chore(ci): migrate resource cleaner MI and CS PR auth SP to Bicep

[galchammat]

AROSLSRE-1351 | ARO-27252

What

Replaces bash-managed identity creation in deploy-resource-cleaner.sh and create-pr-env-sp Makefile target with declarative Bicep templates.

• Resource cleaner: dev-resource-cleaner.bicep creates the managed identity, federated credential, KV roles (Certificates Officer, Secrets Officer), ACR delete access, and subscription Contributor via a separate dev-resource-cleaner-subscription.bicep
• CS PR auth: dev-cs-pr-auth-app.bicep creates the Entra app + SP via entra/app.bicep, with AKS Contributor and KV Certificate User roles
• acr-permissions.bicep: added grantDeleteAccess param (backward-compatible)
• deploy-resource-cleaner.sh stripped to K8s-only (namespace, ConfigMap, CronJob); receives AZURE_CLIENT_ID/AZURE_TENANT_ID from Bicep output

Why

These were the last two bash-managed identity resources in the CSPR path. Moving them to Bicep makes them declarative, idempotent, and auditable — consistent with the rest of the IaC model.

Testing

No unit/integration/E2E tests — this is infrastructure-as-code. Verification is deployment-time:

• az bicep lint passes on all new templates
• az deployment group what-if confirms correct resource creation
• make deploy-pr-env-deps in a personal dev env verifies MSI + fedcred + CronJob works end-to-end

Special notes for your reviewer

• cs-pr-authentication app needs a one-time uniqueName backfill before first Bicep deploy (added to the backfill script in PR chore(ci): migrate mock identity SP creation to declarative Bicep #5976)
• Cross-resource-group scope is explicitly set on all KV and ACR module calls (KVs in mgmt.rg, ACR in global.rg, service KV in regionRG)
• User Access Administrator role was commented out in the old Makefile target; preserved as an echo warning in the new target

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Screenshots included (if graph/UI/metrics changes) — N/A
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide) — draft, pending CI
• Draft PR used for WIP (if applicable)
• Commit history is clean (rebased/squashed)
• Tricky code blocks are commented — N/A
• Specific reviewers tagged — will tag when ready for review
• All comment threads resolved before merge

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: galchammat
Once this PR has been reviewed and has the lgtm label, please assign geoberle for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• cluster-service/OWNERS
• dev-infrastructure/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[galchammat]

/test all

[Copilot]

Pull request overview

This PR migrates the remaining bash-managed identity / service principal setup in the CSPR path into declarative Bicep, leaving the existing shell script to deploy only the Kubernetes resources for the resource cleaner.

Changes:

• Add Bicep templates to create the resource-cleaner UAMI + fedcred + KV/ACR grants, and a separate subscription-scope template for Contributor.
• Add a Bicep template to create/manage the cs-pr-authentication Entra app/SP and assign AKS + Key Vault roles.
• Update the cluster-service Makefile and resource-cleaner deploy script to consume Bicep outputs (client/tenant IDs) and remove bash-based Azure identity provisioning.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
dev-infrastructure/templates/dev-resource-cleaner.bicep	New RG-scope template for resource-cleaner UAMI, fedcred, and RBAC grants (KV + ACR).
dev-infrastructure/templates/dev-resource-cleaner-subscription.bicep	New subscription-scope template assigning Contributor to the resource-cleaner principal.
dev-infrastructure/templates/dev-cs-pr-auth-app.bicep	New template creating/managing the cs-pr-authentication app/SP and assigning AKS Contributor + KV Certificate User.
dev-infrastructure/modules/acr/acr-permissions.bicep	Adds independent grantDeleteAccess switch for AcrDelete role assignments.
dev-infrastructure/configurations/resource-cleaner.tmpl.bicepparam	New templatized parameter file for the resource-cleaner deployment.
dev-infrastructure/configurations/cs-pr-auth-app.tmpl.bicepparam	New templatized parameter file for the CS PR auth app deployment.
cluster-service/Makefile	Switches identity creation to Bicep deployments and wires outputs into the K8s deploy script.
cluster-service/cspr/deploy-resource-cleaner.sh	Removes Azure identity provisioning logic; requires AZURE_CLIENT_ID/AZURE_TENANT_ID env vars.

[galchammat]

@copilot review