Enable ACL confidential VM boot and harden Azure time synchronization

[mayankfz]

Summary

Enable ACL confidential VM boot and harden Azure time synchronization
doc - https://microsoftapc-my.sharepoint.com/:w:/r/personal/mayansingh_microsoft_com/_layouts/15/Doc.aspx?sourcedoc=%7Bebae3a07-f597-4c65-96f0-143459146fb9%7D&action=default

Summary
Adds Azure Confidential VM support and hardens Azure time synchronization.

• Adds TPM2 dependencies required for encrypted ROOT auto-unlock.
• Preserves ignition-disks -> decrypt-root -> initrd-root-device ordering.
• Uses Hyper-V PTP when available without delaying or breaking non-PTP VMs.
• Keeps time.windows.com as the documented public fallback.
• Makes Chrony image customization fail clearly when expected inputs drift.

Change Log

• Enable ACL confidential VM boot and harden Azure time synchronization

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

https://dev.azure.com/mariner-org/ACL/_workitems/edit/23679

Test Methodology

Test details:

• Normal Azure VM boot and reboot passed.
• Chrony passed with and without ptp_hyperv.
• Encrypted ROOT first boot passed on AMD SEV-SNP.
• Azure vTPM enrollment using PCR 7 passed.
• Two unattended reboots passed after removing all passphrase slots.
• Intel TDX validation will run through the AKS image pipeline.

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Jiri Appl (jiria)]

Is this all we were missing to unlock encrypted rootfs on boot?

[mayankfz]

Is this all we were missing to unlock encrypted rootfs on boot?

These were the remaining blockers in our validation, the TPM2 libraries needed for auto-unlock and the decrypt-root ordering fix. The LUKS/dracut support was already added in #33. With these changes, encrypted ROOT now unlocks and boots successfully in our CVM test.

[Jiri Appl (jiria)]

While this is still in draft — could you fill in the description before marking it ready? Right now it's the unmodified template: no change-type ticked, empty "Test details:", and no linked issue.

Given this touches initramfs root decryption and time sync on every Azure image, the things I'd most want recorded are:

• The actual Found ordering cycle journal lines that motivated the bootengine patch. That's the whole justification for the ordering change, and without it the next person to touch these units is flying blind.
• Boot results on both an encrypted CVM (the fix path) and a non-CVM (the regression path).
• chronyc sources on a PTP-capable machine and on one without /dev/ptp_hyperv.

Also worth revisiting the title — "Add ACL CVM support" undersells it a bit, since four of the seven files change chrony behaviour on every Azure image rather than just CVMs.

[Copilot]

🟡 Changes recommended

The initramfs TPM2 library inclusion is currently /usr/lib64-only, which can omit required libs on non-lib64 layouts and break LUKS root auto-unlock.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR enables Azure Confidential VM boot support (TPM-backed LUKS root auto-unlock) and hardens Azure time synchronization by making Hyper-V PTP optional/non-blocking while retaining a public NTP fallback.

Changes:

• Add a chrony helper (chrony-azure-ptp) and systemd drop-in to generate PTP chrony config at service start when /dev/ptp_hyperv exists.
• Add TPM2 (tss2) shared libraries to the initramfs explicit install list to support runtime dlopen() by systemd-cryptsetup.
• Patch bootengine’s decrypt-root.service ordering to run before initrd-root-device.target.

File summaries

File	Description
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh	Adjusts chronyd unit customization, removes unsupported ExecStopPost helper, and installs the Azure PTP helper + drop-in.
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf	Switches to include Azure runtime-generated chrony config and reintroduces time.windows.com fallback.
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf	Updates chronyd drop-in to avoid waiting for Hyper-V PTP while still ordering after it when present, and runs PTP config generator.
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp	New helper script that writes/removes the PTP refclock config under /run/chrony-azure/conf.d.
build_library/rpm/additional_files/99-acl.conf	Adds explicit TPM2 shared library inclusion for initramfs root auto-unlock support.
acl/SPECS/bootengine/bootengine.spec	Bumps release and applies new decrypt-root ordering patch.
acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch	Ensures decrypt-root runs before initrd-root-device.target to preserve firstboot ordering.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.