Summary

Several drivers-evergreen-tools scripts default to debian-11/debian11 images, which reached end of life on 2026-08-31:

• create-and-setup-instance.sh defaults GCPKMS_IMAGEFAMILY to debian-11 (.evergreen/csfle/gcpkms/create-and-setup-instance.sh)
• Azure KMS scripts default the remote VM image to Debian:debian-11:11.0.20221020.1174 and list debian11 as a supported distro (.evergreen/csfle/azurekms/README.md)
• Azure OIDC docs list debian11 as a distro with the Azure CLI installed (.evergreen/auth_oidc/azure/README.md)

The Node team is already seeing GCP CI failures as a result. This should be updated across these usages to a supported Debian (or equivalent) image/distro. The debian11 Evergreen build variant used for general MongoDB≥5.0/SSL testing is out of scope for now.

Update (2026-09-03)

PR #836 moved the GCP KMS and Azure KMS/OIDC defaults to debian-12 and merged. Validated against the Node driver's previously-failing test-gcpkms-task via a scoped Evergreen patch, which passed.

A follow-up, PR #838, proposed moving the same defaults to debian-13 and is now closed: per downloads.mongodb.org/full.json, only 9.0.0-rc0 (an unreleased release candidate) publishes debian13 server binaries, versus 212 released versions for debian12. mongodl.py has no debian13 mapping because there is no released server build to download yet. Revisit once a released server version ships debian13 packages.

Motivation

Who is the affected end user?

Any driver team running CSFLE GCP KMS or Azure KMS/OIDC tests via drivers-evergreen-tools.

How does this affect the end user?

GCP CI is failing for the Node team now; Azure KMS/OIDC are likely to fail or become unsupported soon for any other driver relying on them.

How likely is it that this problem or use case will occur?

Main path — every CSFLE GCP KMS run and Azure KMS/OIDC run defaults to these EOL images.

If the problem does occur, what are the consequences and how severe are they?

CI failures block CSFLE and OIDC testing for any driver relying on these scripts.

Is this issue urgent?

Yes — GCP is already failing, and Debian 11 is already past end of life.

Is this ticket required by a downstream team?

Not specifically, but the fix affects all consuming driver repos.

Is this ticket only for tests?

Yes — this is CI/test infrastructure only, no functional product impact.

Acceptance Criteria

GCP KMS and Azure KMS/OIDC scripts/docs no longer default to an EOL Debian image or distro, and CI passes again for affected drivers. Met for debian-12 via PR #836. The further move to debian-13 is blocked on a released MongoDB server version publishing debian13 packages; not currently actionable.