Job [1]:

level=error msg="Error: Error updating Route Table Association for Subnet \"ci-op-zpjrv9mn-7f637-kkpvn-master-subnet\" (Virtual Network \"ci-op-zpjrv9mn-7f637-kkpvn-vnet\" / Resource Group \"ci-op-zpjrv9mn-7f637-kkpvn-rg\"): network.SubnetsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code=\"ReferencedResourceNotProvisioned\" Message=\"Cannot proceed with operation because resource /subscriptions/d38f1e38-4bed-438e-b227-833f997adf6a/resourceGroups/ci-op-zpjrv9mn-7f637-kkpvn-rg/providers/Microsoft.Network/networkSecurityGroups/ci-op-zpjrv9mn-7f637-kkpvn-controlplane-nsg used by resource /subscriptions/d38f1e38-4bed-438e-b227-833f997adf6a/resourceGroups/ci-op-zpjrv9mn-7f637-kkpvn-rg/providers/Microsoft.Network/virtualNetworks/ci-op-zpjrv9mn-7f637-kkpvn-vnet/subnets/ci-op-zpjrv9mn-7f637-kkpvn-master-subnet is not in Succeeded state. Resource is in Failed state and the last operation that updated/is updating the resource is PutSecurityRuleOperation.\" Details=[]"

Not sure what's going on there, and might just be a provider-side flake, but I didn't see substrings mentioned in existing bugs so I thought I'd file a new one in case other folks see this error and come searching for substrings in Bugzilla.

Currently just the one error (on a 4.3.5 install) in the past 24+h [2].

[1]: https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/logs/release-openshift-origin-installer-e2e-azure-upgrade/94
[2]: https://search.svc.ci.openshift.org/?name=azure&search=resource+is+PutSecurityRuleOperation&maxAge=336h&context=0&type=build-log