fix(security): use random build/test VM passwords and keep them out o… by calvin197 · Pull Request #9791 · Azure/AgentBaker

Calvin S. (calvin197) · 2026-10-15T07:07:35Z

What this PR does / why we need it:
Hardens credential handling in two VHD build/test scripts that run in the AgentBaker VHD pipeline. Addresses Mythos security findings (tracked under ADO 37518878):

• Scan VM password (ADO 37518912) — vhdbuilder/packer/vhd-scanning.sh set the trivy-scan VM's admin password to ScanVM@$CURRENT_TIME (a Unix epoch timestamp), which is trivially guessable. Now generated randomly via openssl rand . The ScanVM@ prefix is kept so Azure VM password-complexity rules (upper/lower/special) are still satisfied.
• Test VM password (ADO 37518914) — vhdbuilder/packer/test/run-test.sh set the test VM's admin password to TestVM@$(date +%s) (predictable, CWE-330) and leaked it to the ADO build log in two ways: the az vm create --admin-password calls ran under set -x (xtrace), and a final echo printed it verbatim (CWE-532, not masked as a pipeline secret). Fix: randomize the password, wrap both az vm create calls in set +x / set -x , and drop the password from the echo (username only).

No functional change beyond credential generation and log hygiene. Validated with bash -n on both scripts; the run-test ShellSpec only exercises the cleanup() function and retry loop, neither of which is touched. openssl is standard on the ADO Ubuntu build agents.
Which issue(s) this PR fixes:
Fixes #

ADO work items (msazure/CloudNativeCompute): 37518912, 37518914 (parent: 37518878)

…f CI logs Addresses Mythos findings tracked under ADO 37518878: - 37518912: vhd-scanning.sh set SCAN_VM_ADMIN_PASSWORD to the deterministic "ScanVM@$CURRENT_TIME" (epoch timestamp, trivially guessable). Generate a random password instead. The "ScanVM@" prefix guarantees upper/lower/special so Azure VM password-complexity rules are still satisfied. - 37518914: run-test.sh set TEST_VM_ADMIN_PASSWORD to the deterministic "TestVM@$(date +%s)" AND echoed it verbatim to the build log; the `az vm create --admin-password` calls also ran under `set -x`, so the value was traced into the ADO log. Randomize the password, wrap the `az vm create` calls in `set +x`/`set -x`, and drop the password from the final echo (username only). No functional change to provisioning/build output beyond credential generation and log hygiene. Validated with bash -n on both scripts; the run-test ShellSpec (spec/vhdbuilder/packer/test/run_test_spec.sh) only exercises the cleanup function and retry loop, neither of which is touched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981

github-actions · 2026-10-15T07:10:25Z

Windows Unit Test Results

3 files 18 suites 1m 10s ⏱️
563 tests 563 ✅ 0 💤 0 ❌
585 runs 585 ✅ 0 💤 0 ❌

Results for commit 3b6a8aa.

♻️ This comment has been updated with latest results.

Copilot

🟡 Changes recommended

Windows VM creation still exposes the password through Azure CLI debug logging, and credential-log protections lack regression coverage.

2 open findings

What changed in this PR

Hardens temporary VM credentials in the VHD build and test pipeline.

Changes:

Replaces timestamp-based passwords with randomly generated values.
Disables shell tracing around test VM creation and removes passwords from the final status message.

File	Description
`vhdbuilder/packer/vhd-scanning.sh`	Randomizes the scan VM password.
`vhdbuilder/packer/test/run-test.sh`	Randomizes the test VM password and reduces credential logging.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

aks-node-assistant · 2026-10-15T10:56:51Z

AgentBaker Linux gate detective

Run: 185891864
Failed job/stage/task: e2e / Run AgentBaker E2E / LocalDNS/Ubuntu2604Minimal

Detective summary: LocalDNS cold-start validation failed after CoreDNS reported plugin/loop fatal while testing empty-hosts cold-start and hosts-file reload behavior.

Likely cause / signature: e2e-localdns-coldstart-empty-hosts-start-timeout.

Confidence: High: failed test record, E2E log, timeline, and prior cold-start row all isolate LocalDNS cold-start behavior.

Recommended owner/action: LocalDNS owner should inspect cold-start loop detection around testdomain456.com and hosts reload.

Strongest alternative: PR-specific behavior in 9791, but the signature already recurred across unrelated PRs.

Evidence: build run, failed test run 693091545, E2E task log 624, timeline, PR metadata, and wiki tracker.

Wiki: e2e-localdns-coldstart-empty-hosts-start-timeout

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: calvin197 <44663669+calvin197@users.noreply.github.com>

Copilot

🟡 Changes recommended

Both password-generation pipelines mask OpenSSL failures and allow execution to continue with predictable fixed passwords.

2 open issues

1 resolved since last review

Remove Azure CLI debug logging from password-bearing VM creation

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

The localized security changes preserve VM creation behavior, add regression coverage, and have no unresolved substantive findings.

2 open issues

_{Review effort: Balanced}

PR review caught that both password-generation pipelines (openssl rand -base64 24 | tr -dc 'A-Za-z0-9') run under 'set -e' without 'pipefail'. A pipeline's exit status is that of its last command, so a silent openssl failure would go undetected (tr succeeds on empty stdin), leaving the script to continue with a fixed, publicly-visible password ('ScanVM@' / 'TestVM@' with no random suffix) instead of aborting. Switch to openssl rand -hex 24, which needs no tr filtering (hex output is already alphanumeric), removing the pipe entirely so 'set -e' correctly aborts on an openssl failure. Verified empirically: a failing openssl now aborts the script (exit 1) instead of silently continuing. Also updates the ShellSpec test's openssl mock/assertions to match the new unfiltered-hex-output behavior (no more tr-induced character stripping). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981

github-actions · 2026-10-22T04:32:06Z

Package	Line Rate	Health
parts_windows Package 1	73%	➖
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
test	0%	❌
windows	27%	❌
Summary	38% (1652 / 6834)	❌

github-actions · 2026-10-22T04:32:40Z

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	72%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	0%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	75% (5873 / 7861)	➖

Copilot

🟢 Approval recommended

The focused changes address the prior security and coverage concerns without any identified blocking regression.

2 open issues

_{Review effort: Balanced}

github-actions · 2026-10-22T04:34:04Z

Package	Line Rate	Health
shellspec spec	28%	❌
Summary	28% (4556 / 15975)	❌

Calvin S. (calvin197) requested review from a team as code owners October 15, 2026 07:07

Copilot AI balanced review requested due to automatic review settings October 15, 2026 07:07

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Comment thread vhdbuilder/packer/test/run-test.sh Outdated

Comment thread vhdbuilder/packer/test/run-test.sh

Copilot started reviewing on behalf of Calvin S. (calvin197) October 15, 2026 07:38

View session

Remove debug flag from VM creation command

5a15a21

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 22, 2026 03:14

Copilot started reviewing on behalf of Calvin S. (calvin197) October 22, 2026 03:14

View session

Copilot started work on behalf of Calvin S. (calvin197) October 22, 2026 03:15

View session

test: add ShellSpec coverage for test VM credential log hygiene

bfc9bb8

Co-authored-by: calvin197 <44663669+calvin197@users.noreply.github.com>

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread vhdbuilder/packer/test/run-test.sh Outdated

Copilot AI balanced review requested due to automatic review settings October 22, 2026 03:19

Copilot started reviewing on behalf of Calvin S. (calvin197) October 22, 2026 03:19

View session

Copilot finished work on behalf of Calvin S. (calvin197) October 22, 2026 03:19

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Copilot started work on behalf of Calvin S. (calvin197) October 22, 2026 03:22

View session

Copilot finished work on behalf of Calvin S. (calvin197) October 22, 2026 03:24

Copilot AI balanced review requested due to automatic review settings October 22, 2026 04:29

Copilot started reviewing on behalf of Calvin S. (calvin197) October 22, 2026 04:29

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Copilot started work on behalf of Calvin S. (calvin197) October 22, 2026 04:33

View session

Copilot finished work on behalf of Calvin S. (calvin197) October 22, 2026 04:36

Cameron Meissner (cameronmeissner) approved these changes Oct 22, 2026

View reviewed changes

Cameron Meissner (cameronmeissner) merged commit 79970d9 into main Oct 22, 2026
49 checks passed

Cameron Meissner (cameronmeissner) deleted the security/packer-vm-credential-hygiene branch October 22, 2026 23:04

Navigation Menu

Repository navigation

fix(security): use random build/test VM passwords and keep them out o… - #9791

fix(security): use random build/test VM passwords and keep them out o…#9791
Cameron Meissner (cameronmeissner) merged 4 commits into
mainfrom
security/packer-vm-credential-hygiene

Calvin S. (calvin197) commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

aks-node-assistant Bot commented Oct 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Calvin S. (calvin197) commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

aks-node-assistant Bot commented Oct 15, 2026

AgentBaker Linux gate detective

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Oct 15, 2026 •

edited

Loading