Add pipeline for Azure community gallery image publishing

[mboersma]

Change description

Replaces the Azure DevOps pipeline scripts with a new flow that publishes to a Community gallery.

Related issues

• Refs Share VM images via Azure Compute Galleries cluster-api-provider-azure#4163
• Refs Add terraform for Azure community image gallery kubernetes/k8s.io#7461
• Fixes Azure Pipeline: use managed identity #1011
• Fixes Support Azure Packer plugin 2.x #1259

Additional context

This is simpler in the end than publishing to Azure Marketplace, and agrees with what we recommend in the CAPZ book. Additionally, the current Azure Packer plugin won't support the SAS key generation necessary to publish VHDs via the existing pipeline, and internal security requirements have made that flow problematic.

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[mboersma]

This actually passed CI, modulo two unrelated flakes.

[mboersma]

/retitle Add pipeline for Azure community gallery image publishing
/retest

[mboersma]

This case is used in the ADO pipelines now, to avoid trying to log in again. Instead, we use managed ID-compatible DevOps tasks such as AzureCLI@2, which provides a bash shell with az already logged in according to credentials specified in a Service Connection defined in ADO.

[jackfrancis]

/lgtm

[mboersma]

I squashed the commits, should be ready to go.

[jackfrancis]

/lgtm

[nawazkh]

/test pull-azure-vhds

[mboersma]

/retest

Flake (I think) with windows-2025:

�[0;32m    azure-arm.sig-windows-2025-containerd: TASK [Optimise powershell] *****************************************************�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd: An exception occurred during task execution. To see the full traceback, use -vvv. The error was:    at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd: fatal: [default]: FAILED! => {"changed": false, "msg": "internal error: failed to become user 'SYSTEM': Exception calling \"CreateProcessAsUser\" with \"9\" argument(s): \"CreateProcessWithTokenW() failed (The process creation has been blocked, Win32ErrorCode 367)\""}�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd:�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd: PLAY RECAP *********************************************************************�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd: default                    : ok=2    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0�[0m
�[0;32m    azure-arm.sig-windows-2025-containerd:�[0m
�[1;32m==> azure-arm.sig-windows-2025-containerd: retry limit reached.�[0m

This PR doesn't really touch any code that would be relevant here.

[mboersma]

/assign @AverageMarcus @drew-viles @jsturtevant

I've been using this branch in the actual pipeline for a while, and it's working well.

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from averagemarcus. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• images/capi/packer/azure/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment