[Az.Aks] Enforce RSA as the GenerateSSHKeys default key type #28998

jovieir · 2025-12-19T01:01:41Z

Description

This pull request enhances the SSH key generation logic in the NewAzureRmAks command to ensure compatibility with changes in OpenSSH 9.4 and above, where the default key type switched to ed25519 (unsupported by AKS). The main update involves detecting the installed OpenSSH version and conditionally specifying the key type when generating SSH keys. Additionally, it introduces platform checks and error handling for robust version detection.

SSH Key Generation Compatibility Updates:

Added a method GetOpenSSHVersion() to detect the installed OpenSSH version, using platform checks and safe process handling to extract the version from ssh.exe output.
Updated the GenerateSshKeyValue() method to use the detected OpenSSH version: if version 9.4 or above is found, the -t rsa argument is added to ssh-keygen to ensure RSA keys are generated; otherwise, the argument is omitted for compatibility with older OpenSSH versions.

Platform Support:

Added a using System.Runtime.InteropServices; directive and platform checks to ensure the correct path to ssh.exe is used on Windows and non-Windows systems.

These changes help prevent issues with unsupported SSH key types in AKS clusters on systems with newer OpenSSH installations.

Mandatory Checklist

Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

SHOULD update ChangeLog.md file(s) appropriately
- Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
  - A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
- Should not change ChangeLog.md if no new release is required, such as fixing test case only.
SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
SHOULD have proper test coverage for changes in pull request.
SHOULD NOT adjust version of module manually in pull request

azure-client-tools-bot-prd · 2025-12-19T01:01:44Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

isra-fel · 2025-12-19T01:08:52Z

/azp run

azure-pipelines · 2025-12-19T01:09:11Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

This pull request addresses compatibility issues with OpenSSH 9.4+ in the Azure Kubernetes Service (AKS) module by ensuring RSA SSH keys are generated instead of the new ed25519 default (which AKS doesn't support). The implementation adds version detection logic to conditionally specify the key type parameter when generating SSH keys.

Key Changes

Added GetOpenSSHVersion() method to detect the installed OpenSSH version through process execution and regex parsing
Modified GenerateSshKeyValue() to conditionally add -t rsa flag for OpenSSH 9.4+ installations
Introduced platform-specific handling using System.Runtime.InteropServices for Windows vs non-Windows path resolution

src/Aks/Aks/Commands/NewAzureRmAks.cs

Copilot · 2025-12-19T01:12:47Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    string standOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();
+
+                    process.WaitForExit();
+                    // OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX
+                    // Examples
+                    // "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"
+                    // "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"
+                    var regMatch = System.Text.RegularExpressions.Regex.Match(standOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");


The variable name "standOutput" appears to be a typo of "standardOutput". This inconsistent naming (compared to "standardError" later) reduces code clarity.

Suggested change

string standOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();

process.WaitForExit();

// OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX

// Examples

// "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"

// "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"

var regMatch = System.Text.RegularExpressions.Regex.Match(standOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");

string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();

process.WaitForExit();

// OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX

// Examples

// "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"

// "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"

var regMatch = System.Text.RegularExpressions.Regex.Match(standardOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");

src/Aks/Aks/Commands/NewAzureRmAks.cs

Copilot · 2025-12-19T01:12:49Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    // OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX
+                    // Examples
+                    // "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"
+                    // "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"
+                    var regMatch = System.Text.RegularExpressions.Regex.Match(standOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");


The regex pattern only matches Windows-specific OpenSSH output format (OpenSSH_for_Windows_X.XpX), but will fail to detect the OpenSSH version on non-Windows platforms where the output format is different (e.g., "OpenSSH_9.4p1, OpenSSL 3.0.2"). This means the version detection will always return null on Linux/macOS, preventing RSA key type enforcement on those platforms when OpenSSH 9.4+ is installed. Consider using a platform-agnostic regex pattern that matches both formats, such as matching "OpenSSH_(\d+).(\d+)p(\d+)" which works for both "OpenSSH_9.4p1" and "OpenSSH_for_Windows_9.4p1".

Suggested change

// OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX

// Examples

// "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"

// "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"

var regMatch = System.Text.RegularExpressions.Regex.Match(standOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");

// OpenSSH version formats to support:

// Windows: "OpenSSH_for_Windows_X.XpX, LibreSSL ..."

// Non-Windows:"OpenSSH_X.XpX, OpenSSL ..."

var regMatch = System.Text.RegularExpressions.Regex.Match(standOutput, @"OpenSSH_(?:for_Windows_)?(\d+)\.(\d+)p(\d+)");

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

src/Aks/Aks/Commands/NewAzureRmAks.cs

Copilot · 2025-12-19T02:29:59Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+        static Version GetOpenSSHVersion()
+        {
+            using (Process process = new Process())
+            {
+                try
+                {
+                    // Using runtime information to determine the path to ssh.exe based on OS type.
+                    bool isWindows = RuntimeInformation.IsOSPlatform(OSPlatform.Windows);
+                    process.StartInfo.FileName = isWindows ? "C:\\Windows\\System32\\OpenSSH\\ssh.exe" : "ssh";
+                    process.StartInfo.Arguments = "-V";
+                    process.StartInfo.UseShellExecute = false;
+                    process.StartInfo.RedirectStandardInput = true;
+                    process.StartInfo.RedirectStandardError = true;
+                    process.StartInfo.RedirectStandardOutput = true;
+                    process.StartInfo.CreateNoWindow = true;
+                    process.Start();
+
+                    string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();
+
+                    process.WaitForExit();
+                    // OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX
+                    // Examples
+                    // "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"
+                    // "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"
+                    var regMatch = System.Text.RegularExpressions.Regex.Match(standardOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");
+
+                    // We don't really care about the patch version, so only return major and minor version. 
+                    return regMatch.Success ? new Version(int.Parse(regMatch.Groups[1].Value), int.Parse(regMatch.Groups[2].Value)) : null;
+                } // We're not expecting ssh to be missing, but just in case, we catch any exception and return null.
+                catch
+                {
+                    return null;
+                }
+                finally //Ensure process is properly disposed of and exited
+                {
+                    if (!process.HasExited)
+                    {
+                        try
+                        {
+                            process.Kill();
+                        }
+                        catch
+                        {
+                            // Ignore exceptions from Kill if process already exited
+                        }
+                    }
+                }
+            }
+        }


The new SSH key generation logic with version detection lacks test coverage. Given that the repository has comprehensive scenario tests for AKS functionality, this new feature should also have corresponding tests to validate:

Correct version detection for different OpenSSH versions

Proper handling when version detection fails (returns null)

Correct argument construction for OpenSSH versions >= 9.4 vs. older versions

Cross-platform behavior (Windows vs. Linux/macOS)

Consider adding unit tests or scenario tests that cover these SSH key generation scenarios.

isra-fel · 2025-12-19T02:38:58Z

/azp run

azure-pipelines · 2025-12-19T02:39:17Z

Azure Pipelines successfully started running 3 pipeline(s).

jovieir · 2025-12-19T03:20:00Z

@copilot open a new pull request to apply changes based on the comments in this thread

jovieir

applying code review suggestions

isra-fel · 2025-12-19T05:08:32Z

/azp run

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

src/Aks/Aks/Commands/NewAzureRmAks.cs

Copilot · 2025-12-19T05:08:39Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+        static Version GetOpenSSHVersion()
+        {
+            using (Process process = new Process())
+            {
+                try
+                {
+                    // Using runtime information to determine the path to ssh.exe based on OS type.
+                    bool isWindows = RuntimeInformation.IsOSPlatform(OSPlatform.Windows);
+                    string defaultWindowsSshPath = @"C:\Windows\System32\OpenSSH\ssh.exe";
+                    process.StartInfo.FileName = isWindows && File.Exists(defaultWindowsSshPath) ? defaultWindowsSshPath : "ssh";
+                    process.StartInfo.Arguments = "-V";
+                    process.StartInfo.UseShellExecute = false;
+                    process.StartInfo.RedirectStandardInput = true;
+                    process.StartInfo.RedirectStandardError = true;
+                    process.StartInfo.RedirectStandardOutput = true;
+                    process.StartInfo.CreateNoWindow = true;
+                    process.Start();
+
+                    string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();
+
+                    process.WaitForExit();
+                    // OpenSSH version for Windows follows the format: OpenSSH_for_Windows_X.XpX
+                    // Examples
+                    // "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"
+                    // "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"
+                    var regMatch = System.Text.RegularExpressions.Regex.Match(standardOutput, @"OpenSSH_for_Windows_(\d+)\.(\d+)p(\d+)");
+
+                    // We don't really care about the patch version, so only return major and minor version. 
+                    return regMatch.Success ? new Version(int.Parse(regMatch.Groups[1].Value), int.Parse(regMatch.Groups[2].Value)) : null;
+                } // We're not expecting ssh to be missing, but just in case, we catch any exception and return null.
+                catch
+                {
+                    return null;
+                }
+                finally //Ensure process is properly disposed of and exited
+                {
+                    if (!process.HasExited)
+                    {
+                        try
+                        {
+                            process.Kill();
+                        }
+                        catch
+                        {
+                            // Ignore exceptions from Kill if process already exited
+                        }
+                    }
+                }
+            }
+        }


The new OpenSSH version detection logic in GetOpenSSHVersion() lacks test coverage. Since the repository uses comprehensive automated testing for the Az.Aks module, consider adding unit tests to verify:

Correct version parsing for different OpenSSH output formats (Windows and non-Windows)

Handling of null returns when OpenSSH is not installed or version cannot be determined

Correct behavior when version is below 9.4 vs. 9.4 and above

The resulting ssh-keygen command arguments are correct for different scenarios

src/Aks/Aks/Commands/NewAzureRmAks.cs

azure-pipelines · 2025-12-19T05:08:50Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

Copilot · 2025-12-19T07:39:52Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                // We're not expecting ssh to be missing, but just in case, we catch any exception and return null.
+                catch
+                {
+                    return null;
+                }


The broad catch block on line 349 silently swallows all exceptions, which could hide important errors beyond just missing SSH binaries. Consider catching specific exceptions like FileNotFoundException or Win32Exception, and logging the exception details using WriteDebug or WriteWarning before returning null. This would help with troubleshooting when SSH version detection fails.

Suggested change

// We're not expecting ssh to be missing, but just in case, we catch any exception and return null.

catch

{

return null;

}

// We're not expecting ssh to be missing, but just in case, we catch specific exceptions and return null.

catch (FileNotFoundException ex)

{

WriteDebug($"Failed to detect SSH version: SSH executable not found. Detail: {ex.Message}");

return null;

}

catch (Win32Exception ex)

{

WriteDebug($"Failed to detect SSH version due to a Win32 error when starting the SSH process. Detail: {ex.Message}");

return null;

}

catch (InvalidOperationException ex)

{

WriteDebug($"Failed to detect SSH version due to an invalid process configuration. Detail: {ex.Message}");

return null;

}

catch (Exception ex)

{

WriteDebug($"Failed to detect SSH version due to an unexpected error. Detail: {ex.Message}");

return null;

}

Copilot · 2025-12-19T07:39:52Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();
+
+                    process.WaitForExit();


The process output reading on line 335 may cause a deadlock if the output buffers fill up. Reading both StandardOutput and StandardError synchronously after process.Start() can block if either buffer becomes full before WaitForExit is called. Consider using asynchronous reading with BeginOutputReadLine and BeginErrorReadLine, or read StandardError and StandardOutput separately to avoid potential deadlock situations.

Copilot · 2025-12-19T07:39:53Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+        // From OpenSSH 9.4 onwards, the default key type is ed25519, which is not supported in AKS.
+        // To ensure backward compatibility, we need to check the OpenSSH version installed and adjust the parameters accordingly.
+        static Version GetOpenSSHVersion()
+        {
+            using (Process process = new Process())
+            {
+                try
+                {
+                    // Using runtime information to determine the path to ssh.exe based on OS type.
+                    bool isWindows = RuntimeInformation.IsOSPlatform(OSPlatform.Windows);
+                    string defaultWindowsSshPath = @"C:\Windows\System32\OpenSSH\ssh.exe";
+                    process.StartInfo.FileName = isWindows && File.Exists(defaultWindowsSshPath) ? defaultWindowsSshPath : "ssh";
+                    process.StartInfo.Arguments = "-V";
+                    process.StartInfo.UseShellExecute = false;
+                    process.StartInfo.RedirectStandardInput = true;
+                    process.StartInfo.RedirectStandardError = true;
+                    process.StartInfo.RedirectStandardOutput = true;
+                    process.StartInfo.CreateNoWindow = true;
+                    process.Start();
+
+                    string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();
+
+                    process.WaitForExit();
+                    // OpenSSH version output follows formats like:
+                    //   Windows: "OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3"
+                    //   Windows: "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"
+                    //   Linux/macOS: "OpenSSH_9.5p1, OpenSSL 3.0.13 30 Jan 2024"
+                    // We match the common "OpenSSH_" prefix and make "for_Windows_" optional so this works across platforms.
+                    var regMatch = System.Text.RegularExpressions.Regex.Match(standardOutput, @"OpenSSH_(?:for_Windows_)?(\d+)\.(\d+)");
+
+                    // We don't really care about the patch version, so only return major and minor version. 
+                    return regMatch.Success ? new Version(int.Parse(regMatch.Groups[1].Value), int.Parse(regMatch.Groups[2].Value)) : null;
+                }
+                // We're not expecting ssh to be missing, but just in case, we catch any exception and return null.
+                catch
+                {
+                    return null;
+                }
+                finally //Ensure process is properly disposed of and exited
+                {
+                    if (!process.HasExited)
+                    {
+                        try
+                        {
+                            process.Kill();
+                        }
+                        catch
+                        {
+                            // Ignore exceptions from Kill if process already exited
+                        }
+                    }
+                }
+            }
+        }


The ChangeLog.md file is missing an entry for this SSH key generation change. According to the repository's contribution guidelines, you SHOULD update the ChangeLog.md file under the "Upcoming Release" section to document this change. Add a bullet point describing the enforcement of RSA as the default key type for OpenSSH 9.4 and above to ensure AKS compatibility.

Copilot · 2025-12-19T07:39:53Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    // Validate if OpenSSH version is 9.4 or above to add -t rsa argument
+                    // Which has been defaulted to ed25519 from OpenSSH 9.4 onwards
+                    // https://github.com/openssh/openssh-portable/blob/master/ssh-keygen.c#L70
+                    var openSshVersion = GetOpenSSHVersion();
+                    // If we cannot determine the OpenSSH version, we assume it's below 9.4 to maintain compatibility.
+                    // If openSshVersion isn't null and is >= 9.4, we add the -t rsa argument, otherwise we skip it
+                    var keyTypeArgument = openSshVersion != null && openSshVersion >= new Version(9, 4) ? "-t rsa " : "";
                    process.StartInfo.FileName = "ssh-keygen";
-                    process.StartInfo.Arguments = String.Format("-f \"{0}\"", generateSshKeyPath);
+                    // if keyTypeArgument is empty, we skip it to maintain compatibility with older OpenSSH versions
+                    // Otherwise, we explicitly set the key type to rsa
+                    process.StartInfo.Arguments = String.Format("{0}-f \"{1}\"", keyTypeArgument, generateSshKeyPath);


The new OpenSSH version detection logic and conditional SSH key type generation are not covered by automated tests. Given that the Aks.Test project contains comprehensive test scenarios for other module functionality, this new behavior should have test coverage to verify correct version detection, version comparison logic, and proper argument construction for both OpenSSH versions below and above 9.4.

src/Aks/Aks/Commands/NewAzureRmAks.cs

isra-fel · 2025-12-19T07:42:33Z

/azp run

azure-pipelines · 2025-12-19T07:42:52Z

Azure Pipelines successfully started running 3 pipeline(s).

jovieir · 2025-12-19T18:52:08Z

@copilot open a new pull request to apply changes based on the comments in this thread

wyunchi-ms

Could you please also update the src/Aks/Aks/ChangeLog.md?

jovieir · 2026-01-08T09:31:17Z

Apologies for the delay @wyunchi-ms for some reason I thought I had edited ChangeLog in the first commit

isra-fel · 2026-01-08T09:42:45Z

/azp run

azure-pipelines · 2026-01-08T09:43:04Z

Azure Pipelines successfully started running 3 pipeline(s).

vidai-msft · 2026-01-13T04:45:44Z

@jovieir Can you please sync with the latest main branch and then make the change log just under the # Upcoming Release? The position looks like not correct.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

jovieir · 2026-01-15T07:04:47Z

@vidai-msft done!

isra-fel · 2026-01-15T07:12:32Z

/azp run

azure-pipelines · 2026-01-15T07:12:48Z

Azure Pipelines successfully started running 3 pipeline(s).

src/Aks/Aks/ChangeLog.md

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/Aks/Aks/Commands/NewAzureRmAks.cs:1

The ChangeLog entry should use backticks for cmdlet names, not straight backticks which are currently used. Additionally, the phrase 'instead of ed25519 that became' could be clearer. Consider: 'Fixed the default SSH key generation logic in New-AzAksCluster to enforce RSA key type for compatibility with OpenSSH 9.4+, which changed its default from RSA to ed25519.'

// ----------------------------------------------------------------------------------

Copilot · 2026-01-16T01:51:55Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                {
+                    return null;
+                }
+                finally //Ensure process is properly disposed of and exited


Missing space after '//' in comment. Should be '// Ensure process is properly disposed of and exited'.

Suggested change

finally //Ensure process is properly disposed of and exited

finally // Ensure process is properly disposed of and exited

Copilot · 2026-01-16T01:51:56Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    var openSshVersion = GetOpenSSHVersion();
+                    // If we cannot determine the OpenSSH version, we assume it's below 9.4 to maintain compatibility.
+                    // If openSshVersion isn't null and is >= 9.4, we add the -t rsa argument, otherwise we skip it
+                    var keyTypeArgument = openSshVersion != null && openSshVersion >= new Version(9, 4) ? "-t rsa " : "";


The trailing space in '-t rsa ' is fragile and could be easily overlooked during maintenance. Consider using string interpolation or removing the space and adjusting the format string on line 398 to always include a space between parameters.

src/Aks/Aks/ChangeLog.md

Copilot · 2026-01-16T01:51:56Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    // Validate if OpenSSH version is 9.4 or above to add -t rsa argument
+                    // Which has been defaulted to ed25519 from OpenSSH 9.4 onwards
+                    // https://github.com/openssh/openssh-portable/blob/master/ssh-keygen.c#L70
+                    var openSshVersion = GetOpenSSHVersion();
+                    // If we cannot determine the OpenSSH version, we assume it's below 9.4 to maintain compatibility.
+                    // If openSshVersion isn't null and is >= 9.4, we add the -t rsa argument, otherwise we skip it
+                    var keyTypeArgument = openSshVersion != null && openSshVersion >= new Version(9, 4) ? "-t rsa " : "";


The new SSH key generation logic with OpenSSH version detection lacks test coverage. Consider adding unit tests to verify: (1) correct version parsing for different OpenSSH output formats, (2) proper fallback behavior when version detection fails, (3) correct key type argument generation for versions below and above 9.4.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

vidai-msft · 2026-01-16T02:06:01Z

/azp run

azure-pipelines · 2026-01-16T02:06:17Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Copilot · 2026-01-16T02:07:44Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                    if (!process.HasExited)
+                    {
+                        try
+                        {
+                            process.Kill();
+                        }
+                        catch
+                        {
+                            // Ignore exceptions from Kill if process already exited
+                        }
+                    }


There is a potential race condition between checking if the process has exited at line 355 and attempting to kill it at line 359. Another thread could terminate the process between the HasExited check and the Kill call. While the inner catch block provides some protection, consider using a more robust approach by catching InvalidOperationException specifically, which is thrown when calling Kill on an already exited process.

Copilot · 2026-01-16T02:07:44Z

src/Aks/Aks/ChangeLog.md

        - Additional information about change #1
 -->
 ## Upcoming Release
+* Fixed the default SSH key generation logic in `New-AzAksCluster` to enforce RSA key type (instead of ed25519 that became the default in OpenSSH 9.4 and above)


The ChangeLog entry should explain the SSH (Secure Shell) acronym for Azure PowerShell users who may not be familiar with it. Consider revising to: "Fixed the default SSH (Secure Shell) key generation logic in New-AzAksCluster to enforce RSA key type (instead of ed25519 that became the default in OpenSSH 9.4 and above)"

Copilot · 2026-01-16T02:07:45Z

src/Aks/Aks/Commands/NewAzureRmAks.cs

+                        catch
+                        {
+                            // Ignore exceptions from Kill if process already exited


The empty catch block at lines 361-364 silently swallows all exceptions during process cleanup. While the comment explains ignoring Kill exceptions if the process already exited, this catch block will also suppress other types of exceptions (e.g., permission issues, system errors) that may indicate real problems. Consider catching only the specific expected exception types like InvalidOperationException which is thrown when the process has already exited.

Suggested change

catch

{

// Ignore exceptions from Kill if process already exited

catch (InvalidOperationException)

{

// Ignore exceptions from Kill if process has already exited or cannot be killed

Copilot AI review requested due to automatic review settings December 19, 2025 01:01

Copilot started reviewing on behalf of jovieir December 19, 2025 01:03 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 19, 2025 02:19

Copilot started reviewing on behalf of jovieir December 19, 2025 02:21 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 19, 2025 04:58

jovieir commented Dec 19, 2025

View reviewed changes

Copilot started reviewing on behalf of jovieir December 19, 2025 05:00 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 19, 2025 07:29

Copilot started reviewing on behalf of jovieir December 19, 2025 07:31 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

wyunchi-ms reviewed Jan 5, 2026

View reviewed changes

vidai-msft added the needs-revision label Jan 15, 2026

João Vieira and others added 5 commits January 14, 2026 22:59

rebase/sync with main

8c510e5

Updated ChangeLog

80b767f

Update src/Aks/Aks/Commands/NewAzureRmAks.cs

9f05245

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestions from code review

e84f9dc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestions from code review

f40bdd0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

jovieir force-pushed the main branch from c08d2ce to f40bdd0 Compare January 15, 2026 07:03

YanaXu previously approved these changes Jan 15, 2026

View reviewed changes

YanaXu reviewed Jan 16, 2026

View reviewed changes

src/Aks/Aks/ChangeLog.md Outdated Show resolved Hide resolved

Update src/Aks/Aks/ChangeLog.md

7e5ce46

YanaXu dismissed their stale review via 7e5ce46 January 16, 2026 01:41

Copilot AI review requested due to automatic review settings January 16, 2026 01:41

YanaXu reviewed Jan 16, 2026

View reviewed changes

src/Aks/Aks/ChangeLog.md Outdated Show resolved Hide resolved

Copilot started reviewing on behalf of YanaXu January 16, 2026 01:43 View session

vidai-msft previously approved these changes Jan 16, 2026

View reviewed changes

Copilot AI reviewed Jan 16, 2026

View reviewed changes

Update src/Aks/Aks/ChangeLog.md

1da71db

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

YanaXu dismissed vidai-msft’s stale review via 1da71db January 16, 2026 01:57

Copilot AI review requested due to automatic review settings January 16, 2026 01:57

vidai-msft approved these changes Jan 16, 2026

View reviewed changes

vidai-msft added Waiting for CI and removed needs-revision labels Jan 16, 2026

Copilot started reviewing on behalf of YanaXu January 16, 2026 01:59 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

vidai-msft enabled auto-merge (squash) January 16, 2026 02:11

vidai-msft merged commit ce93512 into Azure:main Jan 16, 2026
18 of 19 checks passed

-                // We're not expecting ssh to be missing, but just in case, we catch any exception and return null.
-                catch
-                {
-                    return null;
-                }
+                // We're not expecting ssh to be missing, but just in case, we catch specific exceptions and return null.
+                catch (FileNotFoundException ex)
+                {
+                    WriteDebug($"Failed to detect SSH version: SSH executable not found. Detail: {ex.Message}");
+                    return null;
+                }
+                catch (Win32Exception ex)
+                {
+                    WriteDebug($"Failed to detect SSH version due to a Win32 error when starting the SSH process. Detail: {ex.Message}");
+                    return null;
+                }
+                catch (InvalidOperationException ex)
+                {
+                    WriteDebug($"Failed to detect SSH version due to an invalid process configuration. Detail: {ex.Message}");
+                    return null;
+                }
+                catch (Exception ex)
+                {
+                    WriteDebug($"Failed to detect SSH version due to an unexpected error. Detail: {ex.Message}");
+                    return null;
+                }

		string standardOutput = process.StandardOutput.ReadToEnd() + process.StandardError.ReadToEnd();

		process.WaitForExit();

	finally //Ensure process is properly disposed of and exited
	finally // Ensure process is properly disposed of and exited

-                        catch
-                        {
-                            // Ignore exceptions from Kill if process already exited
+                        catch (InvalidOperationException)
+                        {
+                            // Ignore exceptions from Kill if process has already exited or cannot be killed

[Az.Aks] Enforce RSA as the GenerateSSHKeys default key type #28998

[Az.Aks] Enforce RSA as the GenerateSSHKeys default key type #28998

Conversation

jovieir commented Dec 19, 2025

Description

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd bot commented Dec 19, 2025

Uh oh!

isra-fel commented Dec 19, 2025

Uh oh!

azure-pipelines bot commented Dec 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

isra-fel commented Dec 19, 2025

Uh oh!

azure-pipelines bot commented Dec 19, 2025

Uh oh!

jovieir commented Dec 19, 2025

Uh oh!

jovieir left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

isra-fel commented Dec 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

azure-pipelines bot commented Dec 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jovieir left a comment •

edited

Loading