refactor(mgmt): make Swift VNet mandatory for management clusters - #6185
Merged
openshift-merge-bot[bot] merged 1 commit intoJul 22, 2026
Merged
Conversation
…OSLSRE-1548) Management clusters already run Swift V2 in int/stg/prod; only the dev cloud overrode mgmt.aks.enableSwiftV2Vnet/enableSwiftV2Nodepools to false. Remove the non-Swift path for management clusters so Swift is always on and the config surface no longer carries a toggle that must never be flipped in production. - drop enableSwiftV2Vnet/enableSwiftV2Nodepools from config.yaml (default, dev override and all env overlays) and config.schema.json, and re-materialize - hardcode enableSwift/enableSwiftV2Nodepools = true at the mgmt-cluster.bicep module call sites; remove the aksEnableSwiftVnet/aksEnableSwiftNodepools params and their tmpl.bicepparam values - make swift-vnet-permissions.bicep grant the Swift VNet RBAC unconditionally (remove the enableSwift param + tmpl.bicepparam value) - drop the ENABLE_SWIFT gate from the mgmt-pipeline swift-vnet step and scripts/swift-vnet.sh so the create/tag always runs - leave the shared aks-cluster-base/network/pool modules untouched: svc and opstool clusters keep passing enableSwift(V2Nodepools)=false The shared cluster modules still expose the Swift toggle for service and opstool clusters, which remain non-Swift.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors the management-cluster deployment path to make Swift V2 networking mandatory, removing the now-unused mgmt-level config toggles and eliminating the non-Swift management-cluster code path while preserving the Swift toggle for service/opstool clusters.
Changes:
- Remove
mgmt.aks.enableSwiftV2Vnet/mgmt.aks.enableSwiftV2Nodepoolsfromconfig/config.yaml,config/config.schema.json, and re-materializedconfig/rendered/. - Hardcode Swift enabled for management clusters in
mgmt-cluster.bicep(VNet and nodepools), and drop the corresponding bicep params/plumbing. - Make Swift VNet RBAC + Swift VNet create/tag pipeline steps unconditional for management clusters (remove
ENABLE_SWIFTgating andenableSwiftbicepparam).
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| dev-infrastructure/templates/swift-vnet-permissions.bicep | Removes the enableSwift gate so Swift VNet RBAC is always applied for mgmt clusters. |
| dev-infrastructure/templates/mgmt-cluster.bicep | Hardcodes Swift enabled for mgmt VNet and Swift V2 nodepools; removes now-unused params. |
| dev-infrastructure/scripts/swift-vnet.sh | Removes ENABLE_SWIFT short-circuit so the Swift VNet create/tag always runs. |
| dev-infrastructure/mgmt-pipeline.yaml | Makes Swift VNet permissions + create/tag steps unconditional and removes the ENABLE_SWIFT variable wiring. |
| dev-infrastructure/configurations/swift-vnet-permissions.tmpl.bicepparam | Drops the removed enableSwift parameter. |
| dev-infrastructure/configurations/mgmt-cluster.tmpl.bicepparam | Drops the removed Swift enable parameters for mgmt-cluster deployments. |
| config/config.yaml | Removes the mgmt Swift toggle keys from defaults/overlays. |
| config/config.schema.json | Removes the mgmt Swift toggle properties from the schema. |
| config/rendered/dev//.yaml | Removes rendered mgmt Swift toggle keys (materialize output updated accordingly). |
Collaborator
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: raelga, roivaz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
Collaborator
Author
|
/retest-required |
Collaborator
Author
|
/test e2e-parallel |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AROSLSRE-1548
What
Makes Swift V2 VNet mandatory for management clusters and removes the
non-Swift code path for them.
mgmt.aks.enableSwiftV2Vnet/mgmt.aks.enableSwiftV2Nodepoolsfromconfig/config.yaml(default, the dev override, and all env overlays) and fromconfig/config.schema.json; re-materializedconfig/rendered/.enableSwift/enableSwiftV2Nodepools = trueat themgmt-cluster.bicepmodule call sites and removes the now-unusedaksEnableSwiftVnet/aksEnableSwiftNodepoolsparams + their tmpl.bicepparamvalues.
swift-vnet-permissions.bicepnow grants the Swift VNet RBAC unconditionally(dropped the
enableSwiftparam + gate).ENABLE_SWIFTgate from themgmt-pipelineswift-vnetstep andscripts/swift-vnet.shso the VNet create/tag always runs.Service and opstool clusters are not management clusters and keep passing
enableSwift/enableSwiftV2Nodepools = false; the sharedaks-cluster-base/network/vnet/aks/poolmodules retain the toggle for them.Why
Management clusters already run Swift V2 in int/stg/prod — only the dev cloud
overrode the flags to
false. Keeping a mgmt-level Swift toggle means carrying aconfig knob that must never be flipped in production and a non-Swift code path
that is never exercised for management clusters. Removing it makes Swift the
single, enforced management-cluster networking mode and shrinks the config
surface. The dev-cloud blocker (SwiftV2 mgmt-node bring-up) has been cleared with
the owner, so dev/CSPR can move onto Swift.
Testing
bicep buildofmgmt-cluster.bicepandswift-vnet-permissions.bicepcompilesclean (pre-existing BCP334 warning in
aks/pool.bicepis unrelated).bash -n scripts/swift-vnet.shpasses.cd config && make materializere-renders with the flags removed; confirmed noenableSwiftV2Vnet/enableSwiftV2Nodepoolsconfig keys remain anywhere in therepo, and only management-cluster call sites are affected.
No automated test covers the mgmt bootstrap pipeline directly; validated via bicep
build + materialize + config-schema validation.
Special notes for your reviewer
The shared
network/vnet.bicepandaks-cluster-base.bicepmodules intentionallykeep their
enableSwift/enableSwiftV2Nodepoolsparams — service and opstoolclusters still deploy non-Swift. Only the management-cluster path is now
Swift-only.