[SRU] azure-proxy-agent: fix service file ordering to avoid cycle with cloud-init

[Miriam España Acebal]

[ SRU ]
[ Impact ]

The current azure-proxy-agent.service unit file in Ubuntu contains ordering directives that can cause dependency cycles during early boot when combined with cloud-init.service. This leads to boot instability and prevents successful verification in Azure VMs.

This fix adjusts the service definition to:

- Start the agent only after local filesystems are ready, ensuring logs/config paths are accessible.
- Run before networking is configured (Before=network-pre.target) so the agent is present when Azure expects it.
- Avoid pulling in network targets by itself (removing Wants=network-pre.target) to prevent conflicts with cloud-init.
- Add clean shutdown handling (Before=shutdown.target, Conflicts=shutdown.target).

Together, these changes eliminate the ordering cycle and ensure both the Azure agent and cloud-init run reliably.

[ Test Plan ]

 * As described in this SRU exception: https://documentation.ubuntu.com/sru/en/latest/reference/exception-Azure-Proxy-Agent-Updates. The agent will be installed on a live image (before first boot) and CPC will run their test suites on Azure to verify that the VM behaves as expected and that no regression is introduced.

 * The Microsoft team responsible for this agent will also use their own tests to verify the new version.

* In addition, we conduct the following specific checks for this fix:
    Build and install the updated azure-proxy-agent package.

    Launch an Azure VM using a custom image with the updated package.

    Verify:

      - The VM boots cleanly.
      - The VM is fully reachable via SSH.
      - The azure-proxy-agent.service starts successfully before networking.
      - cloud-init.service completes as expected.

    Successful boot and SSH accessibility demonstrate that the cycle is resolved and normal provisioning is restored.

[ Where problems could occur ]

There is a low risk of regressions as changes only affect the unit file ordering and shutdown behavior:

If misordered, the agent may start too early/late, which would show up immediately in boot logs.

[ Original Description ]
# Impact

The current azure-proxy-agent.service unit file in Ubuntu contains ordering directives that can cause dependency cycles during early boot when combined with cloud-init.service. This leads to boot instability and prevents successful verification in Azure VMs.

This fix adjusts the service definition to:

- Start the agent only after local filesystems are ready, ensuring logs/config paths are accessible.
- Run before networking is configured (Before=network-pre.target) so the agent is present when Azure expects it.
- Avoid pulling in network targets by itself (removing Wants=network-pre.target) to prevent conflicts with cloud-init.
- Add clean shutdown handling (Before=shutdown.target, Conflicts=shutdown.target).

Together, these changes eliminate the ordering cycle and ensure both the Azure agent and cloud-init run reliably.

# Test Case

Build and install the updated azure-proxy-agent package.

Launch an Azure VM using a custom image with the updated package.

Verify:

- The VM boots cleanly.
- The VM is fully reachable via SSH.
- The azure-proxy-agent.service starts successfully before networking.
- cloud-init.service completes as expected.

Successful boot and SSH accessibility demonstrate that the cycle is resolved and normal provisioning is restored.

# Regression Potential

Low. The changes only affect the unit file ordering and shutdown behavior:

If misordered, the agent may start too early/late, which would show up immediately in boot logs.

The updated ordering has been validated in Azure VMs and matches the intended design of network-pre.target and cloud-init:

❯ az vm create --resource-group miriam-azure-proxy --name t-m-questing-amd64-server-systemd --image "/subscriptions/4d55f386-4e21-46d0-9a72-4fef530d717a/resourceGroups/miriam-azure-proxy/providers/Microsoft.Compute/galleries/agent/images/questing-server-amd64-gen2" --ssh-key-values ~/.ssh/id_rsa.pub --size Standard_D2s_v3 --admin-username ubuntu
The default value of '--size' will be changed to 'Standard_D2s_v5' from 'Standard_DS1_v2' in a future release.
Selecting "uksouth" may reduce your costs. The region you've selected may cost more for the same services. You can disable this message in the future with the command "az config set core.display_region_identified=false". Learn more at Windows help and learning

ResourceGroup PowerState PublicIpAddress Fqdns PrivateIpAddress MacAddress Location

miriam-azure-proxy VM running 74.234.208.235 10.0.0.4 7C-ED-8D-8F-46-02 westeurope
❯ ssh ubuntu@74.234.208.235
The authenticity of host '74.234.208.235 (74.234.208.235)' can't be established.
ED25519 key fingerprint is SHA256:AV+fjV8N2feJfoSP+0qBPkIEO8vzGN+5HfO1N3YyeX4.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '74.234.208.235' (ED25519) to the list of known hosts.
Welcome to Ubuntu Questing Quokka (development branch) (GNU/Linux 6.17.0-1003-azure x86_64)

Documentation: Ubuntu documentation

Management: https://landscape.canonical.com

Support: Ubuntu Pro | Ubuntu

 System information as of Mon Sep 29 12:45:27 UTC 2025

  System load: 0.95 Processes: 127
  Usage of /: 6.2% of 27.95GB Users logged in: 0
  Memory usage: 4% IPv4 address for eth0: 10.0.0.4
  Swap usage: 0%

0 updates can be applied immediately.

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

ubuntu@t-m-questing-amd64-server-systemd:~$ dpkg -l azure-proxy-agent
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=================-===============-============-=================================
ii azure-proxy-agent 1.0.30-0ubuntu6 amd64 Azure Guest Proxy Agent
ubuntu@t-m-questing-amd64-server-systemd:~$ systemctl --failed --no-legend
ubuntu@t-m-questing-amd64-server-systemd:~$ systemctl is-active azure-proxy-agent
active
ubuntu@t-m-questing-amd64-server-systemd:~$ systemctl status azure-proxy-agent
● azure-proxy-agent.service - Microsoft Azure GuestProxyAgent
     Loaded: loaded (/usr/lib/systemd/system/azure-proxy-agent.service; enabled; preset: enabled)
     Active: active (running) since Mon 2025-09-29 12:44:12 UTC; 2min 3s ago
 Invocation: 2da12dcbef524fa8a617e7c27d5f4fc8
       Docs: man:azure-proxy-agent(8)
   Main PID: 452 (azure-proxy-age)
      Tasks: 5 (limit: 9505)
     Memory: 32.7M (peak: 49.7M)
        CPU: 196ms
     CGroup: /system.slice/azure-proxy-agent.service
             └─452 /usr/sbin/azure-proxy-agent

Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: ============== GuestProxyAgent (1.0.30) is starting on Linux:Ubuntu-25.10.0(>
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Start proxy listener at '127.0.0.1:3080'.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success loaded bpf object.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success updated bpf skip_process map with pid=452.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success updated bpf map for WireServer support.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success updated bpf map for IMDS support.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success updated bpf map for Host GAPlugin support.
Sep 29 12:44:12 ubuntu azure-proxy-agent[452]: Success attached bpf prog.
Sep 29 12:44:22 ubuntu azure-proxy-agent[452]: {"id":1,"method":"GET","url":"/metadata/instance?api-version=2021-08-01&exte>
Sep 29 12:44:22 ubuntu azure-proxy-agent[452]: telemetry event reader task started.

ubuntu@t-m-questing-amd64-server-systemd:~$ journalctl | grep cloud-init
Sep 29 12:44:04 ubuntu systemd[1]: Starting cloud-init-main.service - Cloud-init: Single Process...
Sep 29 12:44:18 ubuntu systemd[1]: Started cloud-init-main.service - Cloud-init: Single Process.
Sep 29 12:44:18 ubuntu systemd[1]: Starting cloud-init-local.service - Cloud-init: Local Stage (pre-network)...
Sep 29 12:44:19 ubuntu cloud-init[677]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 running 'init-local' at Mon, 29 Sep 2025 12:44:19 +0000. Up 30.23 seconds.
Sep 29 12:44:22 ubuntu azure-proxy-agent[452]: {"id":1,"method":"GET","url":"/metadata/instance?api-version=2021-08-01&extended=true","clientIp":"127.0.0.1","clientPort":48264,"ip":"169.254.169.254","port":80,"userId":0,"userName":"root","userGroups":["root"],"processFullPath":"/usr/bin/python3.13","processCmdLine":"/usr/bin/python3 /usr/bin/cloud-init --all-stages","runAsElevated":true,"responseStatus":"200 OK","elapsedTime":81,"errorDetails":""}
Sep 29 12:44:24 t-m-questing-amd64-server-systemd systemd[1]: Reload requested from client PID 743 ('systemctl') (unit cloud-init-main.service)...
Sep 29 12:44:24 t-m-questing-amd64-server-systemd systemd[1]: Finished cloud-init-local.service - Cloud-init: Local Stage (pre-network).
Sep 29 12:44:25 t-m-questing-amd64-server-systemd systemd[1]: Starting cloud-init-network.service - Cloud-init: Network Stage...
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 running 'init' at Mon, 29 Sep 2025 12:44:25 +0000. Up 36.25 seconds.
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +++++++++++++++++++++++++++Net device info++++++++++++++++++++++++++++
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +--------+-------+-----------+-----------+-------+-------------------+
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: | Device | Up | Address | Mask | Scope | Hw-Address |
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +--------+-------+-----------+-----------+-------+-------------------+
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: | eth0 | False | . | . | . | 7c:ed:8d:8f:46:02 |
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: | lo | True | 127.0.0.1 | 255.0.0.0 | host | . |
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: | lo | True | ::1/128 | . | host | . |
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +--------+-------+-----------+-----------+-------+-------------------+
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +++++++++++++++++++Route IPv6 info+++++++++++++++++++
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +-------+-------------+---------+-----------+-------+
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: | Route | Destination | Gateway | Interface | Flags |
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +-------+-------------+---------+-----------+-------+
Sep 29 12:44:25 t-m-questing-amd64-server-systemd cloud-init[677]: ci-info: +-------+-------------+---------+-----------+-------+
Sep 29 12:44:33 t-m-questing-amd64-server-systemd systemd[1]: Reload requested from client PID 1005 ('systemctl') (unit cloud-init-main.service)...
Sep 29 12:44:35 t-m-questing-amd64-server-systemd systemd[1]: Finished cloud-init-network.service - Cloud-init: Network Stage.
Sep 29 12:44:35 t-m-questing-amd64-server-systemd systemd[1]: Listening on cloud-init-hotplugd.socket - cloud-init hotplug hook socket.
Sep 29 12:44:35 t-m-questing-amd64-server-systemd cloud-init[677]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 running 'modules:config' at Mon, 29 Sep 2025 12:44:35 +0000. Up 46.87 seconds.
Sep 29 12:44:39 t-m-questing-amd64-server-systemd python3[1089]: 2025-09-29T12:44:39.524242Z INFO Daemon Daemon cloud-init is enabled: True
Sep 29 12:44:39 t-m-questing-amd64-server-systemd python3[1089]: 2025-09-29T12:44:39.526915Z INFO Daemon Daemon Using cloud-init for provisioning
Sep 29 12:44:42 t-m-questing-amd64-server-systemd cloud-init[677]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 running 'modules:final' at Mon, 29 Sep 2025 12:44:42 +0000. Up 53.83 seconds.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1578]: #############################################################
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1579]: -----BEGIN SSH HOST KEY FINGERPRINTS-----
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1581]: 256 SHA256:DaPtOsltcZrErCrmsHEMsZS3AxNFSMQ5ycVEHp9iGRM root@t-m-questing-amd64-server-systemd (ECDSA)
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1583]: 256 SHA256:AV+fjV8N2feJfoSP+0qBPkIEO8vzGN+5HfO1N3YyeX4 root@t-m-questing-amd64-server-systemd (ED25519)
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1587]: 3072 SHA256:Enlzy1vNQzB+oAElwsUuSEnJnUWBmf+N6EJJ8VR07lM root@t-m-questing-amd64-server-systemd (RSA)
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1588]: -----END SSH HOST KEY FINGERPRINTS-----
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[1589]: #############################################################
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Cloud-init v. 25.3~2g890873f5-0ubuntu2 finished at Mon, 29 Sep 2025 12:44:43 +0000. Datasource DataSourceAzure [seed=/dev/sr0]. Up 54.36 seconds
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Generating public/private rsa key pair.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your identification has been saved in /etc/ssh/ssh_host_rsa_key
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key fingerprint is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: SHA256:Enlzy1vNQzB+oAElwsUuSEnJnUWBmf+N6EJJ8VR07lM root@t-m-questing-amd64-server-systemd
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key's randomart image is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +---[RSA 3072]----+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | o.=.XB*= = |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | = Ooo. * + |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . .o*o o o E |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . oo++ o * |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | ..oSooo+ + |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | o.. oo.. . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . . . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +----[SHA256]-----+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Generating public/private ecdsa key pair.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your identification has been saved in /etc/ssh/ssh_host_ecdsa_key
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your public key has been saved in /etc/ssh/ssh_host_ecdsa_key.pub
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key fingerprint is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: SHA256:DaPtOsltcZrErCrmsHEMsZS3AxNFSMQ5ycVEHp9iGRM root@t-m-questing-amd64-server-systemd
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key's randomart image is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +---[ECDSA 256]---+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |=+@E. |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | B+.* . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |.=.* o o |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |.o= o o + |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |o o .oS . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | o . .= . |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |o o . =.= |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | =o =.= |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: |.o.....o |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +----[SHA256]-----+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Generating public/private ed25519 key pair.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your identification has been saved in /etc/ssh/ssh_host_ed25519_key
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: Your public key has been saved in /etc/ssh/ssh_host_ed25519_key.pub
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key fingerprint is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: SHA256:AV+fjV8N2feJfoSP+0qBPkIEO8vzGN+5HfO1N3YyeX4 root@t-m-questing-amd64-server-systemd
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: The key's randomart image is:
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +--[ED25519 256]--+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | .. . .o |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | oo. . +..+|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | oo. + + *|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . +. .+ +.|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | =S. ...= |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | B o .o.o |
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . + = +o..|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . =.BoE|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: | . o+O*|
Sep 29 12:44:43 t-m-questing-amd64-server-systemd cloud-init[677]: +----[SHA256]-----+
Sep 29 12:44:43 t-m-questing-amd64-server-systemd systemd[1]: cloud-init-main.service: Deactivated successfully.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd systemd[1]: cloud-init-main.service: Consumed 2.261s CPU time, 79.8M memory peak.
Sep 29 12:44:43 t-m-questing-amd64-server-systemd systemd[1]: Reached target cloud-init.target - Cloud-init target.

#Other Info

Last bug related: https://bugs.launchpad.net/ubuntu/+source/azure-proxy-agent/+bug/2122345
Discussion on the upstream issue can be found here: Add `DefaultDependencies=no` back for Linux GPA service : https://github.com/Azure/GuestProxyAgent/pull/272#discussion_r2370319319

[Miriam España Acebal (mirespace)]

I would add ffe tag and subscribe release-team once I have the package reviewed and sponsored.

I have the package at https://launchpad.net/~mirespace/+archive/ubuntu/azure-proxy-agent/+sourcepub/17607758/+listing-archive-extra, but I need to add the LP bug to the changelog (I filled this later).

[Launchpad Janitor (janitor)]

This bug was fixed in the package azure-proxy-agent - 1.0.30-0ubuntu6

---------------
azure-proxy-agent (1.0.30-0ubuntu6) questing; urgency=medium

  [ Daniel Draper ]
  * d/p/fix-systemd-deps-cycle.patch: ensure the service is terminated on
    system shutdown (LP: #2125930)

 -- Miriam España Acebal <email address hidden> Thu, 25 Sep 2025 12:55:12 +0200

[Miriam España Acebal (mirespace)]

I tested the pre-sru-cases against Azure VMS with and amd64 server custom image with the package proposed to be SRUed built on my ppa, per LTSs series.

The Azure VM needs to be created with specific parameters to test azure-proxy-agent (the latest 3 in the follwing command), e.g:

az vm create --resource-group miriam-azure-proxy --name t-m-questing-amd64-server-systemd --image "/subscriptions/4d55f386-4e21-46d0-9a72-4fef530d717a/resourceGroups/miriam-azure-proxy/providers/Microsoft.Compute/galleries/agent/images/plucky-server-amd64-gen2" --ssh-key-values ~/.ssh/id_rsa.pub --size Standard_D2s_v3 --admin-username ubuntu --enable-proxy-agent true --wire-server-mode Enforce --imds-mode Enforce

I did a script that covers the pre-srus listed at [1] . That validation script directly addresses requirements (3), (4), and (5). It first confirms that the azure-proxy-agent service is running correctly and that no errors are present in its logs. Next, it simulates calls to the Azure system endpoints (IMDS and WireServer) using different types of users:

- Authorized users (with the right permissions) — the script confirms their requests are intercepted by the agent (seen in the logs) and that the endpoint returns a successful HTTP response (2xx), meaning the request was allowed.

- Unauthorized users (without the required permissions) — the script confirms their requests are also intercepted but the endpoint responds with a failure HTTP code (such as 403/401), showing the request was blocked.

In short, the test ensures the proxy agent is healthy, actively intercepts all traffic, and enforces the rules correctly by allowing only legitimate requests and rejecting everything else.

All series went OK (it chan be checked per series in the attachment):

⇒ (3) Checking azure-proxy-agent service status…
● azure-proxy-agent.service - Microsoft Azure GuestProxyAgent
     Loaded: loaded (/usr/lib/systemd/system/azure-proxy-agent.service; enabled; preset: enabled)
     Active: active (running) since Thu 2025-10-02 15:12:34 UTC; 3min 49s ago
       Docs: man:azure-proxy-agent(8)
   Main PID: 478 (azure-proxy-age)
      Tasks: 5 (limit: 9507)
     Memory: 32.5M (peak: 46.9M)
        CPU: 2.595s
     CGroup: /system.slice/azure-proxy-agent.service
             └─478 /usr/sbin/azure-proxy-agent

⇒ Final summary:
  Test 1: ✔ IMDS authorized allowed (200) + logged
  Test 2: ✔ IMDS unauthorized blocked (400/403) + logged
  Test 3: ✔ WireServer authorized allowed (200/304) + logged
  Test 4: ✔ WireServer unauthorized blocked (400/403) + logged (:32526)
  Test 5: ✔ IMDS MSI direct blocked (400/401/403) + logged
  Totals: PASSED=5 FAILED=0
✔ All tests passed ✅

 [1] https://documentation.ubuntu.com/sru/en/latest/reference/exception-Azure-Proxy-Agent-Updates/#pre-sru-test-cases

[Miriam España Acebal (mirespace)]

For the especific needed fix that arose with this bug, I tested the same machines creating a new test json for this especific case [1], so it:

- checks that the agent installs correctly, runs at the right time, and shuts down cleanly on all supported Ubuntu releases in Azure.
- covers that service is installed and healthy and starts before networking, there is no system errors or blockers and shuts down quickly and safely.

Results are all ok, artifacts per series attached:

==== FINAL SUMMARY (EXTENDED) ====
VMs with tests: 3
VMs all phases OK: 0 / 3 (0%)
Test success rate: 3 / 3 (100%)
-- Test Breakdown --
  ✓ Passed: 3 ✗ Failed: 0 ⏭ Skipped: 0 📊 Total: 3
  • Failures breakdown → Policy: 0 Cmd/Runtime: 0
Completed series: jammy plucky noble
-- Fails by series (VMs failed / VMs total) --
  jammy: 0/1
  plucky: 0/1
  noble: 0/1
-- Overall Status --
  🎉 PERFECT RUN! All 3 VMs completed successfully (100%)
====================================
==== FINAL SUMMARY (GOOD / BAD / SKIP) ====
GOOD: 3
BAD: 0
SKIP: 0
-- CRITICAL SKIPS --
RUN:CREATE = 0
RUN:IP = 0
RUN:SSH = 0
RUN:SSH_LOST = 0
RUN:REBOOT_SSH = 0
RUN:REBOOT_POWER = 0
RUN:CREATE_POWER = 0
-- GOOD details --
GOOD|vm=t-plucky-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=plucky|type=amd64_server|size=Standard_D2s_v3|offer=ubuntu-25_04|sku=server
GOOD|vm=t-noble-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=amd64_server|size=Standard_D2s_v3|offer=ubuntu-24_04-lts|sku=server
GOOD|vm=t-jammy-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=jammy|type=amd64_server|size=Standard_D2s_v3|offer=0001-com-ubuntu-server-jammy|sku=22_04-lts-gen2

[1] https://github.com/mirespace/v3/tree/stable . This is the same ad-hoc script (I'm afraid, still not polished). I translated the third start (*) of test plan senction into a test-matrix.json file that drives the SRU verification

[Julian Andres Klode (juliank)]

Hello Miriam, or anyone else affected,

Accepted azure-proxy-agent into plucky-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/azure-proxy-agent/1.0.30-0ubuntu6~25.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-plucky to verification-done-plucky. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-plucky. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Miriam, or anyone else affected,

Accepted azure-proxy-agent into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/azure-proxy-agent/1.0.30-0ubuntu6~24.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Miriam, or anyone else affected,

Accepted azure-proxy-agent into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/azure-proxy-agent/1.0.30-0ubuntu6~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Miriam España Acebal (mirespace)]

Repeating comment #4:

TL;DR: All series went well. Artifacs from tests attached.

==== FINAL SUMMARY (EXTENDED) ====
VMs with tests: 14
VMs all phases OK: 0 / 14 (0%)
Test success rate: 14 / 14 (100%)
-- Test Breakdown --
  ✓ Passed: 14 ✗ Failed: 0 ⏭ Skipped: 0 📊 Total: 14
  • Failures breakdown → Policy: 0 Cmd/Runtime: 0
Completed series: jammy plucky noble
-- Fails by series (VMs failed / VMs total) --
  jammy: 0/5
  plucky: 0/4
  noble: 0/5
-- Overall Status --
  🎉 PERFECT RUN! All 14 VMs completed successfully (100%)
====================================
==== FINAL SUMMARY (GOOD / BAD / SKIP) ====
GOOD: 14
BAD: 0
SKIP: 15
-- CRITICAL SKIPS --
RUN:CREATE = 0
RUN:IP = 0
RUN:SSH = 0
RUN:SSH_LOST = 0
RUN:REBOOT_SSH = 0
RUN:REBOOT_POWER = 0
RUN:CREATE_POWER = 0
-- GOOD details --
GOOD|vm=t-plucky-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=plucky|type=amd64_server|size=Standard_D2s_v3|offer=ubuntu-25_04|sku=server
GOOD|vm=t-plucky-amd64-minimal-standard|test=phase1-azure-proxy-checks-and-shutdown|series=plucky|type=amd64_minimal|size=Standard_D2s_v3|offer=ubuntu-25_04|sku=minimal
GOOD|vm=t-plucky-arm64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=plucky|type=arm64_server|size=Standard_D2ps_v6|offer=ubuntu-25_04|sku=server-arm64
GOOD|vm=t-plucky-arm64-minimal-standard|test=phase1-azure-proxy-checks-and-shutdown|series=plucky|type=arm64_minimal|size=Standard_D2ps_v6|offer=ubuntu-25_04|sku=minimal-arm64
GOOD|vm=t-noble-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=amd64_server|size=Standard_D2s_v3|offer=ubuntu-24_04-lts|sku=server
GOOD|vm=t-noble-amd64-minimal-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=amd64_minimal|size=Standard_D2s_v3|offer=ubuntu-24_04-lts|sku=minimal
GOOD|vm=t-noble-amd64-fde-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=amd64_fde|size=Standard_D2s_v3|offer=ubuntu-24_04-lts|sku=cvm
GOOD|vm=t-noble-arm64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=arm64_server|size=Standard_D2ps_v6|offer=ubuntu-24_04-lts|sku=server-arm64
GOOD|vm=t-noble-arm64-minimal-standard|test=phase1-azure-proxy-checks-and-shutdown|series=noble|type=arm64_minimal|size=Standard_D2ps_v6|offer=ubuntu-24_04-lts|sku=minimal-arm64
GOOD|vm=t-jammy-amd64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=jammy|type=amd64_server|size=Standard_D2s_v3|offer=0001-com-ubuntu-server-jammy|sku=22_04-lts-gen2
GOOD|vm=t-jammy-amd64-minimal-standard|test=phase1-azure-proxy-checks-and-shutdown|series=jammy|type=amd64_minimal|size=Standard_D2s_v3|offer=0001-com-ubuntu-minimal-jammy|sku=minimal-22_04-lts-gen2
GOOD|vm=t-jammy-amd64-fde-standard|test=phase1-azure-proxy-checks-and-shutdown|series=jammy|type=amd64_fde|size=Standard_D2s_v3|offer=0001-com-ubuntu-confidential-vm-jammy|sku=22_04-lts-cvm
GOOD|vm=t-jammy-arm64-server-standard|test=phase1-azure-proxy-checks-and-shutdown|series=jammy|type=arm64_server|size=Standard_D2ps_v6|offer=0001-com-ubuntu-server-jammy|sku=22_04-lts-arm64
GOOD|vm=t-jammy-arm64-minimal-standard|test=phase1-a...

[Miriam España Acebal (mirespace)]

Same that comment #3 for Plucky: All tests OK,e.g:

⇒ Final summary:
  Test 1: ✔ IMDS authorized allowed (200) + logged
  Test 2: ✔ IMDS unauthorized blocked (400/403) + logged
  Test 3: ✔ WireServer authorized allowed (200/304) + logged
  Test 4: ✔ WireServer unauthorized blocked (400/403) + logged (:32526)
  Test 5: ✔ IMDS MSI direct blocked (400/401/403) + logged
  Totals: PASSED=5 FAILED=0
✔ All tests passed ✅

Logs attached.

[Miriam España Acebal (mirespace)]

Same that comment #3 for Noble: All tests OK,e.g:

⇒ Final summary:
  Test 1: ✔ IMDS authorized allowed (200) + logged
  Test 2: ✔ IMDS unauthorized blocked (400/403) + logged
  Test 3: ✔ WireServer authorized allowed (200/304) + logged
  Test 4: ✔ WireServer unauthorized blocked (400/403) + logged (:32526)
  Test 5: ✔ IMDS MSI direct blocked (400/401/403) + logged
  Totals: PASSED=5 FAILED=0
✔ All tests passed ✅

Logs attached.

[Miriam España Acebal (mirespace)]

Same that comment #3 for Jammy: All tests OK,e.g:

⇒ Final summary:
  Test 1: ✔ IMDS authorized allowed (200) + logged
  Test 2: ✔ IMDS unauthorized blocked (400/403) + logged
  Test 3: ✔ WireServer authorized allowed (200/304) + logged
  Test 4: ✔ WireServer unauthorized blocked (400/403) + logged (:32526)
  Test 5: ✔ IMDS MSI direct blocked (400/401/403) + logged
  Totals: PASSED=5 FAILED=0
✔ All tests passed ✅

Logs attached.

[Miriam España Acebal (mirespace)]

CTF OK for Plucky

Our framework for images, Cloud-Test-Framework, was runned against the custom images with the proposed package for Plucky.

We ran azure-general, basic-ubuntu and cloud-init tests, all OK (no error in the XML produced) for amd64 and arm64 (minimal and server).

We conclude our testing for this series here. But because we're waiting on our partner's testing we're adding the block tag.

[Miriam España Acebal (mirespace)]

CTF OK for Noble

Our framework for images, Cloud-Test-Framework, was runned against the custom images with the proposed package for Noble.

We ran azure-general, basic-ubuntu and cloud-init tests, all OK (no error in the logs) for amd64 and arm64 (minimal and server):

❯ ack OK
noble-minimal-arm64-basic-ubuntu.log
119:OK (skipped=3)

noble-server-amd64-cloud-init.log
57:OK

noble-minimal-amd64-cloud-init.log
57:OK

noble-server-amd64-azure-general.log
152:OK (skipped=9)

noble-minimal-amd64-azure-general.log
133:OK (skipped=9)

noble-server-arm64-azure-general.log
152:OK (skipped=10)

noble-minimal-arm64-azure-general.log
133:OK (skipped=10)

noble-minimal-arm64-cloud-init.log
57:OK

noble-server-amd64-basic-ubuntu.log
119:OK (skipped=4)

noble-fde-server-amd64-cloud-init.log
57:OK

noble-server-arm64-basic-ubuntu.log
119:OK (skipped=4)

noble-minimal-amd64-basic-ubuntu.log
119:OK (skipped=3)

noble-server-arm64-cloud-init.log
57:OK

noble-fde-server-amd64-azure-general.log
152:OK (skipped=9)

noble-fde-server-amd64-basic-ubuntu.log
119:OK (skipped=4)

We conclude our testing for this series here. But because we're waiting on our partner's testing we're adding the block tag.

[Miriam España Acebal (mirespace)]

CTF OK for Jammy

Our framework for images, Cloud-Test-Framework, was runned against the custom images with the proposed package for Jammy.

We ran azure-general, basic-ubuntu and cloud-init tests for amd64 and arm64 (minimal and server); all OK for azure-general and cloud-init:

❯ ack OK
jammy-server-arm64-azure-general.log
398:OK (skipped=9)

jammy-minimal-amd64-cloud-init.log
57:OK

jammy-minimal-amd64-azure-general.log
145:OK (skipped=8)

jammy-minimal-arm64-azure-general.log
145:OK (skipped=9)

jammy-server-amd64-azure-general.log
395:OK (skipped=8)

jammy-server-amd64-cloud-init.log
304:OK

jammy-fde-server-amd64-azure-general.log
399:OK (skipped=8)

jammy-server-arm64-cloud-init.log
307:OK

jammy-fde-server-amd64-cloud-init.log
308:OK

jammy-minimal-arm64-cloud-init.log
57:OK

for basic-ubuntu we have a false negative:

2025-10-15 13:30:54,825 [INFO] test_framework.tools.testing_tools: ----------------------------------------------------------------------
2025-10-15 13:30:54,825 [WARNING] test_framework.tools.testing_tools: ERROR: tests.BasicUbuntuTests.test_deb_package_policy
Traceback (most recent call last):
  File "/home/miriam/cloudware/testing/cloud-test-framework/test_framework/tests/basic_ubuntu/data/tests.py", line 777, in test_deb_package_policy
    _package_release_component = policy_line.split()[2] # eg. mantic/main
                                 ~~~~~~~~~~~~~~~~~~~^^^
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/miriam/cloudware/testing/cloud-test-framework/test_framework/tests/basic_ubuntu/data/tests.py", line 787, in test_deb_package_policy
    raise RuntimeError(
RuntimeError: Failed to parse apt-cache policy output for package (deb822 is False) 'azure-proxy-agent' - '100 /var/lib/dpkg/status' to release and component.

As this Jammy custom image doesn't contain the sources list file as is prior to the deb822 format, this test should be skipped for Jammy for now.

We conclude our testing for this series here. But because we're waiting on our partner's testing, we're adding the block tag.

[Zhidong Peng (zhidongpeng)]

Looks good from an Azure perspective with ~93k+ VM creates, including 22.04, 24,04 and 25.10 as well. Thanks!

image MSPEnabled GPAInstalled Total ReliabilityPct
ubuntu-2204-arm64 FALSE FALSE 2,232 100
ubuntu-2204-arm64 FALSE TRUE 2,223 100
ubuntu-2204-arm64 TRUE TRUE 1,108 99.91
ubuntu-2204-gen2 FALSE FALSE 4,398 99.98
ubuntu-2204-gen2 FALSE TRUE 4,400 99.91
ubuntu-2204-gen2 TRUE TRUE 2,207 99.95
ubuntu-2404-arm64 FALSE FALSE 2,246 100
ubuntu-2404-arm64 FALSE TRUE 2,202 100
ubuntu-2404-arm64 TRUE TRUE 1,077 99.91
ubuntu-2404-gen2 FALSE FALSE 4,410 99.91
ubuntu-2404-gen2 FALSE TRUE 4,400 99.93
ubuntu-2404-gen2 TRUE TRUE 2,197 99.95
ubuntu-2504-gen2 FALSE TRUE 222 100
ubuntu-2504-gen2 TRUE TRUE 119 100
ubuntu-2510-arm64 FALSE FALSE 2,249 100
ubuntu-2510-arm64 FALSE TRUE 2,042 100
ubuntu-2510-arm64 TRUE TRUE 1,120 100
ubuntu-2510-gen2 FALSE FALSE 4,388 99.98
ubuntu-2510-gen2 FALSE TRUE 4,374 100
ubuntu-2510-gen2 TRUE TRUE 2,183 100
ubuntu-minimal-2204-gen2 FALSE FALSE 4,429 99.98
ubuntu-minimal-2204-gen2 FALSE TRUE 4,395 99.89
ubuntu-minimal-2204-gen2 TRUE TRUE 2,204 99.91
ubuntu-minimal-2404-arm64 FALSE FALSE 1,979 100
ubuntu-minimal-2404-arm64 FALSE TRUE 2,173 99.95
ubuntu-minimal-2404-arm64 TRUE TRUE 1,107 100
ubuntu-minimal-2404-gen2 FALSE FALSE 4,403 100
ubuntu-minimal-2404-gen2 FALSE TRUE 4,378 99.95
ubuntu-minimal-2404-gen2 TRUE TRUE 2,196 99.91
ubuntu-minimal-2504-gen2 FALSE TRUE 239 100
ubuntu-minimal-2504-gen2 TRUE TRUE 109 100
ubuntu-minimal-2510-arm64 FALSE FALSE 2,182 100
ubuntu-minimal-2510-arm64 FALSE TRUE 2,135 100
ubuntu-minimal-2510-arm64 TRUE TRUE 1,107 100
ubuntu-minimal-2510-gen2 FALSE FALSE 4,373 99.93
ubuntu-minimal-2510-gen2 FALSE TRUE 4,375 99.93
ubuntu-minimal-2510-gen2 TRUE TRUE 2,200 99.91

[Miriam España Acebal (mirespace)]

Thanks @zhidongpeng for the report!

Only for context, the data in the previous comment from the MS Azure team compares the baseline Ubuntu image (where azure-proxy-agent (GPA) is not installed) against a variant where GPA is installed. Additionally, similar comparisons were run for cases where GPA is installed, toggling between MSP enabled and MSP disabled.

Focusing on the reliability metrics, as Zhidong pointed out, there does not appear to be any major performance regression in any of the tested configurations, including 25.04, upon closer inspection of the lines.

Due to the above, we are OK with this testing from our partner, which is needed in addition to our own testing already presented.

I'm removing block tags and marking verification-done per series and globally. Please, SRU team, proceed with the packages' release if all is okay on your side as well.