feat(images): add 1p-vm-base-gen2-fips image

[binujp]

Summary

• add the Azure Linux 4.0 1P VM Base Gen2 FIPS UEFI image
• support x86_64 and aarch64 with FIPS enabled
• use package-provided cloud-init, chrony/PTP, and Hyper-V configuration
• remove all KIWI file injections and their loose configuration files
• use systemd-networkd without netplan or post-install config.sh customization
• include WALinuxAgent for Azure provisioning

Testing

• built with azldev image build 1p-vm-base-gen2-fips --arch x86_64
• passed azldev image test 1p-vm-base-gen2-fips (9 passed, 7 skipped)

AB#22820

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Dan Streetman (ddstreetmicrosoft)]

issue(blocking): I have the same concerns here as in the other PR: #18468 (review)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

base/images/images.toml:100

• This non-distroless image is registered only as a canonical build and the KIWI definition has no matching profiles, so there is no -dev variant that ships azurelinux-repos-dev. That breaks the registry contract documented at base/images/images.toml:5-27 and followed by vm-base and minimal-os. Add canonical/dev profiles and a sibling images.1p-vm-base-gen2-fips-dev entry with identical capabilities and tests.

definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/images.toml:102

• The shared suite does not run the existing VM kernel or partition checks for this image. Those tests are auto-marked image("vm-base"), and the matcher accepts only vm-base or vm-base-*; 1p-vm-base-gen2-fips therefore skips them, which explains why a machine-bootable image can report seven skips. Add a matching image-family test directory or move generic bootable-VM checks behind the machine-bootable capability.

  { name = "static-image-checks" },

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:24

• The only registered test suite is offline, so the image's defining FIPS behavior is never verified after boot. A missing FIPS initramfs path or provider/policy activation would still pass these checks even with fips=1 present. Add a booted-VM smoke test that asserts /proc/sys/crypto/fips_enabled is 1 and validates the intended crypto provider/policy.

            kernelcmdline="console=ttyS0 fips=1"

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:39

• This architecture-specific image path is unvalidated: the PR testing only built and tested x86_64, while the aarch64 branch selects a different console and EFI package set. Build and run the image tests for --arch aarch64 before claiming aarch64 support.

    <preferences arch="aarch64">

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• This local-build repository conflicts with the image registry's documented rule at base/images/images.toml:21-23, and with the existing VM definition at base/images/vm-base/vm-base.kiwi:82-92, which use the azl4-dev blob for local builds while Koji overrides it. Using PMC beta here makes local validation consume a different, potentially older package set than the rest of the image pipeline.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />