test(vm_extensions): add AzureSecurityLinuxAgent boot validation test

[vtahiliani]

What

Adds a boot validation test for the Azure Security Linux Agent VM extension
(Microsoft.Azure.Security.Monitoring.AzureSecurityLinuxAgent), onboarding the
publisher to Functional Validation.

Details

• New dedicated suite AzureSecurityLinuxAgentTests subclassing
  VmExtensionTestBase (per docs/vm_extension_validation_framework.rst),
  reusing the shared install / assert-provisioned / uninstall lifecycle helpers
  — no re-implemented lifecycle logic.
• Single AzCertify-named boot validation case
  microsoft_azure_security_monitoring_azuresecuritylinuxagent_boot_validation_test:
  installs the extension with minimal inline settings, asserts
  provisioning_state == "Succeeded", verifies the installed handler version,
  confirms the VM stays reachable over SSH, then removes the extension.
• Publisher / type are class constants; version is a runbook variable
  (azure_security_linux_agent_version), not hardcoded.
• Starts at experimental maturity per the onboarding guidance.
• Adds runbook lisa/microsoft/runbook/azure_security_linux_agent.yml to run
  only this case (includes a maturity: experimental criterion so it is
  approved past LISA's implicit stable gate).

Design note — prerequisites

The heavier AzSecPack/AutoConfig prerequisites in azsecpack.py (managed
identity, azure-mdsd, AMA-first, enableGenevaUpload/enableAutoConfig,
AutoConfig-scope subscription) are AutoConfig-scenario requirements, not the
extension's minimal install contract. A boot validation only needs a supported
distro + waagent + connectivity, so this test does a plain CRP install and
leaves the deep autoconfig/service coverage to the existing verify_azsecpack.

Testing

• black, isort, flake8 clean.
• lisa list -t case -r lisa/microsoft/runbook/azure_security_linux_agent.yml
  discovers and selects the case (selected count: 1).
• End-to-end Azure run pending (requires a subscription; extension is expected
  to provision on a supported Linux image — verify on first real run).

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Adds a new VM extension boot validation test suite to onboard Microsoft.Azure.Security.Monitoring.AzureSecurityLinuxAgent into the VM extension validation framework, plus a dedicated runbook to select only this case at experimental maturity.

Changes:

• Introduces AzureSecurityLinuxAgentTests (subclassing VmExtensionTestBase) with a single boot-validation test case that installs the extension with minimal settings and validates provisioning/SSH reachability.
• Adds a dedicated runbook to run only the new boot validation case, including an explicit maturity: experimental criterion for selection.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
lisa/microsoft/testsuites/vm_extensions/runtime_extensions/azure_security_linux_agent.py	New dedicated VM extension boot validation suite/case for Azure Security Linux Agent.
lisa/microsoft/runbook/azure_security_linux_agent.yml	New runbook to run only the Azure Security Linux Agent boot validation case.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

lisa/microsoft/runbook/azure_security_linux_agent.yml:23

• Major: This comment block implies the case always skips without a case-visible version variable, but if the handler is already installed the case will still run (it validates the existing instance). Please reword to clarify that a version is only needed when installing, and keep the 'is_case_visible' note focused on forwarding variables to the test.

  #   -v azure_security_linux_agent_version:<version>
  # (or the generic -v extension_version:<version>). The case is skipped
  # when neither is set. 'is_case_visible: true' is required so the value
  # is passed into the test case's 'variables' dict at runtime (LISA only
  # forwards case-visible variables); without it the case always skips.

lisa/microsoft/runbook/azure_security_linux_agent.yml:11

• Major: The runbook header says the version variable is always required and the test is skipped when empty, but the test case can validate an already-installed handler without needing any version variable. Please update this comment to reflect that the version is only required for the install path (handler not already present).

This issue also appears on line 19 of the same file.

# The version variable is REQUIRED; the test is skipped when it is empty.

lisa/microsoft/testsuites/vm_extensions/runtime_extensions/azure_security_linux_agent.py:99

• Minor: The PR description says the case "then removes the extension", but this code path returns early when an existing platform-managed instance is detected and does not uninstall it. Consider updating the PR description to reflect the "validate in place" behavior already documented in the test case docstring.

            self._assert_vm_reachable(node)
            return

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

lisa/microsoft/testsuites/vm_extensions/runtime_extensions/azure_security_linux_agent.py:159

• The wait loop uses time.sleep() and, on timeout, logs "proceeding" but then returns a transient provisioning state that will immediately fail _assert_provisioned() with a less-informative assertion. Use LISA's bounded sleep helper and raise a clear timeout error when the state never becomes terminal.

            if time.monotonic() >= deadline:
                log.info(
                    f"Extension '{name}' still in transient state "
                    f"'{provisioning_state}' after {timeout}s; proceeding."
                )

lisa/microsoft/testsuites/vm_extensions/runtime_extensions/azure_security_linux_agent.py:133

• The default timeout/interval values are test-behavior magic numbers. Add inline units/comments (or promote to named constants) so it's clear these are seconds and can be tuned intentionally.

        timeout: int = 600,
        interval: int = 20,

lisa/microsoft/runbook/azure_security_linux_agent.yml:23

• The runbook comments currently state the version variable is always required / the case always skips without is_case_visible. That’s not accurate because the test has an "already installed" validation path that does not require a version. Please update the comments to match the test behavior so users don't assume a version is mandatory in all cases.

  # REQUIRED: pass on the command line with
  #   -v azure_security_linux_agent_version:<version>
  # (or the generic -v extension_version:<version>). The case is skipped
  # when neither is set. 'is_case_visible: true' is required so the value
  # is passed into the test case's 'variables' dict at runtime (LISA only