Azure / Azure/azure-init

[RFC] Azure Admin User Creation Proposal

Open
#273 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
16
Forks
20
Avg merge
2d 14h
Merged PRs (30d)
1

Description

## Summary
Currently, Flatcar uses WALinuxAgent to create the Azure admin account specified in Azure VM configuration. The WALinuxAgent component responsible for this has been deprecated in favor of azure-init. To maintain compatibility and user expectations going forward, this functionality can be migrated to either Ignition, Afterburn, and/or Azure-init.

User creation involves:
- Creating admin user (if specified)
- Setting SSH keys (if supplied)
- Setting the password (if supplied)

Additionally, WALinuxAgent configures SSHd’s `PasswordAuthentication=[no|yes]` based on `disable_password_authentication` option.

### Option 1: Ignition

Ignition-fetch.service fetches user data from IMDS and mounts Azure’s provisioning media. This option will add the capability for ignition to fetch Azure configuration related to the Azure admin account and add/merge it into ignition config.

For example, an empty ignition config in user data would result in something like:
```
{
"ignition": {
"version": "3.4.0"
},
"passwd": {
"users": [
{
"name": "azureuser",
"passwordHash": "$6$...",
"sshAuthorizedKeys": [
"ssh-ed25519 AAAA...B"
],
"groups": [
"sudo",
"wheel"
],
"homeDir": "/home/azureuser"
}
]
},
"storage": {
"files": [
{
"path": "/etc/ssh/sshd_config.d/10-password-auth.conf",
"mode": 420,
"contents": {
"source": "data:,PasswordAuthentication%20yes"
}
}
]
}
}
```
...When the user specifies the following Azure configuration:

```
'osProfile': {'computerName': 'vm-a083', 'adminUsername': 'azureuser', 'adminPassword': 'mypassword', 'linuxConfiguration': {'disablePasswordAuthentication': False, 'ssh': {'publicKeys': [{'path': '/home/azureuser/.ssh/authorized_keys', 'keyData': 'ssh-ed25519 AAAA...B\n'}]}}
```

### Option 2: Afterburn

Add the following features, which would only be done on the Microsoft Azure cloud:
- User creation
- Password handling (if specified)
- SSHD config password fragment to allow password-login

### Option 3: Azure-init
Create a new systemd service file that runs azure-init with command-line option to limit scope of actions, e.g.:
```
azure-init --create-user
--configure-user-password
--configure-user-ssh-keys
--configure-sshd-password-authentication
```

Contributor guide

Open the contributing guide

Research direction

Start by comparing the three proposed owners—Ignition, Afterburn, and azure-init—and the existing WALinuxAgent behavior described in the issue. No files or tests are named; progress requires selecting an approach and defining how admin-user creation, SSH keys, passwords, and SSHD password authentication should be handled, with completion criteria agreed before implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, rust
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.