feat: support shared Windows Gen2 images by sinmentis · Pull Request #9717 · Azure/AgentBaker

Shun Lyu (sinmentis) · 2026-10-07T01:08:58Z

What this PR does / why we need it:

Mark ordinary Windows Gen2 images, including WS2022 and WS2025, as TrustedLaunchSupported. Derive this from hyperVGeneration in the common Windows build template instead of configuring each image separately. Keep Gen1 and dedicated Trusted Launch behavior unchanged.

Create new capable staging definitions directly. Migrate existing Standard definitions with a verified startsAtVersion boundary, preserving unrelated features and metadata. Reuse already-capable definitions without backfilling an absent boundary; reject invalid or future boundaries.

Add shared-image Trusted Launch scenarios for WS2022 and WS2025. Separate nodes are needed because Secure Boot and vTPM require a different VM security profile from the Standard scenarios. Keep the existing Standard scenarios and dedicated WS2025 Trusted Launch scenario name.

Enable the existing WS2022 Gen2 PR build stage so both shared images are tested against this build's image. ShellSpec covers capability creation, migration, boundary checks, publication metadata, and dedicated-image precedence.

Release handling:

This prepares image capability only. AKS RP's Windows OS eligibility remains unchanged, including its WS2022 Trusted Launch restriction. Production continues selecting dedicated Trusted Launch images by default. Shared WS2025 selection uses the runtime's default-empty version setting; production cutover and dedicated-image retirement remain in work item 40024977.

The Windows VHD-build gate must pass on the current source before merge. Generic Windows E2E uses main-tagged images and does not replace build-specific coverage. No manual cleanup or update of staging definitions is required.

github-actions · 2026-10-07T01:11:48Z

Windows Unit Test Results

3 files 18 suites 1m 6s ⏱️
563 tests 563 ✅ 0 💤 0 ❌
585 runs 585 ✅ 0 💤 0 ❌

Results for commit 8650c2e.

♻️ This comment has been updated with latest results.

aks-node-assistant · 2026-10-07T10:57:39Z

AgentBaker Linux gate detective

Run: 184499433
Failed job/stage/task: e2e / Run AgentBaker E2E / Run AgentBaker E2E

Detective summary: Ubuntu2204_PreProvision_CustomCAFailure hit VMExtensionProvisioningError exit 161 while restarting update_certs.service, matching the recurring CustomCA/update_certs gate signature.

Likely cause / signature: e2e-acl-customca-update-certs-exit161 - Known recurring AgentBaker Linux CSE CustomCA/update_certs provisioning failure.

Confidence: High for known recurring flake: same error string, scenario, VMSS payload, and repair-linked wiki row align; PR 9717 is Windows-image scoped.

Recommended owner/action: No PR action unless this branch intentionally touched Linux CSE; repair item #40042898 tracks the recurring CustomCA failure.

Strongest alternative: PR-specific Windows image regression, but the failing path is Linux CustomCA CSE and predates this PR.

Evidence: build run, build report issues, focused failed job log, PR metadata, and wiki tracker.

Wiki: e2e-acl-customca-update-certs-exit161

Copilot

🟡 Changes recommended

The reconciliation check does not verify the version boundary required to protect older images.

1 open finding

Verify startsAtVersion matches SIG_IMAGE_VERSION · New

What changed in this PR

Enables one Windows Server 2025 Gen2 image to support both standard and Trusted Launch nodes.

Changes:

Publishes and reconciles TrustedLaunchSupported capability.
Adds shared-image Trusted Launch E2E coverage.
Updates pipeline selection and focused ShellSpec coverage.

File	Description
`vhdbuilder/packer/produce-packer-settings-functions.sh`	Reconciles image-definition capability.
`spec/vhdbuilder/packer/resolve_security_type_feature_spec.sh`	Tests security-type resolution.
`spec/vhdbuilder/packer/generate_vhd_publishing_info_spec.sh`	Tests shared-image metadata.
`spec/vhdbuilder/packer/ensure_sig_vhd_exists_spec.sh`	Tests creation and reconciliation paths.
`spec/vhdbuilder/packer/ensure_sig_trusted_launch_supported_spec.sh`	Tests capability updates and failures.
`e2e/scenario/scenario_win.go`	Adds shared-image Trusted Launch scenario.
`e2e/README.md`	Documents shared-image rollout behavior.
`.pipelines/templates/.build-and-test-windows-vhds-template.yaml`	Enables capability for the Gen2 build.
`.pipelines/e2e-windows.yaml`	Skips the scenario against older main images.

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

Existing capability boundaries are not validated against the current image version, allowing an out-of-order build to proceed without Trusted Launch support.

0 open findings

1 resolved since last review

Verify startsAtVersion matches SIG_IMAGE_VERSION

Previously missed (1)

In code that hasn't changed since last review

Verify TrustedLaunchSupported startsAtVersion before returning success

vhdbuilder/packer/produce-packer-settings-functions.sh:480

🟡 Medium Risk — 🔧 Script Logic: This returns success for any existing TrustedLaunchSupported feature without checking its startsAtVersion. If a newer build has already established a later boundary in the shared staging definition, an older/out-of-order build can publish below that boundary; its version remains Standard, so the shared-image Trusted Launch scenario cannot create its VMSS. Preserve the existing boundary, but verify it applies to SIG_IMAGE_VERSION (and fail clearly when it is newer) before returning success.

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

The capability migration affects Azure image-definition compatibility and still requires live VHD and VMSS validation.

0 open findings

🧠 Review effort: Balanced

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Copilot

🔵 Needs a closer look

Live Azure migration and shared-image provisioning validation remain pending, and the required Windows VHD-build gate must pass before merge.

0 open findings

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Gallery capability migration and shared-image VMSS provisioning require the pending live VHD-build gate validation before approval.

0 open findings

🧠 Review effort: Balanced

Copilot

🔵 Needs a closer look

Persistent gallery capability migration requires human confirmation that current-head Windows VHD-build and provisioning gates pass.

0 open findings

🧠 Review effort: Balanced

Copilot

🟡 Changes recommended

Generic E2E needs rollout handling for older main-tagged images, and the required current-source Windows VHD-build gate remains unverified.

1 open issue

Gate shared-image runs until main images support Trusted Launch · New

_{Review effort: Balanced}

aks-node-assistant · 2026-10-26T23:32:20Z

AgentBaker Linux gate detective

Run: 186992930
Failed job/stage/task: e2e / Run AgentBaker E2E / vmssCSE update_certs exit 161

Detective summary: Run AgentBaker E2E failed because vmssCSE exited with status 161 while restarting update_certs.service with date invalid n/a in CSE output, then cascaded into create-vmss provisioning failures across scenarios.

Likely cause / signature: e2e-vmsscse-update-certs-service-exit-161.

Confidence: High for provisioning/CSE root cause. Timeline isolates failure to e2e/Run AgentBaker E2E, task log captures vmssCSE exit 161 with update_certs.service restart failure and date invalid n/a, and failure occurs before normal scenario validation.

Recommended owner/action: AgentBaker node provisioning/CSE owner should investigate update-certs service path and CSE script handling for missing date values, then revalidate affected image path.

Strongest alternative: PR 9717 product regression, but failure is in VM extension/CSE bootstrap with update_certs.service exit 161 and appears before scenario logic, so PR-caused runtime behavior regression is less likely.

Evidence: build run, failed timeline records for stage e2e/job Run AgentBaker E2E/task Run AgentBaker E2E, task log lines with vmssCSE exit status=161, update_certs.service failed, date invalid n/a, and repeated create vmss failures, source branch refs/pull/9717/merge, and wiki tracker.

Wiki: e2e-vmsscse-update-certs-service-exit-161

AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Reject migration results with a missing or changed startsAtVersion. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Compare existing boundaries numerically and initialize new shared definitions with a verified versioned capability before building. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Reuse existing TrustedLaunchSupported staging definitions without a boundary or resource updates. Continue validating explicit boundaries and verifying newly migrated definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Run the shared-image scenario in both Windows E2E lanes and keep the documentation consistent with the active selectors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Keep bounded updates for existing definitions and reuse already-capable definitions without boundary backfill. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Shun Lyu (sinmentis) · 2026-10-27T00:08:28Z

Rebased onto main with the CustomData size fixes from #9886 and #9892. No functional changes to this PR; only an annotation for intentional scenario registration in init().

Current source 8650c2e5 now satisfies all required CI checks. The Windows VHD gate and generic Windows E2E both passed after rerunning the failed jobs with restored test-gallery permissions. All Windows image builds and both shared Gen2 Trusted Launch scenarios passed using this build’s images.

Ready for re-review. The separate non-required generic E2E check still has failures; this does not mean every check is green.

github-actions · 2026-10-27T00:10:17Z

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1652 / 6834)	❌

github-actions · 2026-10-27T00:11:34Z

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	73%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	35%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	75% (6014 / 7980)	➖

github-actions · 2026-10-27T00:12:22Z

Package	Line Rate	Health
shellspec spec	29%	❌
Summary	29% (4637 / 16133)	❌

Copilot

🔵 Needs a closer look

Live Windows VHD-build gate results are unavailable, and mocked coverage cannot verify gallery migration safety or WS2022/WS2025 Standard and shared-image Trusted Launch provisioning.

No open issues 🎉

1 resolved since last review

Gate shared-image runs until main images support Trusted Launch

_{Review effort: Balanced}

Shun Lyu (sinmentis) marked this pull request as ready for review October 8, 2026 03:12

Copilot AI balanced review requested due to automatic review settings October 8, 2026 03:12

Shun Lyu (sinmentis) requested review from a team as code owners October 8, 2026 03:12

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 03:13

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Comment thread vhdbuilder/packer/produce-packer-settings-functions.sh Outdated

Copilot AI balanced review requested due to automatic review settings October 8, 2026 03:55

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 03:55

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 8, 2026 07:39

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 8, 2026 07:42

View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:03

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 03:04

View session

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from f223539 to f7484fe Compare October 15, 2026 03:06

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 15, 2026 03:09

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 03:09

View session

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from f7484fe to 3eff784 Compare October 15, 2026 05:55

Copilot AI balanced review requested due to automatic review settings October 15, 2026 05:55

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 15, 2026 07:26

View session

Tim Wright (timmy-wright) reviewed Oct 15, 2026

View reviewed changes

Comment thread e2e/scenario/scenario_win.go

Tim Wright (timmy-wright) reviewed Oct 15, 2026

View reviewed changes

Comment thread vhdbuilder/packer/produce-packer-settings-functions.sh Outdated

Artur Khantimirov (r2k1) reviewed Oct 16, 2026

View reviewed changes

Comment thread vhdbuilder/packer/produce-packer-settings-functions.sh

Copilot AI balanced review requested due to automatic review settings October 21, 2026 21:06

Shun Lyu (sinmentis) changed the title ~~feat: support a shared Windows 2025 Gen2 image~~ feat: support shared Windows Gen2 images Oct 23, 2026

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 23, 2026 01:00

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Comment thread e2e/scenario/scenario_win.go

Tim Wright (timmy-wright) approved these changes Oct 23, 2026

View reviewed changes

Shun Lyu (sinmentis) mentioned this pull request Oct 23, 2026

fix: reduce legacy Linux custom data encoding overhead #9880

Merged

Cameron Meissner (cameronmeissner) approved these changes Oct 23, 2026

View reviewed changes

Shun Lyu (sinmentis) and others added 9 commits October 27, 2026 13:05

feat: support a shared Windows 2025 Gen2 image

a0c59ec

AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

fix: verify the Trusted Launch capability boundary

bc5fbc2

Reject migration results with a missing or changed startsAtVersion. AB#39994891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

refactor: simplify shared Windows image capability updates

ac06f6d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

feat: mark Windows Gen2 images as Trusted Launch capable

d83f667

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

test: allow Windows scenario registration during init

8650c2e

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1e0bbdd6-8fe8-4eef-a0ff-bc3fdd4b8122

Shun Lyu (sinmentis) force-pushed the sinmentis/39994891 branch from d89d49c to 8650c2e Compare October 27, 2026 00:07

Copilot AI balanced review requested due to automatic review settings October 27, 2026 00:07

Copilot started reviewing on behalf of Shun Lyu (sinmentis) October 27, 2026 00:08

View session

Shun Lyu (sinmentis) requested review from Cameron Meissner (cameronmeissner) and Tim Wright (timmy-wright) October 27, 2026 00:08

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Shun Lyu (sinmentis) enabled auto-merge (squash) October 27, 2026 21:34

Tim Wright (timmy-wright) approved these changes Oct 27, 2026

View reviewed changes

Shun Lyu (sinmentis) merged commit b0abc4f into main Oct 27, 2026
53 of 54 checks passed

Shun Lyu (sinmentis) deleted the sinmentis/39994891 branch October 27, 2026 21:43

Conversation

Shun Lyu (sinmentis) commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

aks-node-assistant Bot commented Oct 7, 2026

AgentBaker Linux gate detective

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

aks-node-assistant Bot commented Oct 26, 2026

AgentBaker Linux gate detective

Uh oh!

Shun Lyu (sinmentis) commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Shun Lyu (sinmentis) commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

Shun Lyu (sinmentis) commented Oct 27, 2026 •

edited

Loading