Unable to reference `image_urn` when the image is in a Shared Image Gallery

[bender-the-greatest]

👻 Brief Description

I am unable to reference image_urn when the image is in a Shared Image Gallery.

Version

I am not sure, kitchen diagnose is not reporting the version. Here is the driver portion of kitchen diagnose:

timestamp: 2022-05-18 21:53:54 UTC
kitchen_version: 2.11.2
plugins:
  driver:
    Azurerm:
      class: Kitchen::Driver::Azurerm
      version: 
      api_version: 2

Environment

Attempting to run Chef tests against the latest image version in a shared gallery I control, although this issue can be reproduced with kitchen create.

Scenario

I need to be able to use Test Kitchen to create Azure VMs using the latest image available through a Shared Image Gallery.

Steps to Reproduce

Here is the relevant kitchen.yml which does not work when the image is available through a Shared Image Gallery:

driver:
  name: azurerm
  image_urn: MyCompanyName:MyImageOffer:MyImageSku:latest

Running kitchen create attempting to reference the image by URN above will produce the error below.

Expected Result

I am expecting my instance to be created from my organization's machine image.

Actual Result

There is a much longer error in the stacktrace but here is the relevant part (sanitized to remove actual org info and formatted for readability):

{
  "code" => "InvalidTemplateDeployment", "message" => "The template deployment 'DEPLOY_ID' is not valid according to the validation procedure. The tracking id is 'TRACKING_ID'. See inner errors for details.", "details" => [{
    "code" => "InvalidParameter",
    "target" => "imageReference",
    "message" => "The following list of images referenced from the deployment template are not found: Publisher: MyCompanyName, Offer: MyImageOffer, Sku: MyImageSku, Version: latest. Please refer to https://docs.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage for instructions on finding available images."
  }]
}

[bender-the-greatest]

I believe I found the solution. Since it appears there is no searching going on for non-marketplace images with image_urn, it appears image_id works if you provide the resource ID to:

1. The managed image itself (assumes you have direct permission to access it)
2. The image definition from the Shared Image Gallery
   • Grabs latest
3. The image definition version from the Shared Image Gallery
   • Pins to that particular image version until the resource ID is updated to use a different image version

The documentation is very unclear on this for image_id, as it seems to imply only the first case above is supported.