Skip to content

fix: use azcli login for azcopy in windows#8047

Merged
awesomenix merged 1 commit intomainfrom
nishp/fix/azcopy_scripts
Mar 9, 2026
Merged

fix: use azcli login for azcopy in windows#8047
awesomenix merged 1 commit intomainfrom
nishp/fix/azcopy_scripts

Conversation

@awesomenix
Copy link
Contributor

Missed some spots with azcli login

@awesomenix awesomenix merged commit 97d6e46 into main Mar 9, 2026
22 of 29 checks passed
@awesomenix awesomenix deleted the nishp/fix/azcopy_scripts branch March 9, 2026 22:37
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Windows AzCopy usage to rely on Azure CLI-based authentication instead of MSI for both Windows VHD build-time downloads and Windows e2e log uploads.

Changes:

  • Switch AzCopy auth to AZCLI auto-login and adjust env vars for concurrency.
  • Remove explicit --login-type=MSI usage and add azcopy login calls in Windows scripts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
vhdbuilder/packer/windows/configure-windows-vhd.ps1 Updates VHD build-time AzCopy download flow to use AZCLI auto-login.
e2e/vmss.go Updates the Windows VM RunCommand log-upload script to use AZCLI auto-login and adds an azcopy login step.

Comment on lines +619 to +623
$env:AZCOPY_AUTO_LOGIN_TYPE = "AZCLI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
C:\k\debug\collect-windows-logs.ps1
$CollectedLogs=(Get-ChildItem . -Filter "*_logs.zip" -File)[0].Name
.\azcopy.exe login
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Windows VM RunCommand log-upload script switches AzCopy auth from MSI to AZCLI, but it doesn't install Azure CLI or run az login. If Azure CLI isn't present on the node image (typical), azcopy login/copy will fail and you'll lose failure diagnostics. Either keep MSI-based AzCopy auth here, or add a non-interactive Azure CLI install + az login --identity flow as part of this script.

Suggested change
$env:AZCOPY_AUTO_LOGIN_TYPE = "AZCLI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
C:\k\debug\collect-windows-logs.ps1
$CollectedLogs=(Get-ChildItem . -Filter "*_logs.zip" -File)[0].Name
.\azcopy.exe login
$env:AZCOPY_AUTO_LOGIN_TYPE = "MSI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
C:\k\debug\collect-windows-logs.ps1
$CollectedLogs=(Get-ChildItem . -Filter "*_logs.zip" -File)[0].Name
.\azcopy.exe login --identity

Copilot uses AI. Check for mistakes.
Comment on lines +619 to +620
$env:AZCOPY_AUTO_LOGIN_TYPE = "AZCLI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uploadLogsPowershellScript still takes $arg3 (and the Go code still passes the VM identity resource ID), but after this change $arg3 is no longer used. Either remove the unused parameter/wiring, or keep MSI-based auth that consumes it, to avoid confusion about which identity AzCopy is using.

Suggested change
$env:AZCOPY_AUTO_LOGIN_TYPE = "AZCLI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
$env:AZCOPY_AUTO_LOGIN_TYPE = "MSI"
$env:AZCOPY_CONCURRENCY_VALUE = "AUTO"
if (-not [string]::IsNullOrEmpty($arg3)) {
$env:AZCOPY_MSI_RESOURCE_ID = $arg3
}

Copilot uses AI. Check for mistakes.
Comment on lines 136 to 150
@@ -144,7 +146,7 @@ function Download-FileWithAzCopy

Write-Log "Logging in to AzCopy"
# user_assigned_managed_identities has been bound in vhdbuilder/packer/windows/windows-vhd-builder-sig.json
.\azcopy.exe login --login-type=MSI
.\azcopy.exe login

Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AZCOPY_AUTO_LOGIN_TYPE is being switched to AZCLI, but the script never ensures Azure CLI is installed/logged in on the Windows build VM. On a default Windows Server image this typically means azcopy.exe login/copy will fail (or prompt for interactive device login), breaking VHD builds that rely on Download-FileWithAzCopy for private downloads. Consider either (a) explicitly performing a non-interactive az login --identity before running AzCopy (and avoid azcopy login entirely), or (b) keep using --login-type=MSI for headless builds.

Copilot uses AI. Check for mistakes.
Comment on lines 147 to 150
Write-Log "Logging in to AzCopy"
# user_assigned_managed_identities has been bound in vhdbuilder/packer/windows/windows-vhd-builder-sig.json
.\azcopy.exe login --login-type=MSI
.\azcopy.exe login

Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azcopy.exe login is now invoked with no --login-type, which can default to an interactive device-code flow in automation. Since AZCOPY_AUTO_LOGIN_TYPE is already set, you can usually remove the explicit login call and let AzCopy auto-auth, or force a non-interactive login type explicitly to avoid hanging the build.

Copilot uses AI. Check for mistakes.
awesomenix added a commit that referenced this pull request Mar 10, 2026
awesomenix added a commit that referenced this pull request Mar 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants