feat: install aznfs package on AzureLinux 3.0 by andyzhangx · Pull Request #8085 · Azure/AgentBaker

andyzhangx · 2026-03-12T14:20:58Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
feat: install aznfs package on AzureLinux 3.0

Install the aznfs NFS mount helper on AzureLinux 3.0 VHDs. The aznfs RPM is
downloaded directly from PMC at VHD build time (via components.json) and
stored in /opt/aznfs/downloads. During node provisioning, installAznfsPkgFromPMC
installs the pre-downloaded RPM locally with dnf_install, avoiding the need to
add the rhel9 PMC repo to the RPM database (which could cause versioning
conflicts with AzureLinux packages).

Additional configuration:

Disable aznfs auto-upgrade (AUTOUPDATE=false) to respect operator OS update settings and AKS SDP
Disable the legacy aznfswatchdog service (only aznfswatchdogv4 is needed)
Import the Microsoft RPM GPG key into the RPM database
Use sort -V to deterministically select the newest RPM when multiple versions exist

there is no azl3 package due to GNU TLS dependency, this is only the way to install aznfs package on AzureLinux3, check here: https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares?tabs=azure-portal%2CAzureLinux

Which issue(s) this PR fixes:
Fixes #

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
tested upgrade from previous version
commits are GPG signed and Github marks them as verified

Special notes for your reviewer:

Release note:

none

Copilot

Pull request overview

Adds Azure Linux 3.0 support in the VHD build pipeline to install the aznfs NFS client package from packages.microsoft.com (PMC) by downloading and installing the Microsoft repo RPM, then installing aznfs. This fits into AgentBaker’s VHD builder + shared Linux provisioning script set by ensuring the dependency is present on Azure Linux 3.0 images.

Changes:

Invoke installAznfsPkgFromPMC during Mariner/AzureLinux VHD dependency installation.
Add installAznfsPkgFromPMC implementation to the Mariner/AzureLinux install script.
Regenerate/refresh multiple pkg/agent/testdata/**/CustomData snapshots.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vhdbuilder/packer/install-dependencies.sh	Calls `installAznfsPkgFromPMC` during Mariner/AzureLinux (non-OSGuard) VHD build setup.
parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh	Introduces `installAznfsPkgFromPMC` to download/install Microsoft repo RPM and install `aznfs` on Azure Linux 3.0.
pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=true/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=false/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/MarinerV2+Kata/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/MarinerV2+CustomCloud/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/MarinerV2+CustomCloud+USSec/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/MarinerV2+CustomCloud+USNat/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=true/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=false/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/AzureLinuxV3+Kata/CustomData	Updated generated CustomData snapshot.
pkg/agent/testdata/AzureLinuxV2+Kata/CustomData	Updated generated CustomData snapshot.

You can also share your feedback on Copilot code review. Take the survey.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

…or handling - Use dnf_install instead of rpm -i (rpm command won't work per andyzhangx's comment) - Use basename to derive RPM filename from URL instead of hardcoding - Use systemctl is-enabled/is-active checks with best-effort disable/stop to avoid breaking VHD build under set -e - Properly quote evalPackageDownloadURL argument

The schema does not allow ubuntu.default or flatcar.current for packages that don't support those OSes. Simply omitting the OS key is the correct way to indicate no support, matching the pattern used by other packages like oras and walinuxagent.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

- Use $(uname -m) in download URL to support both x86_64 and aarch64 - Move installAznfsPkgFromPMC call after the component download loop so the pre-downloaded RPM is available when the function runs

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

- Remove defensive guards around aznfswatchdog disable/stop - let it fail the build if something is wrong - Remove aznfswatchdogv4 restart check (no longer needed) - Add Microsoft RPM GPG key import into RPM database

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Address review comment: use version sort instead of arbitrary head -1 to ensure the newest RPM is installed when multiple versions exist in /opt/aznfs/downloads.

djsly · 2026-04-17T13:41:59Z

+            ]
+          }
+        },
+        "mariner": {


we dont build mariner anymore. not needed

Good point, removed the mariner section from components.json.

djsly · 2026-04-17T13:43:43Z

+  systemctl stop aznfswatchdog
+
+  echo "Importing Microsoft RPM GPG key into RPM database"
+  gpg --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Microsoft || echo "Warning: failed to import Microsoft RPM GPG key"


why do we need this ?

see #8085 (comment), without this, there would be cert issue when dnf install other packages.

djsly · 2026-04-17T13:44:10Z

    installRPMPackageFromFile "kubectl" $desiredVersion || exit $ERR_KUBECTL_INSTALL_FAIL
 }

+installAznfsPkgFromPMC() {


what is this package for ? how come it doesnt live in azl3 repo ?

there is no azl3 package due to GNU TLS dependency, this is only the way to install aznfs package on AzureLinux3, check here: https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares?tabs=azure-portal%2CAzureLinux

djsly · 2026-04-17T13:47:11Z

    "acr-mirror")
      # acr-mirror is handled separately below via installAndConfigureArtifactStreaming.
      ;;
+    "aznfs")


we should only perform the installAznfsPkgFromPMC in here, and combien the download in the function, no. need to decouple the downlaod and later do the install. if we want to always install it.

Done — added installAznfsPkgFromPMC call in install-dependencies.sh after the download, so it's combined during VHD build. Also added a fallback download path in the function for cases where the RPM isn't pre-downloaded.

djsly · 2026-04-17T13:47:47Z

+            "versionsV2": [
+              {
+                "renovateTag": "<DO_NOT_UPDATE>",
+                "latestVersion": "3.0.15-1"


why arent we looking at tracking the versions with renovate ? when would this need to change ?

The aznfs package is from PMC (packages.microsoft.com) not the AzureLinux repo, so renovate can't track it. The version is pinned with <DO_NOT_UPDATE> tag and we'd bump it manually when a new version is available. We could add a custom renovate datasource later if this becomes a maintenance burden.

renovate support PMC, or I mean we could easily add support for the locaiton of this package

I'm just scared at one point we will loose track of the manual bump

let's do it manually now since we need to verify the version before auto version bump. we need to make sure the version AB used is stable and won't break first. @djsly

- Remove mariner section from components.json (mariner no longer built) - Combine download+install in installAznfsPkgFromPMC with fallback download - Call installAznfsPkgFromPMC from install-dependencies.sh during VHD build

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

vhdbuilder/packer/install-dependencies.sh:547

installAznfsPkgFromPMC is invoked twice for AzureLinux/Mariner builds: once inside the "aznfs" case and again unconditionally after the packages loop. On Azure Linux 3.0 this results in a redundant second install/config run, which adds build time and can introduce non-idempotent side effects. Please keep a single well-scoped call (either inside the aznfs case, or gated after the loop based on whether aznfs was downloaded).

      installAznfsPkgFromPMC
      ;;
    *)
      echo "Package name: ${name} not supported for download. Please implement the download logic in the script."
      # We can add a common function to download a generic package here.
      # However, installation could be different for different packages.
      ;;
  esac
  capture_benchmark "${SCRIPT_NAME}_download_${name}"
done <<< "$packages"

installAndConfigureArtifactStreaming() {
  local downloadURL="$1"
  local version="$2"
  # The arm64 packages have "-arm64" inserted before the file extension,

andyzhangx requested review from AbelHu, Devinwong, YaoC, awesomenix, calvin197, cameronmeissner, djsly, ganeshkumarashok, juan-lee, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright, yewmsft and zachary-bailey as code owners March 12, 2026 14:21

Copilot AI review requested due to automatic review settings March 12, 2026 14:21

andyzhangx temporarily deployed to test March 12, 2026 14:21 — with GitHub Actions Inactive

Copilot started reviewing on behalf of andyzhangx March 12, 2026 14:21 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh Outdated

andyzhangx force-pushed the andyzhangx/install-aznfs-linux3-2 branch from 647ac4d to 6e493f1 Compare March 12, 2026 14:56

andyzhangx temporarily deployed to test March 12, 2026 14:57 — with GitHub Actions Inactive

surajssd reviewed Mar 12, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

andyzhangx force-pushed the andyzhangx/install-aznfs-linux3-2 branch from 6e493f1 to 0b36d79 Compare March 13, 2026 02:07

Copilot AI review requested due to automatic review settings March 13, 2026 02:07

andyzhangx temporarily deployed to test March 13, 2026 02:07 — with GitHub Actions Inactive

Copilot started reviewing on behalf of andyzhangx March 28, 2026 01:20 View session

andyzhangx had a problem deploying to test March 28, 2026 01:20 — with GitHub Actions Failure

Copilot AI reviewed Mar 28, 2026

View reviewed changes

Comment thread vhdbuilder/packer/install-dependencies.sh Outdated

Comment thread parts/common/components.json Outdated

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh Outdated

andyzhangx had a problem deploying to test March 28, 2026 01:53 — with GitHub Actions Failure

Copilot AI review requested due to automatic review settings March 28, 2026 02:05

andyzhangx temporarily deployed to test March 28, 2026 02:05 — with GitHub Actions Inactive

Copilot started reviewing on behalf of andyzhangx March 28, 2026 02:09 View session

Copilot AI reviewed Mar 28, 2026

View reviewed changes

Comment thread vhdbuilder/packer/install-dependencies.sh

fix: use arch-aware RPM URL and move aznfs install after download loop

bbe5248

- Use $(uname -m) in download URL to support both x86_64 and aarch64 - Move installAznfsPkgFromPMC call after the component download loop so the pre-downloaded RPM is available when the function runs

andyzhangx temporarily deployed to test April 10, 2026 06:20 — with GitHub Actions Inactive

andyzhangx requested a review from Copilot April 10, 2026 07:10

Copilot started reviewing on behalf of andyzhangx April 10, 2026 07:11 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

Comment thread vhdbuilder/packer/install-dependencies.sh Outdated

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

fix: simplify aznfswatchdog disable and import Microsoft RPM GPG key

a38dcdc

- Remove defensive guards around aznfswatchdog disable/stop - let it fail the build if something is wrong - Remove aznfswatchdogv4 restart check (no longer needed) - Add Microsoft RPM GPG key import into RPM database

andyzhangx temporarily deployed to test April 10, 2026 11:44 — with GitHub Actions Inactive

andyzhangx requested a review from Copilot April 10, 2026 12:51

Copilot started reviewing on behalf of andyzhangx April 10, 2026 12:55 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

Comment thread parts/common/components.json

Comment thread parts/common/components.json

use sort -V to deterministically pick newest aznfs RPM

24add77

Address review comment: use version sort instead of arbitrary head -1 to ensure the newest RPM is installed when multiple versions exist in /opt/aznfs/downloads.

andyzhangx temporarily deployed to test April 10, 2026 13:29 — with GitHub Actions Inactive

djsly reviewed Apr 17, 2026

View reviewed changes

fix: address review comments from djsly

765e71f

- Remove mariner section from components.json (mariner no longer built) - Combine download+install in installAznfsPkgFromPMC with fallback download - Call installAznfsPkgFromPMC from install-dependencies.sh during VHD build

Copilot AI review requested due to automatic review settings April 17, 2026 13:56

andyzhangx temporarily deployed to test April 17, 2026 13:56 — with GitHub Actions Inactive

Copilot started reviewing on behalf of andyzhangx April 17, 2026 13:56 View session

fix: remove duplicate installAznfsPkgFromPMC call after download loop

a33bcb4

andyzhangx temporarily deployed to test April 17, 2026 13:58 — with GitHub Actions Inactive

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

Comment thread parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

Conversation

andyzhangx commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

andyzhangx commented Mar 12, 2026 •

edited

Loading