feat: provide unified Windows golden image manifest for customers

Replace byoi.yaml with a single golden-image.yaml manifest that gives
customers everything needed to create and configure a Windows Server 2022
golden image. Two methods in one file:

- Method 1 (default): Tekton pipeline installs Windows from ISO with
  sysprep (SSH, guest agent, Administrator/Administrator, vTPM).
- Method 2 (alternative): DataVolume import for users who already have
  a prepared image (HTTP, registry, PVC clone, or upload).

This addresses the review feedback to "provide the customer with exactly
what is needed, i.e. a Tekton pipeline" — single oc apply, full automation.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Ahmad-Hafe

README.md

@@ -248,52 +248,89 @@ $ podman run -e OCP_VIRT_VALIDATION_IMAGE=${OCP_VIRT_VALIDATION_IMAGE} -e DRY_RU
 
 ### Windows Testing (Optional)
 
-The validation checkup supports optional Windows VM testing. When enabled, the checkup will:
-1. Create a Windows 11 golden image using the `windows-efi-installer` Tekton pipeline
-2. Run Windows-specific tests from the tier2 test suite
+The validation checkup supports optional Windows VM testing. There are two options:
 
-#### Prerequisites for Windows Testing
-- **OpenShift Pipelines operator** must be installed on the cluster
-- **Internet access** is required to download the Windows ISO and fetch the pipeline from Artifact Hub (see [Disconnected Environments](#disconnected-environments) for air-gapped clusters)
-- **Sufficient storage** for the Windows golden image (~64GB recommended)
+#### Option 1: Customer-Managed (Apply Manifest)
 
-#### Enabling Windows Testing
-To enable Windows testing, set the `ACCEPT_WINDOWS_EULA` environment variable to `true`:
+A ready-to-use manifest is provided that creates a Windows Server 2022 golden image from scratch using a Tekton pipeline. It includes namespace, RBAC, sysprep configuration, and a PipelineRun — single `oc apply`, full automation.
+
+**Prerequisites:**
+- **OpenShift Pipelines operator** must be installed
+- **cluster-admin** access (for privileged SCC assignment)
+- **Internet access** to download the Windows ISO and fetch the pipeline from Artifact Hub (see [`disconnected/README.md`](disconnected/README.md) for air-gapped setups)
+- **Sufficient storage** (~64GB recommended for the Windows image)
+
+**Setup:**
+
+1. Apply the manifest:
+```bash
+oc apply -f manifests/windows/golden-image.yaml
+```
+2. Wait for the pipeline to complete (~1-2 hours):
+```bash
+oc get pipelinerun -n validation-os-images -w
+```
+3. Verify the DataSource is Ready:
+```bash
+oc get datasource win2k22 -n validation-os-images -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
+```
+4. Run the tool normally (no `ACCEPT_WINDOWS_EULA` needed):
+```bash
+podman run -e OCP_VIRT_VALIDATION_IMAGE=${OCP_VIRT_VALIDATION_IMAGE} ${OCP_VIRT_VALIDATION_IMAGE} generate | oc apply -f -
+```
+
+The tool detects the existing DataSource and runs Windows tests automatically. After tests complete, **nothing is deleted** — your resources remain for future runs.
+
+The manifest also includes a commented-out alternative (Method 2) for users who already have a prepared Windows image and want to import via HTTP, registry, or upload.
+
+See [`manifests/windows/golden-image.yaml`](manifests/windows/golden-image.yaml) for full details and image requirements.
+
+#### Option 2: Automated (Tool Creates Everything)
+
+The tool downloads a Windows Server 2022 ISO, runs a Tekton pipeline to install it, and creates all resources. Everything is cleaned up after tests finish.
+
+**Prerequisites:**
+- **OpenShift Pipelines operator** must be installed
+- **Internet access** to download the ISO and fetch the pipeline from Artifact Hub
+- **Sufficient storage** (~64GB recommended)
+- **`STORAGE_CLASS`** set to a valid storage class (required by the Windows setup script)
+
+**Usage:**
 ```bash
 $ podman run -e OCP_VIRT_VALIDATION_IMAGE=${OCP_VIRT_VALIDATION_IMAGE} \
     -e ACCEPT_WINDOWS_EULA=true \
+    -e STORAGE_CLASS=<your-storage-class> \
     ${OCP_VIRT_VALIDATION_IMAGE} generate
 ```
 
 **Note:** By setting `ACCEPT_WINDOWS_EULA=true`, you acknowledge acceptance of Microsoft's End User License Agreement for Windows.
 
-#### Optional Windows Parameters
+**Optional Parameters:**
 
 | Environment Variable | Description | Default |
 |---------------------|-------------|---------|
 | `ACCEPT_WINDOWS_EULA` | Enable Windows testing (must be `true` to enable) | `false` |
-| `WIN_IMAGE_DOWNLOAD_URL` | Custom Windows 11 ISO download URL | Default Microsoft URL |
-| `WIN_IMAGE_NAME` | Name of an existing Windows DataSource to use (skips golden image creation) | _(none)_ |
+| `WIN_IMAGE_DOWNLOAD_URL` | Custom Windows Server 2022 ISO download URL | Default Microsoft URL |
 | `TEKTON_PIPELINE_VERSION` | Version of the `windows-efi-installer` pipeline | `>=v4.21.0` |
 
 Example with custom ISO URL:
 ```bash
 $ podman run -e OCP_VIRT_VALIDATION_IMAGE=${OCP_VIRT_VALIDATION_IMAGE} \
     -e ACCEPT_WINDOWS_EULA=true \
-    -e WIN_IMAGE_DOWNLOAD_URL="https://my-internal-server/windows11.iso" \
+    -e STORAGE_CLASS=<your-storage-class> \
+    -e WIN_IMAGE_DOWNLOAD_URL="https://my-internal-server/SERVER_EVAL_x64FRE_en-us.iso" \
     ${OCP_VIRT_VALIDATION_IMAGE} generate
 ```
 
-#### How It Works
-When Windows testing is enabled:
+**How It Works:**
 1. The checkup verifies that the OpenShift Pipelines operator is installed
-2. A Windows 11 golden image is created in the `openshift-virtualization-os-images` namespace using the `windows-efi-installer` Tekton pipeline (fetched automatically via the hub resolver)
-3. The tier2 test suite includes Windows-specific tests marked with `@pytest.mark.windows`
-4. The golden image is reused for subsequent runs if it already exists
-
-**Note:** The initial Windows image creation takes approximately 60-90 minutes. Subsequent runs will skip this step if the golden image already exists.
+2. Creates the `validation-os-images` namespace, RBAC, and runs the `windows-efi-installer` Tekton pipeline
+3. The pipeline downloads the ISO and installs Windows Server 2022 with OpenSSH, QEMU guest agent, and firewall disabled
+4. A DataSource (`win2k22`) is created backed by the output PVC
+5. The tier2 test suite runs tests matching `@pytest.mark.conformance`; when no golden image is available, tests with `@pytest.mark.windows` are excluded
+6. After tests complete, the entire `validation-os-images` namespace is deleted
 
-**Note:** Windows-specific tests require the `@pytest.mark.windows` marker to be added to the [openshift-virtualization-tests](https://github.com/RedHatQE/openshift-virtualization-tests) repository. Until then, enabling Windows testing will prepare the golden image but no Windows-specific tests will run.
+**Note:** The initial Windows image creation takes approximately 1-2 hours (up to 3 hours on slow networks).
 
 ## Disconnected Environments
 The validation checkup can be run on disconnected (air-gapped) OpenShift clusters by mirroring the required test images to an accessible registry and configuring mirror sets (ITMS + IDMS). No changes to the checkup configuration are needed -- mirror sets transparently redirect image pulls at the CRI-O level.

disconnected/README.md

@@ -350,22 +350,26 @@ The script will:
 
 Windows testing requires additional setup in disconnected environments because the `windows-efi-installer` Tekton pipeline normally uses the hub resolver to fetch the pipeline and tasks from Artifact Hub, which requires internet access.
 
+**Recommended:** Apply `manifests/windows/golden-image.yaml` once. Pre-install the Tekton pipeline (see Step 2 below), set `winImageDownloadURL` to your internal ISO mirror in the manifest, and wait for the pipeline to finish. Then run the checkup **without** `ACCEPT_WINDOWS_EULA` — the tool detects the existing DataSource and skips the pipeline entirely, avoiding repeated downloads and rebuilds.
+
+The steps below describe the **alternative (ephemeral)** path using `ACCEPT_WINDOWS_EULA=true`, which rebuilds the golden image on every run.
+
 ### Prerequisites for Disconnected Windows Testing
 
 1. **OpenShift Pipelines operator** installed on the cluster
-2. **Windows 11 ISO** available on an accessible internal server
+2. **Windows Server 2022 ISO** available on an accessible internal server
 3. **Tekton pipeline and tasks** pre-installed manually
 
-### Step 1: Download the Windows ISO
+### Step 1: Download the Windows Server 2022 ISO
 
-Download the Windows 11 ISO from Microsoft on a connected machine and host it on an internal HTTP server accessible from the cluster:
+Download the Windows Server 2022 evaluation ISO from Microsoft on a connected machine and host it on an internal HTTP server accessible from the cluster:
 
 ```bash
 # On connected machine
-curl -L -o windows11.iso "https://software-static.download.prss.microsoft.com/dbazure/888969d5-f34g-4e03-ac9d-1f9786c66749/26200.6584.250915-1905.25h2_ge_release_svc_refresh_CLIENT_CONSUMER_x64FRE_en-us.iso"
+curl -L -o SERVER_EVAL_x64FRE_en-us.iso "https://software-static.download.prss.microsoft.com/sg/download/888969d5-f34g-4e03-ac9d-1f9786c66749/SERVER_EVAL_x64FRE_en-us.iso"
 
 # Copy to your internal HTTP server
-scp windows11.iso user@internal-server:/var/www/html/images/
+scp SERVER_EVAL_x64FRE_en-us.iso user@internal-server:/var/www/html/images/
 ```
 
 ### Step 2: Pre-install the Tekton Pipeline
@@ -387,10 +391,12 @@ curl -L -o windows-efi-installer-configmaps.yaml \
 
 Transfer and apply to the disconnected cluster:
 ```bash
-# Apply to the golden image namespace
-oc apply -f windows-efi-installer-tasks.yaml -n openshift-virtualization-os-images
-oc apply -f windows-efi-installer-configmaps.yaml -n openshift-virtualization-os-images
-oc apply -f windows-efi-installer.yaml -n openshift-virtualization-os-images
+oc create namespace validation-os-images
+oc label namespace validation-os-images app=ocp-virt-validation
+oc label namespace validation-os-images pod-security.kubernetes.io/enforce=privileged
+oc apply -f windows-efi-installer-tasks.yaml -n validation-os-images
+oc apply -f windows-efi-installer-configmaps.yaml -n validation-os-images
+oc apply -f windows-efi-installer.yaml -n validation-os-images
 ```
 
 Alternatively, get the manifests from Artifact Hub:
@@ -403,13 +409,14 @@ When running the validation checkup, specify your internal Windows ISO URL:
 ```bash
 $ podman run -e OCP_VIRT_VALIDATION_IMAGE=${OCP_VIRT_VALIDATION_IMAGE} \
     -e ACCEPT_WINDOWS_EULA=true \
-    -e WIN_IMAGE_DOWNLOAD_URL="http://internal-server.example.com/images/windows11.iso" \
+    -e STORAGE_CLASS=<your-storage-class> \
+    -e WIN_IMAGE_DOWNLOAD_URL="http://internal-server.example.com/images/SERVER_EVAL_x64FRE_en-us.iso" \
     ${OCP_VIRT_VALIDATION_IMAGE} generate
 ```
 
 ### Notes for Disconnected Windows Testing
 
-- The Windows golden image will be created in the `openshift-virtualization-os-images` namespace
-- The image creation takes approximately 60-90 minutes on first run
-- Once created, the golden image is reused for subsequent test runs
+- The pipeline output PVC backs a `win2k22` DataSource in a custom `validation-os-images` namespace created by the tool -- no intermediate VMs or snapshots
+- The image creation takes approximately 1-2 hours on first run (up to 3 hours on slow networks)
+- With `ACCEPT_WINDOWS_EULA=true`, each run rebuilds the golden image from scratch and cleans up on completion
 - If the hub resolver fails (due to no internet), the checkup will provide instructions for manual pipeline installation

manifests/run/generate.sh

@@ -20,7 +20,6 @@ STORAGE_CLASS=${STORAGE_CLASS:-""}
 STORAGE_CAPABILITIES=${STORAGE_CAPABILITIES:-""}
 ACCEPT_WINDOWS_EULA=${ACCEPT_WINDOWS_EULA:-"false"}
 WIN_IMAGE_DOWNLOAD_URL=${WIN_IMAGE_DOWNLOAD_URL:-""}
-WIN_IMAGE_NAME=${WIN_IMAGE_NAME:-""}
 TEKTON_PIPELINE_VERSION=${TEKTON_PIPELINE_VERSION:-""}
 
 # Calculate storage size based on test suites (2Gi per suite, 10Gi for tier2)
@@ -224,8 +223,6 @@ spec:
               value: "${ACCEPT_WINDOWS_EULA}"
             - name: WIN_IMAGE_DOWNLOAD_URL
               value: "${WIN_IMAGE_DOWNLOAD_URL}"
-            - name: WIN_IMAGE_NAME
-              value: "${WIN_IMAGE_NAME}"
             - name: TEKTON_PIPELINE_VERSION
               value: "${TEKTON_PIPELINE_VERSION}"
           volumeMounts: