TRT-2925: Revert "CORS-4441: Bump Azure Marketplace Images" (#10802)

[redhat-chai-bot]

Revert of #10802

This reverts the merge commit for #10802 on release-5.0.

Why

Payload 5.0.0-0.ci-2026-08-25-204245 was rejected. The blocking job aggregated-azure-ovn-upgrade-5.0-major fails because the MCO machine-config ClusterOperator goes Degraded=True during a 4.22→5.0 upgrade.

Root cause: PR #10802 (CORS-4441) removed the hyperVGen1 entries from the Azure marketplace image JSON files. During upgrade, the MCO bootimage controller calls getTargetImageFromStream, which finds imageSet.Gen1 == nil and returns a hard error:

no Gen1 Azure marketplace image available for architecture x86_64

The installer PR landed ahead of a companion MCO fix that would gracefully skip Gen1 reconciliation when the entry is absent. The PR's presubmits only ran fresh Gen2 installs — no upgrade-from-4.22 job exercising Gen1-booted MachineSets was tested.

Impact

• 5.0 CI payload stream blocked (~6 hours since last accepted payload)
• All Azure upgrade paths from 4.22→5.0 fail

Tracking

Jira: TRT-2925

---

AI-generated. Review for accuracy.

@sdodson requested in Slack thread

Summary by CodeRabbit

• Updates
  • Updated Azure marketplace metadata for RHEL 9 and RHEL 10 images across ARM64 and x86_64 architectures.
  • Added distinct Hyper-V Gen1 and Gen2 image variants for x86_64.
  • Updated marketplace image selection to use architecture and release information while retaining compatibility with the requested OpenShift release.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@redhat-chai-bot: This pull request references TRT-2925 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Revert of #10802

This reverts the merge commit for #10802 on release-5.0.

Why

Payload 5.0.0-0.ci-2026-08-25-204245 was rejected. The blocking job aggregated-azure-ovn-upgrade-5.0-major fails because the MCO machine-config ClusterOperator goes Degraded=True during a 4.22→5.0 upgrade.

Root cause: PR #10802 (CORS-4441) removed the hyperVGen1 entries from the Azure marketplace image JSON files. During upgrade, the MCO bootimage controller calls getTargetImageFromStream, which finds imageSet.Gen1 == nil and returns a hard error:

no Gen1 Azure marketplace image available for architecture x86_64

The installer PR landed ahead of a companion MCO fix that would gracefully skip Gen1 reconciliation when the entry is absent. The PR's presubmits only ran fresh Gen2 installs — no upgrade-from-4.22 job exercising Gen1-booted MachineSets was tested.

Impact

• 5.0 CI payload stream blocked (~6 hours since last accepted payload)
• All Azure upgrade paths from 4.22→5.0 fail

Tracking

Jira: TRT-2925

---

AI-generated. Review for accuracy.

@sdodson requested in Slack thread

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c8f67a5-1fe9-4215-af3e-f742f41cfce9

📥 Commits

Reviewing files that changed from the base of the PR and between c31e9ef and fd05c2a.

📒 Files selected for processing (4)

• data/data/coreos/marketplace/coreos-rhel-10.json
• data/data/coreos/marketplace/coreos-rhel-9.json
• hack/rhcos/populate-marketplace-imagestream.go
• pkg/rhcos/marketplace/azure/azure.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change updates Azure RHEL 9 and RHEL 10 marketplace SKUs for ARO4 images. Azure image lookup no longer filters candidates by RHEL major version. Marketplace population no longer passes a RHEL major version.

Changes

Azure marketplace image selection

Layer / File(s)	Summary
Remove RHEL-major lookup filtering pkg/rhcos/marketplace/azure/azure.go	Azure lookup methods no longer accept RHEL-major input. Candidate selection uses release version ordering. ARO SKU parsing returns Gen1 and Gen2 SKUs without version validation.
Update marketplace population wiring hack/rhcos/populate-marketplace-imagestream.go	RHEL stream configuration no longer stores rhelMajor. Azure population calls Populate with architecture and release only.
Update ARO4 marketplace metadata data/data/coreos/marketplace/coreos-rhel-9.json, data/data/coreos/marketplace/coreos-rhel-10.json	RHEL 9 and RHEL 10 metadata use the updated ARM, Hyper-V Gen1, and Hyper-V Gen2 ARO4 SKUs and versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fd05c

This PR reverts the marketplace image change; no actionable merge-blocking risk remains based on the supplied evidence.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change as reverting the Azure Marketplace Images update from PR #10802. It also includes the tracking issue TRT-2925.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes no test paths and adds no Ginkgo title calls. The changed Go files contain no Ginkgo imports or It/Describe/Context/When declarations. The date-like values are Azure marketpla…
Test Structure And Quality	✅ Passed	PASS: The pull request changes two marketplace JSON files and two production Go files only. The exact diff contains no *_test.go files, no Ginkgo test blocks, and no cluster-test setup, cleanup, waits…
Microshift Test Compatibility	✅ Passed	PASS — The pull request changes only two Azure marketplace JSON files and two Go implementation files. The exact parent-to-HEAD diff contains no *_test.go files, Ginkgo It/Describe/Context/When declar…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes two JSON metadata files and two non-test Go implementation files. The exact HEAD^..HEAD diff adds no Ginkgo declarations such as It, Describe, Context, or When, and intr…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The commit changes only Azure marketplace metadata and the RHCOS marketplace image population/lookup code. The exact diff contains no deployment manifests, operator/controller scheduling logic, …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request adds no process-level stdout writes. Its Go changes only alter Azure lookup arguments and SKU parsing; the only changed executable is the documented marketplace population helpe…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only two marketplace JSON files and two non-test Go source files. The exact diff adds no Ginkgo declarations such as It, Describe, Context, or When, and it adds no test …
No-Weak-Crypto	✅ Passed	PASS: The pull request changes Azure marketplace metadata and image-selection logic only. The changed Go files add no crypto imports, weak algorithm identifiers, cryptographic APIs, custom crypto, or …
Container-Privileges	✅ Passed	PASS. The commit changes two Azure marketplace metadata JSON files and two Go marketplace-lookup files. The diff introduces no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, `allowPri…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds no sensitive logging. The diff only changes Azure marketplace SKUs/versions, removes the RHEL-major filter, and updates method arguments. It adds no log calls or credential…

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (2 skipped: 2 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes no test paths and adds no Ginkgo title calls. The changed Go files contain no Ginkgo imports or It/Describe/Context/When declarations. The date-like values are Azure marketplace image versions, not test names.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes two marketplace JSON files and two production Go files only. The exact diff contains no *_test.go files, no Ginkgo test blocks, and no cluster-test setup, cleanup, waits, or assertions to assess. The Test Structure and Quality check is therefore inapplicable.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request changes only two Azure marketplace JSON files and two Go implementation files. The exact parent-to-HEAD diff contains no *_test.go files, Ginkgo It/Describe/Context/When declarations, or new e2e tests. The MicroShift Test Compatibility check therefore does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes two JSON metadata files and two non-test Go implementation files. The exact HEAD^..HEAD diff adds no Ginkgo declarations such as It, Describe, Context, or When, and introduces no new e2e tests. The SNO compatibility check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The commit changes only Azure marketplace metadata and the RHCOS marketplace image population/lookup code. The exact diff contains no deployment manifests, operator/controller scheduling logic, pod anti-affinity, topology spread constraints, replica settings, node selectors, tolerations, or PDBs. The modified Go files also have no Kubernetes or scheduling imports, so the check is not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request adds no process-level stdout writes. Its Go changes only alter Azure lookup arguments and SKU parsing; the only changed executable is the documented marketplace population helper, not an OTE test binary. Existing log.Printf/log.Fatalln calls use Go's default os.Stderr, and logrus also defaults to os.Stderr. The JSON changes contain no code.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only two marketplace JSON files and two non-test Go source files. The exact diff adds no Ginkgo declarations such as It, Describe, Context, or When, and it adds no test files. Therefore the IPv4 and disconnected-network test compatibility conditions do not apply.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request changes Azure marketplace metadata and image-selection logic only. The changed Go files add no crypto imports, weak algorithm identifiers, cryptographic APIs, custom crypto, or secret/token comparisons. The added JSON values contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage.

Full details: Container-Privileges

Explanation

PASS. The commit changes two Azure marketplace metadata JSON files and two Go marketplace-lookup files. The diff introduces no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or container security-context settings. It does not add a container or Kubernetes manifest.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request adds no sensitive logging. The diff only changes Azure marketplace SKUs/versions, removes the RHEL-major filter, and updates method arguments. It adds no log calls or credential/token output. The existing logs emit public marketplace identifiers, release/version strings, and errors; those log statements are unchanged, and the only logging statement removed reports the RHEL-major filter.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn-fips
/test e2e-azure-default-config
/test e2e-azure-ovn
/test e2e-azure-ovn-shared-vpc
/test e2e-azurestack
/test e2e-aws-ovn

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[redhat-chai-bot]

/retest-required

Both failures are Azure infrastructure issues unrelated to this revert:

• e2e-azure-default-config: Azure AD service principal provisioning flake (Resource does not exist or one of its queried reference-property objects are not present)
• e2e-azure-ovn-shared-vpc: Missing shared VNet resource (do-not-delete-shared-vnet-westus2 not found, 404)

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/retest-required

All 4 failures are Azure infrastructure issues unrelated to this revert (marketplace image JSON restore):

• e2e-azure-default-config: Azure AD service principal provisioning flake
• e2e-azure-ovn-shared-vpc: Missing shared VNet resource (404)
• e2e-azure-ovn: Boskos lease update failures (502/503)
• e2e-azurestack: AzureStack install failure + lease 502s

---

AI-generated. Review for accuracy.

[openshift-ci]

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azurestack	fd05c2a	link	false	/test e2e-azurestack
ci/prow/e2e-azure-ovn-shared-vpc	fd05c2a	link	false	/test e2e-azure-ovn-shared-vpc
ci/prow/e2e-azure-default-config	fd05c2a	link	false	/test e2e-azure-default-config

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.