fix: use cloud-specific ARM endpoint for IMDS token in ORAS login by charleswool · Pull Request #8424 · Azure/AgentBaker

charleswool · 2026-04-29T00:48:39Z

The oras_login_with_kubelet_identity (Linux) and Invoke-OrasLogin (Windows) functions hardcoded https://management.azure.com/ as the ARM resource endpoint in the IMDS token request URL. This causes authentication failures in sovereign clouds (e.g. Fairfax) where the correct endpoint differs.

Added get_arm_resource_endpoint / Get-ArmResourceEndpoint helpers that resolve the ARM endpoint from the cloud environment variable (TARGET_CLOUD on Linux, $TargetEnvironment on Windows):

AzureUSGovernmentCloud -> https://management.usgovcloudapi.net/
AzureChinaCloud -> https://management.chinacloudapi.cn/
default (public) -> https://management.azure.com/

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Copilot

Pull request overview

Updates the ORAS managed-identity login flow on Linux and Windows to use a cloud-specific ARM resource endpoint (instead of hardcoding https://management.azure.com/), preventing auth failures in sovereign clouds.

Changes:

Added a Go helper (datamodel.GetArmResourceEndpoint) with tests to map cloud name → ARM resource endpoint.
Exposed GetArmResourceEndpoint into the template func map and injected it into Linux CSE env (ARM_RESOURCE_ENDPOINT) and Windows custom data ($ArmResourceEndpoint).
Updated ORAS login token acquisition URLs (Linux oras_login_with_kubelet_identity, Windows Invoke-OrasLogin) to use the injected endpoint.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`staging/cse/windows/networkisolatedclusterfunc.ps1`	Uses `$ArmResourceEndpoint` in the IMDS token request for ORAS login.
`parts/windows/kuberneteswindowssetup.ps1`	Injects `$ArmResourceEndpoint` into Windows custom data from the Go template func map.
`parts/linux/cloud-init/artifacts/cse_cmd.sh`	Adds `ARM_RESOURCE_ENDPOINT` to the Linux CSE command environment.
`parts/linux/cloud-init/artifacts/cse_helpers.sh`	Uses `ARM_RESOURCE_ENDPOINT` in ORAS IMDS token request URL.
`pkg/agent/baker.go`	Adds `GetArmResourceEndpoint` to the template function map (including custom cloud override).
`pkg/agent/datamodel/sig_config.go` / `pkg/agent/datamodel/sig_config_test.go`	Implements and tests cloud→ARM endpoint mapping.

The oras_login_with_kubelet_identity (Linux) and Invoke-OrasLogin (Windows) functions hardcoded https://management.azure.com/ as the ARM resource endpoint in the IMDS token request URL. This causes authentication failures in sovereign clouds (e.g. Fairfax) where the correct endpoint differs. Added get_arm_resource_endpoint / Get-ArmResourceEndpoint helpers that resolve the ARM endpoint from the cloud environment variable (TARGET_CLOUD on Linux, $TargetEnvironment on Windows): - AzureUSGovernmentCloud -> https://management.usgovcloudapi.net/ - AzureChinaCloud -> https://management.chinacloudapi.cn/ - USNatCloud -> https://management.azure.eaglex.ic.gov/ - USSecCloud -> https://management.azure.microsoft.scloud/ - default (public) -> https://management.azure.com/

…oints Agent-Logs-Url: https://github.com/Azure/AgentBaker/sessions/d463ecda-08d8-4e26-8616-e577a3e40391 Co-authored-by: charleswool <65653735+charleswool@users.noreply.github.com>

…etContainerServiceFuncMap Agent-Logs-Url: https://github.com/Azure/AgentBaker/sessions/65f0b28e-1864-49bd-87e6-6c4e93668fb2 Co-authored-by: charleswool <65653735+charleswool@users.noreply.github.com>

@cameronmeissner

Address @cameronmeissner's review comment: aks-node-controller's getCSEEnv must also expose ARM_RESOURCE_ENDPOINT so the new sovereign- cloud aware oras_login_with_kubelet_identity logic works under the scriptless-NBC / aks-node-controller deployment mode as well. - Export getArmResourceEndpoint -> GetARMResourceEndpoint in pkg/agent so it can be reused by aks-node-controller/parser. - Add ARM_RESOURCE_ENDPOINT env var in aks-node-controller parser, delegating to GetARMResourceEndpoint and parsing CustomEnvJsonContent.resourceManagerEndpoint for AKS custom clouds. - Add unit tests covering all branches and assert the env var in parser_test for both China and default-cloud cases.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

+			}
+		}
+	}
+	return agent.GetARMResourceEndpoint(getCloudTargetEnv(v))


+    $armEndpoint = if ([string]::IsNullOrWhiteSpace($ArmResourceEndpoint)) { "https://management.azure.com/" } else { $ArmResourceEndpoint }
+    $accessUrl = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${armEndpoint}&client_id=$ClientID"


+    local arm_endpoint="${ARM_RESOURCE_ENDPOINT:-https://management.azure.com/}"
+    access_url="http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${arm_endpoint}&client_id=$client_id"


+	It("returns USNat endpoint for USNatCloud", func() {
+		Expect(GetARMResourceEndpoint(datamodel.USNatCloud)).To(Equal("https://management.azure.eaglex.ic.gov/"))
+	})
+	It("returns USSec endpoint for USSecCloud", func() {
+		Expect(GetARMResourceEndpoint(datamodel.USSecCloud)).To(Equal("https://management.azure.microsoft.scloud/"))


+func Test_getArmResourceEndpoint(t *testing.T) {
+	tests := []struct {
+		name string
+		v    *aksnodeconfigv1.Configuration
+		want string
+	}{
+		{
+			name: "Nil config returns public endpoint",
+			v:    &aksnodeconfigv1.Configuration{},
+			want: "https://management.azure.com/",
+		},
+		{
+			name: "China cloud by location",
+			v: &aksnodeconfigv1.Configuration{
+				ClusterConfig: &aksnodeconfigv1.ClusterConfig{Location: "chinaeast2"},
+			},
+			want: "https://management.chinacloudapi.cn/",
+		},
+		{
+			name: "US Gov by location",
+			v: &aksnodeconfigv1.Configuration{
+				ClusterConfig: &aksnodeconfigv1.ClusterConfig{Location: "usgovvirginia"},
+			},
+			want: "https://management.usgovcloudapi.net/",
+		},
+		{
+			name: "German cloud by location",
+			v: &aksnodeconfigv1.Configuration{
+				ClusterConfig: &aksnodeconfigv1.ClusterConfig{Location: "germanynortheast"},
+			},
+			want: "https://management.microsoftazure.de/",
+		},
+		{
+			name: "AKS custom cloud with resourceManagerEndpoint in CustomEnvJsonContent",
+			v: &aksnodeconfigv1.Configuration{
+				CustomCloudConfig: &aksnodeconfigv1.CustomCloudConfig{
+					CustomCloudEnvName:   helpers.AksCustomCloudName,
+					CustomEnvJsonContent: `{"resourceManagerEndpoint":"https://management.azure.microsoft.fakecustomcloud/"}`,
+				},
+			},
+			want: "https://management.azure.microsoft.fakecustomcloud/",
+		},
+		{
+			name: "AKS custom cloud with empty CustomEnvJsonContent falls back to public",
+			v: &aksnodeconfigv1.Configuration{
+				CustomCloudConfig: &aksnodeconfigv1.CustomCloudConfig{
+					CustomCloudEnvName: helpers.AksCustomCloudName,
+				},
+			},
+			want: "https://management.azure.com/",
+		},
+		{
+			name: "AKS custom cloud with malformed JSON falls back to public",
+			v: &aksnodeconfigv1.Configuration{
+				CustomCloudConfig: &aksnodeconfigv1.CustomCloudConfig{
+					CustomCloudEnvName:   helpers.AksCustomCloudName,
+					CustomEnvJsonContent: `{not-json`,
+				},
+			},
+			want: "https://management.azure.com/",
+		},
+	}


cameronmeissner

would shouldn't hardcode resource manager endpoints

@cameronmeissner

…ove hardcoded sovereign endpoints Per @cameronmeissner's review: - Hardcoding USNat/USSec ARM endpoints (eaglex.ic.gov, microsoft.scloud) in this OSS repo is not allowed. - cs.Properties.CustomCloudEnv.ResourceManagerEndpoint is always populated by AKS RP (typeconversion.go), so the cloud-name-based fallback mapping is unnecessary. - Drop GetARMResourceEndpoint(cloudName) helper from pkg/agent/baker.go. - GetArmResourceEndpoint template func now returns cs.Properties.CustomCloudEnv.ResourceManagerEndpoint directly. - aks-node-controller getArmResourceEndpoint now sources the value solely from CustomEnvJsonContent.resourceManagerEndpoint (RP-populated). When absent, returns empty; cse_helpers.sh fallback to public ARM is unchanged. - Update unit tests accordingly.

Per review feedback: CustomCloudEnv.ResourceManagerEndpoint is only populated by RP for AKS custom clouds (Azure Stack), not for the public sovereign clouds Fairfax (USGov) and Mooncake (China). Map those two explicitly by cloud name; their endpoints are public knowledge. Public Azure cloud still falls through to empty so that scripts keep defaulting to https://management.azure.com/.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

+		}
+		var env struct {
+			ResourceManagerEndpoint string `json:"resourceManagerEndpoint"`
+		}


+			v: &aksnodeconfigv1.Configuration{
+				CustomCloudConfig: &aksnodeconfigv1.CustomCloudConfig{
+					CustomCloudEnvName:   helpers.AksCustomCloudName,
+					CustomEnvJsonContent: `{"resourceManagerEndpoint":"https://management.azure.microsoft.fakecustomcloud/"}`,
+				},


+		want string
+	}{
+		{
+			name: "Nil config returns empty (public cloud default)",


Per review nit: explicitly return https://management.azure.com/ as the final fallback in both pkg/agent/baker.go GetArmResourceEndpoint and aks-node-controller/parser/helper.go getArmResourceEndpoint, instead of relying on script-side defaults.

Copilot AI review requested due to automatic review settings April 29, 2026 00:48

charleswool requested review from AbelHu, Devinwong, SriHarsha001, awesomenix, calvin197, cameronmeissner, djsly, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright and zachary-bailey as code owners April 29, 2026 00:48

charleswool temporarily deployed to test April 29, 2026 00:48 — with GitHub Actions Inactive

Copilot started reviewing on behalf of charleswool April 29, 2026 00:49 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

Comment thread pkg/agent/baker.go

Comment thread pkg/agent/datamodel/sig_config_test.go Outdated

Comment thread staging/cse/windows/networkisolatedclusterfunc.ps1 Outdated

Comment thread parts/linux/cloud-init/artifacts/cse_helpers.sh Outdated

charleswool force-pushed the yuewu2/ni-cloud-fix branch from 9692840 to 1776e6f Compare April 29, 2026 01:02

charleswool temporarily deployed to test April 29, 2026 01:02 — with GitHub Actions Inactive

fseldow reviewed Apr 29, 2026

View reviewed changes

Comment thread pkg/agent/datamodel/sig_config.go Outdated

fseldow reviewed Apr 29, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/cse_helpers.sh Outdated

charleswool changed the title ~~fix: [NI]use cloud-specific ARM endpoint for IMDS token in ORAS login~~ fix: use cloud-specific ARM endpoint for IMDS token in ORAS login Apr 29, 2026

Copilot AI review requested due to automatic review settings April 29, 2026 03:34

charleswool force-pushed the yuewu2/ni-cloud-fix branch from 1776e6f to 63df433 Compare April 29, 2026 03:34

charleswool temporarily deployed to test April 29, 2026 03:34 — with GitHub Actions Inactive

charleswool force-pushed the yuewu2/ni-cloud-fix branch from d95baf3 to ccc6244 Compare May 1, 2026 11:47

charleswool temporarily deployed to test May 1, 2026 11:47 — with GitHub Actions Inactive

Ubuntu and others added 4 commits May 4, 2026 05:23

fix: add AzureGermanCloud, AzureGermanyCloud, AzureBleuCloud ARM endp…

8aa5d89

…oints Agent-Logs-Url: https://github.com/Azure/AgentBaker/sessions/d463ecda-08d8-4e26-8616-e577a3e40391 Co-authored-by: charleswool <65653735+charleswool@users.noreply.github.com>

fix: remove redundant comment and move getArmResourceEndpoint after g…

37bef60

…etContainerServiceFuncMap Agent-Logs-Url: https://github.com/Azure/AgentBaker/sessions/65f0b28e-1864-49bd-87e6-6c4e93668fb2 Co-authored-by: charleswool <65653735+charleswool@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 4, 2026 05:30

charleswool force-pushed the yuewu2/ni-cloud-fix branch from ccc6244 to bbc7907 Compare May 4, 2026 05:30

charleswool temporarily deployed to test May 4, 2026 05:30 — with GitHub Actions Inactive

Copilot started reviewing on behalf of charleswool May 4, 2026 05:30 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

cameronmeissner requested changes May 7, 2026

View reviewed changes

cameronmeissner reviewed May 7, 2026

View reviewed changes

Comment thread pkg/agent/baker.go Outdated

charleswool temporarily deployed to test May 7, 2026 23:30 — with GitHub Actions Inactive

cameronmeissner reviewed May 7, 2026

View reviewed changes

Comment thread pkg/agent/baker.go

Copilot AI review requested due to automatic review settings May 8, 2026 02:46

charleswool temporarily deployed to test May 8, 2026 02:46 — with GitHub Actions Inactive

Copilot started reviewing on behalf of charleswool May 8, 2026 02:47 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

cameronmeissner reviewed May 8, 2026

View reviewed changes

Comment thread aks-node-controller/parser/helper.go

cameronmeissner reviewed May 8, 2026

View reviewed changes

Comment thread pkg/agent/baker.go

cameronmeissner approved these changes May 8, 2026

View reviewed changes

charleswool temporarily deployed to test May 8, 2026 03:03 — with GitHub Actions Inactive

fseldow approved these changes May 8, 2026

View reviewed changes

cameronmeissner approved these changes May 8, 2026

View reviewed changes

cameronmeissner merged commit 6bb3dc3 into main May 8, 2026
40 of 42 checks passed

cameronmeissner deleted the yuewu2/ni-cloud-fix branch May 8, 2026 15:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use cloud-specific ARM endpoint for IMDS token in ORAS login#8424

fix: use cloud-specific ARM endpoint for IMDS token in ORAS login#8424
cameronmeissner merged 7 commits into
mainfrom
yuewu2/ni-cloud-fix

charleswool commented Apr 29, 2026 •

edited by cameronmeissner

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

cameronmeissner left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

		$armEndpoint = if ([string]::IsNullOrWhiteSpace($ArmResourceEndpoint)) { "https://management.azure.com/" } else { $ArmResourceEndpoint }
		$accessUrl = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${armEndpoint}&client_id=$ClientID"

		local arm_endpoint="${ARM_RESOURCE_ENDPOINT:-https://management.azure.com/}"
		access_url="http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${arm_endpoint}&client_id=$client_id"

Conversation

charleswool commented Apr 29, 2026 • edited by cameronmeissner Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cameronmeissner left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

charleswool commented Apr 29, 2026 •

edited by cameronmeissner

Loading

cameronmeissner left a comment •

edited

Loading