fix(dev-ci): upgrade opstool AKS node pools, not just control plane (AROSLSRE-1414)

[raelga]

AROSLSRE-1414

What

Adds an upgrade-aks-cluster Shell step to the opstool dev-ci pipeline so that a Kubernetes version bump in config-dev-ci.yaml rolls the node pools, not just the control plane. The step runs the same dev-infrastructure/scripts/upgrade-aks-cluster.sh used by the svc/mgmt pipelines and assumes the shared global-rollout-identity, exposed via a new global-identity output step (mirroring the dev-ci e2e-subscription-rbac pipeline).

Why

The opstool pipeline previously ran only the cluster ARM step. That step sets the managedCluster kubernetesVersion (control plane) but the agentPoolProfiles / aks/pool.bicep pools carry no orchestratorVersion — on a managedCluster PUT an omitted orchestratorVersion means "no change", so existing node pools stay on their current version.

Observed after deploying the 1.33 bump to opstool: control plane went to 1.33.12 but all three node pools stayed on 1.32 orchestrator. svc/mgmt don't hit this because their pipelines already run upgrade-aks-cluster.sh (az aks upgrade, which rolls control plane and node pools). opstool was the outlier. This is also the root cause of the opstool version drift behind AROSLSRE-863.

config kubernetesVersion bump
  -> cluster ARM step        => control plane upgraded, pools unchanged  (before)
  -> upgrade-aks-cluster.sh  => `az aks upgrade` rolls control plane + node pools  (after)

Testing

• templatize pipeline validate --topology-config-file topology-dev-ci.yaml --service-config-file config/config-dev-ci.yaml --dev-mode --dev-region westus3 → passes.
• yamlfmt → no changes.
• Reuses the already-proven upgrade-aks-cluster.sh and the global-identity output pattern from the sibling e2e-subscription-rbac pipeline; the script is idempotent (no-op when the cluster is already at the target version).

Special notes for your reviewer

dev-ci infra is rolled out manually (make dev-ci-local-run), so this takes effect on the next opstool rollout. Scope is dev-ci only (topology-dev-ci.yaml); int/stg/prod are unaffected.

[Copilot]

Pull request overview

Updates the dev-ci opstool AKS rollout pipeline so that when opstool.aks.kubernetesVersion is bumped, the pipeline runs the existing upgrade-aks-cluster.sh flow (via az aks upgrade) to roll node pools as well as the control plane, aligning opstool behavior with svc/mgmt pipelines.

Changes:

• Add an upgrade-aks-cluster Shell step that runs dev-infrastructure/scripts/upgrade-aks-cluster.sh with CLUSTER_NAME, RESOURCE_GROUP, and KUBERNETES_VERSION from config.
• Add a new global resource group section that exposes the shared rollout identity via an output-only global-identity ARM step (used by the Shell step’s shellIdentity).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[inbharajmani]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inbharajmani, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• dev-infrastructure/OWNERS [raelga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[raelga]

Retesting e2e-parallel — this is a flake unrelated to the PR.

Failure: the single failing test is test/e2e/nodepool_version_upgrade.go:210 — failed to upgrade node pool npupgrade-4-21 to version 4.21.0 ... timeout '45.000000' minutes exceeded during UpdateNodePoolAndWait ... context deadline exceeded. That's a timeout-class flake (known shared-CI-subscription ARM slowness), not a deterministic failure.

Scope evidence (not PR-specific):

• This PR changes only dev-infrastructure/dev-ci/cluster/opstool-aks-pipeline.yaml (a dev-ci EV2 pipeline definition). It does not touch the e2e harness, HCP cluster/node-pool code, or anything e2e-parallel exercises.
• e2e-parallel is red across multiple unrelated PRs right now (e.g. chore: sync ARO-Tools to c3198b56b79a #5990, Improve snapshot analyze context for stuck deletion scenario #5989) while others pass (feat(infra): add delete-extra-infra-nodepools pipeline step (AROSLSRE-1136) #5557, create alert for absent leaders #5896) — transient infra, not a code break.

/test e2e-parallel