team, Nishchay (awesomenix), Ben Brady (benjamin-brady), Cameron Meissner (cameronmeissner), Sylvain Boily (djsly), Artur Khantimirov (r2k1) and Tim Wright (timmy-wright) as code owners October 6, 2026 19:17

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 6, 2026 19:17

View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Comment thread parts/windows/windowscsehelper.ps1 Outdated

Copilot AI balanced review requested due to automatic review settings October 14, 2026 14:51

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from d6fb536 to bb8c94d Compare October 14, 2026 14:51

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 14, 2026 15:03

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 14, 2026 20:37

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from bb8c94d to db61c18 Compare October 14, 2026 20:37

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 14, 2026 20:38

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Comment thread parts/windows/kuberneteswindowssetup.ps1.template Outdated

Copilot AI balanced review requested due to automatic review settings October 15, 2026 02:44

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from db61c18 to 2f62a5d Compare October 15, 2026 02:44

Thibault Cohen (titilambert) requested review from a team as code owners October 15, 2026 02:44

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 15, 2026 02:44

View session

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from 2f62a5d to e9ba571 Compare October 19, 2026 13:14

Copilot AI balanced review requested due to automatic review settings October 19, 2026 13:14

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 19, 2026 13:14

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 20, 2026 16:04

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 20, 2026 16:04

View session

Copilot AI reviewed Oct 20, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 20, 2026 17:33

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 20, 2026 17:34

View session

Copilot AI reviewed Oct 20, 2026

View reviewed changes

Comment thread staging/cse/windows/sshfunc.ps1 Outdated

Copilot AI balanced review requested due to automatic review settings October 21, 2026 12:56

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 21, 2026 12:58

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 21, 2026 16:40

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from 35536a0 to 05fc0af Compare October 21, 2026 16:40

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 21, 2026 16:41

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Thibault Cohen (titilambert) and others added 10 commits October 21, 2026 15:21

fix(windows): clear inherited SSH keys before applying live keys

7a7f482

Preserve the authorized keys file and its ACL while removing stale PIS keys. Cover repeated configuration and cleanup failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(e2e): use RunCommand for Windows PIS bake validation

3808918

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

test(e2e): validate disabled SSH on Windows Server 2025

fa688db

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix PR comments

7080cfb

fix(windows): prepare OpenSSH capability during BasePrep

3f4bd12

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

refactor(windows): consolidate SSH access in Install-OpenSSH

23a58b8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix tests

47c7f79

refactor(windows): preserve SSH-enabled bake behavior

5bc1030

Limit RunCommand guest validation to Windows scenarios that skip SSH connectivity, and restore existing SSH startup ordering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix(windows): keep SSH disabled until live keys are configured

f9b40b9

Stop and disable sshd before replacing inherited authorized keys. Enable it only after key and ACL preparation succeeds, including on fresh installations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 21, 2026 19:36

Thibault Cohen (titilambert) force-pushed the fix-windows-enforce-ssh-access branch from 05fc0af to f9b40b9 Compare October 21, 2026 19:36

Copilot started reviewing on behalf of Thibault Cohen (titilambert) October 21, 2026 19:37

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Conversation

Thibault Cohen (titilambert) commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Thibault Cohen (titilambert) commented Oct 6, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Thibault Cohen (titilambert) commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading