feat: add azure variant of ares golden image and update source repo by l50 · Pull Request #249 · dreadnode/ares

l50 · 2026-04-30T22:10:24Z

Key Changes:

Introduced Azure-specific golden image template with full red-team toolchain and GPU support
Updated AWS template to use unified ares repository for nimbus_range collection
Improved Ansible collection copy logic for AWS image builder
Ensured feature parity and easier maintenance between AWS and Azure images

Added:

Azure golden image template - Added ares-golden-azure directory containing README.md and warpgate.yaml to provide an Azure-specific variant of the Ares golden image. This includes documentation, provisioning steps, NVIDIA GPU support, and red-team tool installation using the nimbus_range Ansible collection. The template supports publishing to Azure Compute Gallery with all required resource and identity settings.

Changed:

Source repository and branch for nimbus_range - Updated AWS ares-golden-image/warpgate.yaml to pull the nimbus_range collection from the dreadnode/ares repository at the feat/more-attack-cov branch instead of the old repository, ensuring alignment with Azure and consolidated feature set.
Ansible collection copy logic - Modified the provisioner in the AWS template to copy only the ansible subdirectory from the source repo into the target Ansible collection path, matching the new repo structure and preventing unnecessary files from being copied.

…ce repo **Changed:** - Pin setuptools to version <81 in the noPac venv to ensure pkg_resources is available for impacket compatibility, preventing import errors in privesc_tools Ansible role - Update nimbus_range source in warpgate template to point to the new ares repository and checkout the feat/more-attack-cov branch for improved attack coverage - Adjust file copy command in warpgate provisioner to correctly copy the ansible directory contents from the new repository layout

…late **Changed:** - Updated Azure VM size from Standard_D4s_v3 to Standard_D2as_v7 to optimize resource usage in the warpgate template - Removed unused or redundant Azure target properties: resource_group, location, gallery, gallery_image_definition, os_type, and identity_id to streamline the template configuration

…and gpu support **Added:** - Clone and install nimbus_range red team Ansible collection from GitHub for attack tooling - Install NVIDIA driver and CUDA toolkit to enable GPU-accelerated hashcat and tools - Add shell provisioner to install all red team tools and Alloy telemetry agent via Ansible playbook - Document required Azure quota and Kali marketplace terms for GPU and image provisioning in README **Changed:** - Switch base image from Ubuntu 22.04 LTS to kali-linux/kali/kali-last for red team parity - Update warpgate.yaml metadata: bump version to 1.0.0, expand description, and add red team tags - Refactor provisioners to use shell for Ansible playbook install due to Azure customizer length limits - Update Azure target configuration to use GPU VM size (Standard_NC4as_T4_v3) and relevant tags - README now describes feature parity with AWS AMI and lists included red team capabilities **Removed:** - Remove smoke.yml Ansible playbook and related minimal provisioning steps - Drop prior Ubuntu-specific and smoke-test tags and metadata from warpgate.yaml - Remove basic red team tool install from initial provisioner in favor of full toolchain setup

**Changed:** - Set default vm_size to Standard_D4s_v3 for improved compatibility and cost efficiency; added a commented GPU option for reference in warpgate.yaml

…mplate **Changed:** - Updated Kali Marketplace plan in documentation to use `kali-2026-1` instead of `kali-last` for improved accuracy and consistency - README.md - Changed the Azure VM image sku in the template configuration from `kali-last` to `kali-2026-1` to match the current marketplace offering - warpgate.yaml

**Changed:** - Replace warpgate 'sources' and 'type: file' steps with a single shell provisioner that securely clones the nimbus_range repository using a git credential helper, avoiding token exposure and Azure Image Builder timeouts caused by copying large file trees. Updated inline documentation to explain rationale for the shell-based approach. - Remove redundant file provisioner and adjust steps to clone, copy, and clean up the ansible collection in one sequence.

**Changed:** - Bump WARPGATE_VERSION from v4.4.0 to v4.6.0 in build-and-push-templates.yaml, test-template-builds.yaml, and validate-templates.yaml to use latest Warpgate release in CI workflows

Copilot

Pull request overview

Adds an Azure-specific “Ares golden image” Warpgate template and aligns the existing AWS golden image template to pull the nimbus_range Ansible collection from the unified dreadnode/ares repo, alongside bumping the Warpgate version used in CI workflows.

Changes:

Added ares-golden-azure template (Warpgate YAML + README) to build/publish a Kali-based Azure golden image with the full toolchain and GPU support.
Updated ares-golden-image (AWS) to source nimbus_range from dreadnode/ares (feat/more-attack-cov) and copy only the ansible/ subtree into the collection path.
Bumped CI workflows’ WARPGATE_VERSION from v4.4.0 to v4.6.0.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`warpgate-templates/templates/ares-golden-image/warpgate.yaml`	Switches `nimbus_range` source repo/ref and updates collection copy behavior to match the new repo layout.
`warpgate-templates/templates/ares-golden-azure/warpgate.yaml`	Introduces an Azure Image Builder template provisioning Ansible + the Ares toolchain, with Azure publishing configuration.
`warpgate-templates/templates/ares-golden-azure/README.md`	Documents Azure prerequisites and build invocation for the new template.
`.github/workflows/validate-templates.yaml`	Updates Warpgate version used for template validation.
`.github/workflows/test-template-builds.yaml`	Updates Warpgate version used for test builds.
`.github/workflows/build-and-push-templates.yaml`	Updates Warpgate version used for build/push pipeline.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-05-01T00:12:48Z

+version: latest
+
+base:
+  image: kali-linux/kali/kali-last:latest


base.image is using a floating :latest tag. All other warpgate templates in this repo pin base images by digest (e.g. ares-base, ares-cli, ares-golden-image), which improves reproducibility and avoids surprise rebuild diffs. Please pin this Kali base image to a specific digest (and optionally keep a human-readable tag alongside it if supported).

Suggested change

image: kali-linux/kali/kali-last:latest

image: kali-linux/kali/kali-last:latest@sha256:<REPLACE_WITH_VERIFIED_KALI_IMAGE_DIGEST>

Copilot · 2026-05-01T00:12:49Z

+targets:
+  - type: azure
+    subscription_id: 70a9c8a4-6bc6-4a48-ae24-27996cea8c02
+    location: centralus
+    resource_group: WARPGATE-TEST-RG
+    gallery: warpgateTestGallery


This template only defines an azure target. The repo CI workflows (e.g. test-template-builds.yaml / build-and-push-templates.yaml) assume non-AMI templates can be built as containers and will attempt warpgate build ... --registry ... --push unless explicitly skipped. As-is, this new template is likely to break those workflows. Either add a container target (if feasible) or update the workflows’ template discovery logic to skip templates that don’t include a container target (similar to the existing AMI-only skip).

Copilot · 2026-05-01T00:12:49Z

+    subscription_id: 70a9c8a4-6bc6-4a48-ae24-27996cea8c02
+    location: centralus
+    resource_group: WARPGATE-TEST-RG
+    gallery: warpgateTestGallery
+    gallery_image_definition: ares-golden-azure
+    identity_id: /subscriptions/70a9c8a4-6bc6-4a48-ae24-27996cea8c02/resourcegroups/warpgate-test-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/warpgate-aib-uami
+    vm_size: Standard_D4s_v3


The Azure target configuration hard-codes a specific subscription ID, resource group, gallery name, and managed identity resource ID. This makes the template hard to reuse across environments and may unintentionally expose internal Azure identifiers in a public repo. Prefer parameterizing these fields via variables (e.g. ${AZURE_SUBSCRIPTION_ID}, ${AZURE_RESOURCE_GROUP}, ${AZURE_IDENTITY_ID}) and documenting the required values in the README, or clearly marking these as placeholders.

Suggested change

subscription_id: 70a9c8a4-6bc6-4a48-ae24-27996cea8c02

location: centralus

resource_group: WARPGATE-TEST-RG

gallery: warpgateTestGallery

gallery_image_definition: ares-golden-azure

identity_id: /subscriptions/70a9c8a4-6bc6-4a48-ae24-27996cea8c02/resourcegroups/warpgate-test-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/warpgate-aib-uami

vm_size: Standard_D4s_v3

subscription_id: ${AZURE_SUBSCRIPTION_ID}

location: ${AZURE_LOCATION}

resource_group: ${AZURE_RESOURCE_GROUP}

gallery: ${AZURE_GALLERY_NAME}

gallery_image_definition: ares-golden-azure

identity_id: ${AZURE_IDENTITY_ID}

vm_size: ${AZURE_VM_SIZE}

Copilot · 2026-05-01T00:12:49Z

+  # Install NVIDIA drivers for GPU-accelerated hashcat on NCas T4 v3 (T4 GPU)
+  - type: shell
+    inline:
+      - apt-get update
+      - apt-get install -y --no-install-recommends nvidia-driver firmware-misc-nonfree


This step installs nvidia-driver/firmware, but the later CUDA step also installs nvidia-driver again alongside headers/dkms/CUDA. This duplication increases build time and failure surface. Consider consolidating into a single install step (or keep this step as only a probe like nvidia-smi without installing packages twice).

Suggested change

# Install NVIDIA drivers for GPU-accelerated hashcat on NCas T4 v3 (T4 GPU)

- type: shell

inline:

- apt-get update

- apt-get install -y --no-install-recommends nvidia-driver firmware-misc-nonfree

# Probe for NVIDIA tooling during image build; the actual driver/CUDA

# installation happens later in a single consolidated step.

- type: shell

inline:

Copilot · 2026-05-01T00:12:49Z

+Provisioned manually (one-time):
+
+- Resource group `warpgate-test-rg` in `eastus`
+- Compute Gallery `warpgateTestGallery`
+- Image definition `ares-golden-azure` (Linux, Generalized, HyperV V2,
+  publisher=`dreadnode`, offer=`ares`, sku=`golden`)
+- User-assigned managed identity `warpgate-aib-uami`
+  with Contributor on `warpgate-test-rg`


The prerequisites here don’t match the checked-in template values: README says resource group warpgate-test-rg in eastus, while warpgate.yaml uses resource_group: WARPGATE-TEST-RG and location: centralus. Please align the README with the template (or explicitly state which values are examples/placeholders and where they must match).

Suggested change

Provisioned manually (one-time):

- Resource group `warpgate-test-rg` in `eastus`

- Compute Gallery `warpgateTestGallery`

- Image definition `ares-golden-azure` (Linux, Generalized, HyperV V2,

publisher=`dreadnode`, offer=`ares`, sku=`golden`)

- User-assigned managed identity `warpgate-aib-uami`

with Contributor on `warpgate-test-rg`

Provisioned manually (one-time). These values match the checked-in

`warpgate.yaml` and should be kept in sync if the template values change:

- Resource group `WARPGATE-TEST-RG` in `centralus`

- Compute Gallery `warpgateTestGallery`

- Image definition `ares-golden-azure` (Linux, Generalized, HyperV V2,

publisher=`dreadnode`, offer=`ares`, sku=`golden`)

- User-assigned managed identity `warpgate-aib-uami`

with Contributor on `WARPGATE-TEST-RG`

Copilot · 2026-05-01T00:12:50Z


 env:
-  WARPGATE_VERSION: "v4.4.0"
+  WARPGATE_VERSION: "v4.6.0"


WARPGATE_VERSION was bumped to v4.6.0, but the JSON schema download later in this workflow is still hard-coded to v4.4.0 (schema_url = .../v4.4.0/schema/warpgate-template.json). This can lead to misleading schema validation warnings/errors when templates use fields added/changed in newer versions. Consider constructing schema_url from WARPGATE_VERSION (or updating it to v4.6.0) so schema validation stays in sync.

Suggested change

WARPGATE_VERSION: "v4.6.0"

WARPGATE_VERSION: "v4.6.0"

WARPGATE_SCHEMA_URL: "https://raw.githubusercontent.com/warp-tech/warpgate/v4.6.0/schema/warpgate-template.json"

Copilot · 2026-05-01T00:12:50Z

 sources:
  - name: nimbus_range
    git:
-      repository: https://github.com/dreadnode/ansible-collection-nimbus_range.git
+      repository: https://github.com/dreadnode/ares.git
+      ref: feat/more-attack-cov
      depth: 1


The sources entry is still named nimbus_range, but it now clones dreadnode/ares.git. This is confusing when reading/debugging template sources (and differs from other templates that name the source after the repo, e.g. ares-cli). Consider renaming the source to ares (or similar) and updating ${sources.*} references accordingly, while keeping the destination path /tmp/nimbus_range if you want to preserve the collection path semantics.

l50 added 9 commits April 30, 2026 16:04

feat: add Azure golden image template

4c7f325

fix: update azure vm_size in warpgate template

86968e0

fix: update vm_size to Standard_D4s_v3 for ares-golden-azure template

3258b2f

**Changed:** - Set default vm_size to Standard_D4s_v3 for improved compatibility and cost efficiency; added a commented GPU option for reference in warpgate.yaml

fix: update warpgate template

336b62e

dreadnode-renovate-bot Bot added the area/templates Changes made to warpgate template configurations label Apr 30, 2026

ci: update Warpgate version to v4.6.0 in GitHub Actions workflows

9541bfa

**Changed:** - Bump WARPGATE_VERSION from v4.4.0 to v4.6.0 in build-and-push-templates.yaml, test-template-builds.yaml, and validate-templates.yaml to use latest Warpgate release in CI workflows

dreadnode-renovate-bot Bot added the area/github Changes made to GitHub Actions workflows label Apr 30, 2026

l50 requested a review from Copilot May 1, 2026 00:07

Copilot started reviewing on behalf of l50 May 1, 2026 00:07 View session

Copilot AI reviewed May 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add azure variant of ares golden image and update source repo#249

feat: add azure variant of ares golden image and update source repo#249
l50 wants to merge 10 commits intomainfrom
feat/warpgate-azure-template

l50 commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	image: kali-linux/kali/kali-last:latest
	image: kali-linux/kali/kali-last:latest@sha256:<REPLACE_WITH_VERIFIED_KALI_IMAGE_DIGEST>

	WARPGATE_VERSION: "v4.6.0"
	WARPGATE_VERSION: "v4.6.0"
	WARPGATE_SCHEMA_URL: "https://raw.githubusercontent.com/warp-tech/warpgate/v4.6.0/schema/warpgate-template.json"

Conversation

l50 commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants