feat: support a shared Windows 2025 Gen2 image by sinmentis · Pull Request #9717 · Azure/AgentBaker

Shun Lyu (sinmentis) · 2026-10-07T01:08:58Z

What this PR does / why we need it:

Build windows-2025-gen2 as TrustedLaunchSupported without enabling Trusted Launch on the build VM. Standard and Trusted Launch nodes can then use the same image.

Reuse already-capable staging definitions without startsAtVersion without updating or recreating them, matching the existing Linux staging behavior. When a boundary is present, preserve it only when valid and numerically at or below the build version; malformed, empty, or future boundaries fail the build. New capability migrations still establish and verify the exact persisted boundary, preserving other features and metadata.

Create genuinely new shared staging definitions directly as TrustedLaunchSupported. Only existing Standard definitions need a bounded capability update.

Add Windows2025Gen2_TrustedLaunch_SharedImage because its VM security profile differs from the standard scenario. Retain the dedicated TL build and existing scenario name.

Run the shared scenario in both the VHD-build gate, using that build's image, and the generic Windows E2E job, using the main-tagged test image.

Focused ShellSpec covers direct capable creation, existing-definition migration/read-back, no-backfill reuse, metadata, and dedicated precedence. Previous VHD-build and generic Windows E2E gates passed on the earlier source head; revised-source CI must run after publication.

Release handling:

No cleanup or manual update of shared test definitions is required. The Windows VHD-build gate must pass using this build's image before merge.

This change prepares shared-image capability. Production continues to select dedicated TL images. The runtime uses one default-empty version setting for approved shared-image testing. Formal production cutover and dedicated-image retirement remain in work item 40024977.

github-actions · 2026-10-07T01:11:48Z

Windows Unit Test Results

3 files 18 suites 48s ⏱️
563 tests 563 ✅ 0 💤 0 ❌
585 runs 585 ✅ 0 💤 0 ❌

Results for commit 421218a.

♻️ This comment has been updated with latest results.

aks-node-assistant · 2026-10-07T10:57:39Z

AgentBaker Linux gate detective

Run: 184499433
Failed job/stage/task: e2e / Run AgentBaker E2E / Run AgentBaker E2E

Detective summary: Ubuntu2204_PreProvision_CustomCAFailure hit VMExtensionProvisioningError exit 161 while restarting update_certs.service, matching the recurring CustomCA/update_certs gate signature.

Likely cause / signature: e2e-acl-customca-update-certs-exit161 - Known recurring AgentBaker Linux CSE CustomCA/update_certs provisioning failure.

Confidence: High for known recurring flake: same error string, scenario, VMSS payload, and repair-linked wiki row align; PR 9717 is Windows-image scoped.

Recommended owner/action: No PR action unless this branch intentionally touched Linux CSE; repair item #40042898 tracks the recurring CustomCA failure.

Strongest alternative: PR-specific Windows image regression, but the failing path is Linux CustomCA CSE and predates this PR.

Evidence: build run, build report issues, focused failed job log, PR metadata, and wiki tracker.

Wiki: e2e-acl-customca-update-certs-exit161

Copilot

🟡 Changes recommended

The reconciliation check does not verify the version boundary required to protect older images.

1 open finding

Verify startsAtVersion matches SIG_IMAGE_VERSION · New

What changed in this PR

Enables one Windows Server 2025 Gen2 image to support both standard and Trusted Launch nodes.

Changes:

Publishes and reconciles TrustedLaunchSupported capability.
Adds shared-image Trusted Launch E2E coverage.
Updates pipeline selection and focused ShellSpec coverage.

File	Description
`vhdbuilder/packer/produce-packer-settings-functions.sh`	Reconciles image-definition capability.
`spec/vhdbuilder/packer/resolve_security_type_feature_spec.sh`	Tests security-type resolution.
`spec/vhdbuilder/packer/generate_vhd_publishing_info_spec.sh`	Tests shared-image metadata.
`spec/vhdbuilder/packer/ensure_sig_vhd_exists_spec.sh`	Tests creation and reconciliation paths.
`spec/vhdbuilder/packer/ensure_sig_trusted_launch_supported_spec.sh`	Tests capability updates and failures.
`e2e/scenario/scenario_win.go`	Adds shared-image Trusted Launch scenario.
`e2e/README.md`	Documents shared-image rollout behavior.
`.pipelines/templates/.build-and-test-windows-vhds-template.yaml`	Enables capability for the Gen2 build.
`.pipelines/e2e-windows.yaml`	Skips the scenario against older main images.

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

Existing capability boundaries are not validated against the current image version, allowing an out-of-order build to proceed without Trusted Launch support.

0 open findings

1 resolved since last review

Verify startsAtVersion matches SIG_IMAGE_VERSION

Previously missed (1)

In code that hasn't changed since last review

Verify TrustedLaunchSupported startsAtVersion before returning success

vhdbuilder/packer/produce-packer-settings-functions.sh:480

🟡 Medium Risk — 🔧 Script Logic: This returns success for any existing TrustedLaunchSupported feature without checking its startsAtVersion. If a newer build has already established a later boundary in the shared staging definition, an older/out-of-order build can publish below that boundary; its version remains Standard, so the shared-image Trusted Launch scenario cannot create its VMSS. Preserve the existing boundary, but verify it applies to SIG_IMAGE_VERSION (and fail clearly when it is newer) before returning success.

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

The capability migration affects Azure image-definition compatibility and still requires live VHD and VMSS validation.

0 open findings

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

Live Azure migration and shared-image provisioning validation remain pending, and the required Windows VHD-build gate must pass before merge.

0 open findings

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Gallery capability migration and shared-image VMSS provisioning require the pending live VHD-build gate validation before approval.

0 open findings

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Persistent gallery capability migration requires human confirmation that current-head Windows VHD-build and provisioning gates pass.

0 open findings

🧠 Review effort: Balanced

Tim Wright (timmy-wright) · 2026-10-15T23:29:50Z

-		},
-	},
-})
+func init() {


How is this init func invoked? And given how the TL VHD will be retired in the future, it might make life easier just to duplicate the block - then we can delete the old one later.

This code is fine. (Though there are multiple ways to achieve the same)

I changed the way E2E are executed.

We registered all available tests in a shared variable on first launch.
Then executer picks which tests to run based on conditions.

Tim Wright (timmy-wright) · 2026-10-15T23:33:55Z

 	echo "SIG existence checking for $MODE"
+	local supported_features="DiskControllerTypes=SCSI,NVMe SecurityType=TrustedLaunchSupported"
+	if [ "${MODE}" = "windowsVhdMode" ]; then
+		supported_features="DiskControllerTypes=SCSI,NVMe SecurityType=Standard"


This seems strange - removing the TrustedLaunchSupported for Windows SIGs.

But it's made me wonder - maybe we should set TrustedLaunchSupported for all gen2 SIGs. Even for WS2022. We block trusted launch for WS2022 in aks-rp, so that's not an issue. I'm not sure if there are other implications tho.

Artur Khantimirov (r2k1) · 2026-10-16T01:01:14Z

 	fi
 }

+function ensure_sig_trusted_launch_supported() {


This feels like a lot of code for a single property configuration. Can this be simplified?

AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Reject migration results with a missing or changed startsAtVersion. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Compare existing boundaries numerically and initialize new shared definitions with a verified versioned capability before building. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Reuse existing TrustedLaunchSupported staging definitions without a boundary or resource updates. Continue validating explicit boundaries and verifying newly migrated definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Run the shared-image scenario in both Windows E2E lanes and keep the documentation consistent with the active selectors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Keep bounded updates for existing definitions and reuse already-capable definitions without boundary backfill. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Copilot

🔵 Needs a closer look

The in-place gallery capability migration needs human sign-off and confirmation that the required revised-source VHD-build gate passes.

No open issues 🎉

_{Review effort: Balanced}

github-actions · 2026-10-21T21:13:28Z

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1652 / 6834)	❌

github-actions · 2026-10-21T21:15:22Z

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	72%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	0%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	74% (5833 / 7825)	➖

github-actions · 2026-10-21T21:16:07Z

Package	Line Rate	Health
shellspec spec	29%	❌
Summary	29% (4603 / 16027)	❌

Copilot

🔵 Needs a closer look

The image-capability migration needs human confirmation that the mandatory Windows VHD-build gate passes on the revised source, which was not verified here.

No open issues 🎉

_{Review effort: Balanced}

Shun Lyu (sinmentis) marked this pull request as ready for review October 8, 2026 03:12

Copilot AI balanced review requested due to automatic review settings October 8, 2026 03:12

Shun Lyu (sinmentis) requested review from a team as code owners October 8, 2026 03:12

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 03:13

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Comment thread vhdbuilder/packer/produce-packer-settings-functions.sh Outdated

Copilot AI balanced review requested due to automatic review settings October 8, 2026 03:55

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 03:55

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 8, 2026 07:39

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 07:42

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:03

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 03:04

View session

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from f223539 to f7484fe Compare October 15, 2026 03:06

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:09

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 03:09

View session

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from f7484fe to 3eff784 Compare October 15, 2026 05:55

Copilot AI balanced review requested due to automatic review settings October 15, 2026 05:55

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 07:26

View session

Tim Wright (timmy-wright) reviewed Oct 15, 2026

View reviewed changes

Artur Khantimirov (r2k1) reviewed Oct 16, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 21, 2026 21:06

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 21, 2026 21:07

View session

Shun Lyu (sinmentis) and others added 6 commits October 22, 2026 10:10

feat: support a shared Windows 2025 Gen2 image

91ff892

AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

fix: verify the Trusted Launch capability boundary

391485c

Reject migration results with a missing or changed startsAtVersion. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from 5475af2 to 421218a Compare October 21, 2026 21:11

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 21, 2026 21:11

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 21, 2026 21:12

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Conversation

Shun Lyu (sinmentis) commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

aks-node-assistant Bot commented Oct 7, 2026

AgentBaker Linux gate detective

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Tim Wright (timmy-wright) Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

Artur Khantimirov (r2k1) Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Tim Wright (timmy-wright) Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

Artur Khantimirov (r2k1) Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Shun Lyu (sinmentis) commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading