fix(swift-vnet): reland #5834 with shellIdentity on mgmt Shell steps (ARO-28045)

[raelga]

ARO-28045 (epic ARO-28038; follow-ups ARO-28066, ARO-28082)

Relands #5834 (reverted in #5888) with the EV2 fix. Rebased onto main — now a single clean commit.

What

Re-applies #5834 (Swift mgmt-VNet create/tag via a managed-identity ACI launched from a single synchronous swift-vnet Shell step, replacing the Azure-Policy-banned deploymentScripts) and adds the missing shellIdentity on the Shell steps in both mgmt-pipeline.yaml and mgmt-solo-pipeline.yaml:

    shellIdentity:
      input:
        resourceGroup: global
        step: output
        name: globalMSIId

• swift-vnet in both mgmt pipelines (the step reverted from fix: create/tag Swift VNet via a managed-identity container (ARO-28045) #5834).
• fixes in mgmt-solo-pipeline.yaml, which had the same omission — folded in here so all shellIdentity changes to that file live in a single PR (the dev-ci offenders are handled separately in #5890).

Why

#5834 was reverted (#5888) because its swift-vnet Shell step omitted shellIdentity, which sdp-pipelines EV2RA manifest generation validates unconditionally. The bump failed at manifest resolution:

step Management.Infra.management.swift-vnet: error validating step:
invalid shell identity: variable must specify config ref, value, or input chain

ARO-HCP CI does not exercise EV2RA generation, so it slipped through. Declaring shellIdentity: globalMSIId (same pattern as upgrade-aks-cluster / cleanup-prometheus-pvc, and matching the step's own DEPLOYMENT_MSI_ID input) satisfies the validator. In EV2 the outer shell runs as globalMSI (harmless — the container still performs the create/tag); templatize's local executor ignores shellIdentity, so e2e behaviour is identical to the proven #5834 run.

Testing

• yamllint -c .yamllint.yml on both pipelines (clean).
• fix: create/tag Swift VNet via a managed-identity container (ARO-28045) #5834's e2e already proved the swift networking path (container ran as globalMSI, VNet created + tagged, swift clusters reached ready).

Special notes for your reviewer

Now rebased onto main after the revert (#5888) merged — the diff is exactly the #5834 reintroduction plus the shellIdentity additions, in one commit. The schema change that makes shellIdentity required lives in Azure/ARO-Tools#262 (AROSLSRE-1380), held until this and #5890 merge.

PR Checklist

• PR is scoped to a single task
• Title follows Conventional Commits
• Summary explains the "Why"
• Linked to relevant ticket/issue
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide)
• Commit history is clean
• Tricky code blocks are commented

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Copilot]

Pull request overview

This PR relands the Swift management VNet create/tag flow by replacing the Azure-Policy-banned deploymentScripts approach with a synchronous Shell step (swift-vnet) that launches an ACI container group assigned globalMSI to perform the Swift stamp tag write, and it adds the missing shellIdentity wiring to satisfy EV2RA manifest validation.

Changes:

• Introduce scripts/swift-vnet.sh to create/tag the Swift mgmt VNet by running the write inside an ACI container group assigned globalMSI.
• Split Swift VNet RBAC role assignments into a dedicated Bicep module/template (vnet-rbac.bicep, swift-vnet-permissions.bicep) and update VNet module behavior for Swift to treat the VNet as existing.
• Update mgmt-pipeline.yaml and mgmt-solo-pipeline.yaml to add swift-vnet-permissions + swift-vnet steps and declare shellIdentity for Shell steps that require it.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
dev-infrastructure/templates/swift-vnet-permissions.bicep	New template that conditionally applies RBAC grants for the Swift VNet identity.
dev-infrastructure/configurations/swift-vnet-permissions.tmpl.bicepparam	New bicepparam template wiring deploymentMsiId + enableSwift into the RBAC template.
dev-infrastructure/modules/network/vnet-rbac.bicep	New module that creates Network Contributor + Tag Contributor assignments for the Swift identity.
dev-infrastructure/modules/network/vnet.bicep	Removes deployment-script-based Swift path; for Swift, treats VNet as existing (created/tagged out-of-band).
dev-infrastructure/scripts/swift-vnet.sh	New script to launch ACI under globalMSI, poll for completion, stream logs, and clean up.
dev-infrastructure/mgmt-pipeline.yaml	Adds swift-vnet-permissions + swift-vnet steps and fixes EV2RA validation via shellIdentity.
dev-infrastructure/mgmt-solo-pipeline.yaml	Adds subscription lookup + Swift VNet steps and adds missing shellIdentity on fixes.
dev-infrastructure/templates/mgmt-cluster.bicep	Stops passing deploymentMsiId into the VNet module now that it no longer accepts it.
dev-infrastructure/templates/svc-cluster.bicep	Stops passing deploymentMsiId into the VNet module for non-Swift svc deployments.
dev-infrastructure/templates/opstool-cluster.bicep	Stops passing deploymentMsiId into the VNet module for non-Swift opstool deployments.

[geoberle]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: geoberle, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• dev-infrastructure/OWNERS [geoberle,raelga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

[raelga]

/test e2e-parallel