[RFC] Azure Admin User Creation Proposal
- Dominant language
- Rust
- Stars
- 16
- Forks
- 20
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 1
Description
## Summary
Currently, Flatcar uses WALinuxAgent to create the Azure admin account specified in Azure VM configuration. The WALinuxAgent component responsible for this has been deprecated in favor of azure-init. To maintain compatibility and user expectations going forward, this functionality can be migrated to either Ignition, Afterburn, and/or Azure-init.
User creation involves:
- Creating admin user (if specified)
- Setting SSH keys (if supplied)
- Setting the password (if supplied)
Additionally, WALinuxAgent configures SSHd’s `PasswordAuthentication=[no|yes]` based on `disable_password_authentication` option.
### Option 1: Ignition
Ignition-fetch.service fetches user data from IMDS and mounts Azure’s provisioning media. This option will add the capability for ignition to fetch Azure configuration related to the Azure admin account and add/merge it into ignition config.
For example, an empty ignition config in user data would result in something like:
```
{
"ignition": {
"version": "3.4.0"
},
"passwd": {
"users": [
{
"name": "azureuser",
"passwordHash": "$6$...",
"sshAuthorizedKeys": [
"ssh-ed25519 AAAA...B"
],
"groups": [
"sudo",
"wheel"
],
"homeDir": "/home/azureuser"
}
]
},
"storage": {
"files": [
{
"path": "/etc/ssh/sshd_config.d/10-password-auth.conf",
"mode": 420,
"contents": {
"source": "data:,PasswordAuthentication%20yes"
}
}
]
}
}
```
...When the user specifies the following Azure configuration:
```
'osProfile': {'computerName': 'vm-a083', 'adminUsername': 'azureuser', 'adminPassword': 'mypassword', 'linuxConfiguration': {'disablePasswordAuthentication': False, 'ssh': {'publicKeys': [{'path': '/home/azureuser/.ssh/authorized_keys', 'keyData': 'ssh-ed25519 AAAA...B\n'}]}}
```
### Option 2: Afterburn
Add the following features, which would only be done on the Microsoft Azure cloud:
- User creation
- Password handling (if specified)
- SSHD config password fragment to allow password-login
### Option 3: Azure-init
Create a new systemd service file that runs azure-init with command-line option to limit scope of actions, e.g.:
```
azure-init --create-user
--configure-user-password
--configure-user-ssh-keys
--configure-sshd-password-authentication
```
Contributor guide
Research direction
Start by comparing the three proposed owners—Ignition, Afterburn, and azure-init—and the existing WALinuxAgent behavior described in the issue. No files or tests are named; progress requires selecting an approach and defining how admin-user creation, SSH keys, passwords, and SSHD password authentication should be handled, with completion criteria agreed before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, rust
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100