Change performance diagnostics to use Managed Identity

[lukeluong1212]

Add MSI support for performance diagnostics and remove SAS usage per Security Wave requirements.

Notes:

• This will still not work until the MSI support for Azure Performance Diagnostics is released. The work for that is still on-going.
• The VM will need to be preconfigured with these role assignments for Storage Account at Subscription level so it can inherit the permissions:
  - Storage Account Contributor
  - Storage Account Blob Contributor
  - Storage Account Table Contributor

[LiliDeng]

@lukeluong1212 please change the test priority back to 1 in

lisa/microsoft/testsuites/vm_extensions/azureperformancediagnostics.py

Line 63 in 08b810d

priority=5,

[LiliDeng]

@lukeluong1212 let know which package version need to be updated, thanks!

[lukeluong1212]

@lukeluong1212 please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Pull request overview

Updates the Azure Performance Diagnostics VM extension test to prefer system-assigned Managed Identity (MSI) authentication instead of using Storage Account keys/SAS, aligning with the stated Security Wave direction.

Changes:

• Switches the VM extension protected settings to use authenticationType: SystemManagedIdentity and assigns a system identity to the VM.
• Removes Storage Account key retrieval logic in favor of MSI-based access.
• Expands the supported Linux distro major versions (adds Ubuntu 22 and CBLMariner/AzureLinux 3).

[LiliDeng]

AI Test Case Selection

Selected 53 test case(s): verify_azuremonitoragent_linux,verify_application_health_extension,verify_azsecpack,verify_azure_disk_encryption_enabled,verify_azure_disk_encryption_provisioned,verify_key_vault_extension,verify_asr_by_cvt,verify_asr_by_cvt_no_extension,verify_vm_extension_install_uninstall,verify_vm_assess_patches,verify_vm_install_patches,verify_metricsextension,verify_azure_network_watcher,microsoft_azure_extensions_customscript_boot_validation_test,verify_public_script_run,verify_second_public_script_run,verify_script_in_both_settings_failed,verify_public_script_protected_settings_run,verify_public_script_without_command_run,verify_base64_script_with_command_run,verify_public_script_with_base64_script_run,verify_public_script_with_gzip_base64_script_run,verify_private_script_without_sas_run_failed,verify_private_script_with_storage_credentials_run,verify_private_sas_script_run,verify_public_python_script_run,microsoft_cplat_core_runcommandlinux_boot_validation_test,verify_public_script_without_command_run_failed,verify_base64_script_with_command_run_failed,microsoft_cplat_core_runcommandhandlerlinux_boot_validation_test,verify_existing_script_run,verify_custom_script_run,verify_script_run_with_named_parameter,verify_script_run_with_unnamed_parameter,verify_script_run_with_protected_parameter,verify_public_uri_script_run,verify_private_uri_script_run_failed,verify_sas_uri_script_run,verify_script_run_with_timeout,verify_script_run_with_timeout_failed,verify_script_run_with_valid_user,verify_script_run_with_invalid_user,verify_valid_password_run,verify_openssh_key_run,verify_password_and_ssh_key_run,verify_no_password_and_ssh_key_run_failed,verify_pem_certificate_ssh_key_run,verify_ssh2_key_run,verify_remove_username_run,verify_valid_expiration_run,verify_vmsnapshot_extension,verify_exclude_disk_support_restore_point,verify_vm_agent

Marketplace image: suse sles-15-sp6 gen2 latest

Result: Failed

View full logs in Azure DevOps