Repository: Azure/ARO-RP
Pull request #1776 (2021-10-06 14:46:50)

Add RP Config as a dependency for Kusto and Geneva Pipelines
### Which issue this PR addresses:

Fixes (https://msazure.visualstudio.com/AzureRedHatOpenShift/_workitems/edit/11124811)

### What this PR does / why we need it:

This PR allows us to read configs from the RP Config for Kusto and Geneva pipelines.

### Test plan for issue:

We ran the pipeline and saw that it pulled in the rp config appropriately.

### Is there any documentation that needs to be updated for this PR?

no


Patch:
diff --git a/.pipelines/build-and-push-fluentbit.yml b/.pipelines/build-and-push-fluentbit.yml
deleted file mode 100644
index c526a655a..000000000
--- a/.pipelines/build-and-push-fluentbit.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Azure DevOps Pipeline building rp images and pushing to int acr
-trigger: none
-pr: none
-
-variables:
-- template: vars.yml
-
-jobs:
-- job: Build_and_push_image_fluentbit
-  pool:
-    name: ARO-CI
-
-  steps:
-  - template: ./templates/template-checkout.yml
-  - template: ./templates/template-az-cli-login.yml
-    parameters:
-      azureDevOpsJSONSPN: $(aro-v4-ci-devops-spn)
-  - template: ./templates/template-push-images-to-acr.yml
-    parameters:
-      rpImageACR: $(RP_IMAGE_ACR)
-      buildCommand: publish-image-fluentbit
-  - template: ./templates/template-az-cli-logout.yml
diff --git a/.pipelines/build-and-push-images.yml b/.pipelines/build-and-push-images.yml
index 6a638da4d..7e76dc119 100644
--- a/.pipelines/build-and-push-images.yml
+++ b/.pipelines/build-and-push-images.yml
@@ -18,7 +18,6 @@ jobs:
   - template: ./templates/template-push-images-to-acr.yml
     parameters:
       rpImageACR: $(RP_IMAGE_ACR)
-      buildCommand: publish-image-aro
   - template: ./templates/template-az-cli-logout.yml
   - script: |
       cp -a --parents aro "$(Build.ArtifactStagingDirectory)"
diff --git a/.pipelines/onebranch/pipeline.logging.geneva.bootstrapper.pullrequest.yml b/.pipelines/onebranch/pipeline.logging.geneva.bootstrapper.pullrequest.yml
index 04044da3a..6a25133b8 100644
--- a/.pipelines/onebranch/pipeline.logging.geneva.bootstrapper.pullrequest.yml
+++ b/.pipelines/onebranch/pipeline.logging.geneva.bootstrapper.pullrequest.yml
@@ -25,6 +25,9 @@ resources:
   - repository: rhado
     type: git
     name: ARO.Pipelines
+  - repository: rpconfig
+    type: git
+    name: RP-Config
 
 extends:
   template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates # https://aka.ms/obpipelines/templates
diff --git a/.pipelines/onebranch/pipeline.logging.geneva.pullrequest.yml b/.pipelines/onebranch/pipeline.logging.geneva.pullrequest.yml
index b1758f3dc..f2d8858f3 100644
--- a/.pipelines/onebranch/pipeline.logging.geneva.pullrequest.yml
+++ b/.pipelines/onebranch/pipeline.logging.geneva.pullrequest.yml
@@ -25,6 +25,9 @@ resources:
   - repository: rhado
     type: git
     name: ARO.Pipelines
+  - repository: rpconfig
+    type: git
+    name: RP-Config
 
 extends:
   template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates # https://aka.ms/obpipelines/templates
diff --git a/.pipelines/onebranch/pipeline.logging.kusto.pullrequest.yml b/.pipelines/onebranch/pipeline.logging.kusto.pullrequest.yml
index 884dcfa37..0079709b9 100644
--- a/.pipelines/onebranch/pipeline.logging.kusto.pullrequest.yml
+++ b/.pipelines/onebranch/pipeline.logging.kusto.pullrequest.yml
@@ -25,6 +25,9 @@ resources:
   - repository: rhado
     type: git
     name: ARO.Pipelines
+  - repository: rpconfig
+    type: git
+    name: RP-Config
 
 extends:
   template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates # https://aka.ms/obpipelines/templates
diff --git a/.pipelines/templates/template-push-images-to-acr.yml b/.pipelines/templates/template-push-images-to-acr.yml
index 11c27ef70..acd3fe260 100644
--- a/.pipelines/templates/template-push-images-to-acr.yml
+++ b/.pipelines/templates/template-push-images-to-acr.yml
@@ -1,6 +1,5 @@
 parameters:
   rpImageACR: ''
-  buildCommand: ''
 steps:
 - script: |
     set -e
@@ -11,5 +10,5 @@ steps:
     az acr login --name "$RP_IMAGE_ACR"
     # azure checkouts commit, so removing master reference when publishing image
     export BRANCH=$(Build.SourceBranchName)
-    make ${{ parameters.buildCommand }}
+    make publish-image-aro
   displayName: ⚙️ Build and push images to ACR
diff --git a/docs/disk-encryption-set.md b/docs/disk-encryption-set.md
deleted file mode 100644
index e4ae331d4..000000000
--- a/docs/disk-encryption-set.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# Using a custom Disk Encryption Set
-
-## What is the Disk Encryption Set used for?
-
-In summary, it allows a customer to control the keys that are used to encrypt/decrypt VM disks.
-See [deploy-a-vm-with-customer-managed-keys](https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal#deploy-a-vm-with-customer-managed-keys) for more information.
-
-## How to deploy?
-First, install and use the AzureCLI extension with
-```bash
-make az
-```
-
->You can check if the extension is in use by running:
-```bash
-az extension list
-[
-  {
-    "experimental": false,
-    "extensionType": "dev",
-    "name": "aro",
-    "path": "<path to go SRC>/github.com/Azure/ARO-RP/python/az/aro",
-    "preview": true,
-    "version": "1.0.1"
-  }
-]
-```
-
-Follow [tutorial-create-cluster](https://docs.microsoft.com/en-us/azure/openshift/tutorial-create-cluster) but don't run the `az aro create` command, instead proceed as follows:
-
-  - set additional env variables
-```bash
-export KEYVAULT_NAME=$USER-enckv
-export KEYVAULT_KEY_NAME=$USER-key
-export DISK_ENCRYPTION_SET_NAME=$USER-des
-```
-  - create the KeyVault and Key
-```bash
-az keyvault create -n $KEYVAULT_NAME \
-                   -g $RESOURCEGROUP \
-                   -l $LOCATION \
-                   --enable-purge-protection true \
-                   --enable-soft-delete true
-
-az keyvault key create --vault-name $KEYVAULT_NAME \
-                       -n $KEYVAULT_KEY_NAME \
-                       --protection software
-
-KEYVAULT_ID=$(az keyvault show --name $KEYVAULT_NAME --query "[id]" -o tsv)
-
-KEYVAULT_KEY_URL=$(az keyvault key show --vault-name $KEYVAULT_NAME \
-                                        --name $KEYVAULT_KEY_NAME \
-                                        --query "[key.kid]" -o tsv)
-```
-  - create the DES and add permissions to use the KeyVault
-```bash
-az disk-encryption-set create -n $DISK_ENCRYPTION_SET_NAME \
-                              -l $LOCATION \
-                              -g $RESOURCEGROUP \
-                              --source-vault $KEYVAULT_ID \
-                              --key-url $KEYVAULT_KEY_URL
-
-DES_IDENTITY=$(az disk-encryption-set show -n $DISK_ENCRYPTION_SET_NAME \
-                                           -g $RESOURCEGROUP \
-                                           --query "[identity.principalId]" \
-                                           -o tsv)
-
-az keyvault set-policy -n $KEYVAULT_NAME \
-                       -g $RESOURCEGROUP \
-                       --object-id $DES_IDENTITY \
-                       --key-permissions wrapkey unwrapkey get
-```
-  - run the az aro create command
-```bash
-az aro create --resource-group $RESOURCEGROUP \
-              --name $CLUSTER  \
-              --vnet aro-vnet  \
-              --master-subnet master-subnet \
-              --worker-subnet worker-subnet \
-              --disk-encryption-set $DES_ID
-```
-
-After creating the cluster all VMs should have the customer controlled Disk Encryption Set.
->Remember to delete the disk-encryption-set and keyvault when done.
diff --git a/pkg/portal/middleware/aad.go b/pkg/portal/middleware/aad.go
index 29742b773..0b05cff6e 100644
--- a/pkg/portal/middleware/aad.go
+++ b/pkg/portal/middleware/aad.go
@@ -20,6 +20,7 @@ import (
 	"github.com/gorilla/sessions"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/microsoft"
 
 	"github.com/Azure/ARO-RP/pkg/env"
 	"github.com/Azure/ARO-RP/pkg/util/oidc"
@@ -91,11 +92,6 @@ func NewAAD(log *logrus.Entry,
 		return nil, errors.New("invalid sessionKey")
 	}
 
-	endpoint := oauth2.Endpoint{
-		AuthURL:  env.Environment().ActiveDirectoryEndpoint + env.TenantID() + "/oauth2/v2.0/authorize",
-		TokenURL: env.Environment().ActiveDirectoryEndpoint + env.TenantID() + "/oauth2/v2.0/token",
-	}
-
 	a := &aad{
 		log: log,
 		env: env,
@@ -109,7 +105,7 @@ func NewAAD(log *logrus.Entry,
 		store:       sessions.NewCookieStore(sessionKey),
 		oauther: &oauth2.Config{
 			ClientID:    clientID,
-			Endpoint:    endpoint,
+			Endpoint:    microsoft.AzureADEndpoint(env.TenantID()),
 			RedirectURL: "https://" + hostname + "/callback",
 			Scopes: []string{
 				"openid",
diff --git a/python/az/aro/HISTORY.rst b/python/az/aro/HISTORY.rst
index f7f5057c8..8a86c83c0 100644
--- a/python/az/aro/HISTORY.rst
+++ b/python/az/aro/HISTORY.rst
@@ -25,7 +25,3 @@ Release History
 1.0.0
 ++++++
 * Remove preview flag.
-
-1.0.1
-++++++
-* Switch to new preview API
diff --git a/python/az/aro/azext_aro/_client_factory.py b/python/az/aro/azext_aro/_client_factory.py
index 9963abc21..e03b5a16c 100644
--- a/python/az/aro/azext_aro/_client_factory.py
+++ b/python/az/aro/azext_aro/_client_factory.py
@@ -4,7 +4,7 @@
 import urllib3
 
 from azext_aro.custom import rp_mode_development
-from azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2021_09_01_preview import AzureRedHatOpenShiftClient
+from azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2020_04_30 import AzureRedHatOpenShiftClient
 from azure.cli.core.commands.client_factory import get_mgmt_service_client
 
 
diff --git a/python/az/aro/azext_aro/_params.py b/python/az/aro/azext_aro/_params.py
index 9b6e33171..db41c9fab 100644
--- a/python/az/aro/azext_aro/_params.py
+++ b/python/az/aro/azext_aro/_params.py
@@ -4,10 +4,8 @@
 from azext_aro._validators import validate_cidr
 from azext_aro._validators import validate_client_id
 from azext_aro._validators import validate_cluster_resource_group
-from azext_aro._validators import validate_disk_encryption_set
 from azext_aro._validators import validate_domain
 from azext_aro._validators import validate_pull_secret
-from azext_aro._validators import validate_sdn
 from azext_aro._validators import validate_subnet
 from azext_aro._validators import validate_client_secret
 from azext_aro._validators import validate_visibility
@@ -56,23 +54,10 @@ def load_arguments(self, _):
         c.argument('service_cidr',
                    help='CIDR of service network. Must be a minimum of /18 or larger.',
                    validator=validate_cidr('service_cidr'))
-        c.argument('software_defined_network', arg_type=get_enum_type(['OVNKubernetes', 'OpenShiftSDN']),
-                   options_list=['--software-defined-network-type', '--sdn-type'],
-                   help='SDN type either "OpenShiftSDN" (default) or "OVNKubernetes"',
-                   validator=validate_sdn)
 
-        c.argument('disk_encryption_set',
-                   help='ResourceID of the DiskEncryptionSet to be used for master and worker VMs.',
-                   validator=validate_disk_encryption_set)
-        c.argument('master_encryption_at_host', arg_type=get_three_state_flag(),
-                   options_list=['--master-encryption-at-host', '--master-enc-host'],
-                   help='Encryption at host flag for master VMs.')
         c.argument('master_vm_size',
                    help='Size of master VMs.')
 
-        c.argument('worker_encryption_at_host', arg_type=get_three_state_flag(),
-                   options_list=['--worker-encryption-at-host', '--worker-enc-host'],
-                   help='Encryption at host flag for worker VMs.')
         c.argument('worker_vm_size',
                    help='Size of worker VMs.')
         c.argument('worker_vm_disk_size_gb',
diff --git a/python/az/aro/azext_aro/_rbac.py b/python/az/aro/azext_aro/_rbac.py
index f096004d7..adcd7ffec 100644
--- a/python/az/aro/azext_aro/_rbac.py
+++ b/python/az/aro/azext_aro/_rbac.py
@@ -11,8 +11,7 @@ from knack.log import get_logger
 from msrest.exceptions import ValidationError
 from msrestazure.tools import resource_id
 
-ROLE_NETWORK_CONTRIBUTOR = '4d97b98b-1d4f-4787-a291-c67834d212e7'
-ROLE_READER = 'acdd72a7-3385-48ef-bd42-f606fba81ae7'
+NETWORK_CONTRIBUTOR = '4d97b98b-1d4f-4787-a291-c67834d212e7'
 
 logger = get_logger(__name__)
 
@@ -35,7 +34,7 @@ def _create_role_assignment(auth_client, resource, params):
             logger.warning("%s; retry %d of %d", ex, retries, max_retries)
 
 
-def assign_role_to_resource(cli_ctx, resource, object_id, role_name):
+def assign_network_contributor_to_resource(cli_ctx, resource, object_id):
     auth_client = get_mgmt_service_client(cli_ctx, ResourceType.MGMT_AUTHORIZATION)
 
     RoleAssignmentCreateParameters = get_sdk(cli_ctx, ResourceType.MGMT_AUTHORIZATION,
@@ -46,7 +45,7 @@ def assign_role_to_resource(cli_ctx, resource, object_id, role_name):
         subscription=get_subscription_id(cli_ctx),
         namespace='Microsoft.Authorization',
         type='roleDefinitions',
-        name=role_name,
+        name=NETWORK_CONTRIBUTOR,
     )
 
     _create_role_assignment(auth_client, resource, RoleAssignmentCreateParameters(
@@ -56,14 +55,14 @@ def assign_role_to_resource(cli_ctx, resource, object_id, role_name):
     ))
 
 
-def has_role_assignment_on_resource(cli_ctx, resource, object_id, role_name):
+def has_network_contributor_on_resource(cli_ctx, resource, object_id):
     auth_client = get_mgmt_service_client(cli_ctx, ResourceType.MGMT_AUTHORIZATION)
 
     role_definition_id = resource_id(
         subscription=get_subscription_id(cli_ctx),
         namespace='Microsoft.Authorization',
         type='roleDefinitions',
-        name=role_name,
+        name=NETWORK_CONTRIBUTOR,
     )
 
     for assignment in auth_client.role_assignments.list_for_scope(resource):
diff --git a/python/az/aro/azext_aro/_validators.py b/python/az/aro/azext_aro/_validators.py
index 07a1c24e5..e0a580824 100644
--- a/python/az/aro/azext_aro/_validators.py
+++ b/python/az/aro/azext_aro/_validators.py
@@ -9,7 +9,7 @@ import uuid
 from azure.cli.core.commands.client_factory import get_mgmt_service_client
 from azure.cli.core.commands.client_factory import get_subscription_id
 from azure.cli.core.profiles import ResourceType
-from azure.cli.core.azclierror import InvalidArgumentValueError, \
+from azure.cli.core.azclierror import CLIInternalError, InvalidArgumentValueError, \
     RequiredArgumentMissingError
 from knack.log import get_logger
 from msrestazure.azure_exceptions import CloudError
@@ -64,23 +64,6 @@ def validate_cluster_resource_group(cmd, namespace):
                 namespace.cluster_resource_group)
 
 
-def validate_disk_encryption_set(cmd, namespace):
-    if namespace.disk_encryption_set is not None:
-        if not is_valid_resource_id(namespace.disk_encryption_set):
-            raise InvalidArgumentValueError(
-                "Invalid --disk-encryption-set '%s', has to be a resource ID." %
-                namespace.disk_encryption_set)
-
-        desid = parse_resource_id(namespace.disk_encryption_set)
-        compute_client = get_mgmt_service_client(cmd.cli_ctx, ResourceType.MGMT_COMPUTE)
-        try:
-            compute_client.disk_encryption_sets.get(resource_group_name=desid['resource_group'],
-                                                    disk_encryption_set_name=desid['name'])
-        except CloudError as err:
-            raise InvalidArgumentValueError("Invald --disc-encryption-set, error when getting '%s': %s" %
-                                            (namespace.disk_encryption_set, err.message)) from err
-
-
 def validate_domain(namespace):
     if namespace.domain is not None:
         if not re.match(r'^' +
@@ -107,13 +90,6 @@ def validate_pull_secret(namespace):
             raise InvalidArgumentValueError("Invalid --pull-secret.") from e
 
 
-def validate_sdn(namespace):
-    if namespace.software_defined_network is not None:
-        if namespace.software_defined_network not in ['OVNKubernetes', 'OpenshiftSDN']:
-            raise InvalidArgumentValueError("Invalid --software-defined-network '%s'." %
-                                            namespace.software_defined_network)
-
-
 def validate_subnet(key):
     def _validate_subnet(cmd, namespace):
         subnet = getattr(namespace, key)
@@ -160,8 +136,7 @@ def validate_subnet(key):
             client.subnets.get(parts['resource_group'],
                                parts['name'], parts['child_name_1'])
         except CloudError as err:
-            raise InvalidArgumentValueError("Invald --%s, error when getting '%s': %s" %
-                                            (key.replace('_', '-'), subnet, err.message)) from err
+            raise CLIInternalError(err.message) from err
 
     return _validate_subnet
 
diff --git a/python/az/aro/azext_aro/commands.py b/python/az/aro/azext_aro/commands.py
index f0ef86ae7..29665ba94 100644
--- a/python/az/aro/azext_aro/commands.py
+++ b/python/az/aro/azext_aro/commands.py
@@ -10,7 +10,7 @@ from azext_aro._help import helps  # pylint: disable=unused-import
 
 def load_command_table(self, _):
     aro_sdk = CliCommandType(
-        operations_tmpl='azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2021_09_01_preview.operations#OpenShiftClustersOperations.{}',  # pylint: disable=line-too-long
+        operations_tmpl='azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2020_04_30.operations#OpenShiftClustersOperations.{}',  # pylint: disable=line-too-long
         client_factory=cf_aro)
 
     with self.command_group('aro', aro_sdk, client_factory=cf_aro) as g:
diff --git a/python/az/aro/azext_aro/custom.py b/python/az/aro/azext_aro/custom.py
index f557fc37d..fcdf60379 100644
--- a/python/az/aro/azext_aro/custom.py
+++ b/python/az/aro/azext_aro/custom.py
@@ -15,11 +15,10 @@ from msrestazure.tools import resource_id, parse_resource_id
 from msrest.exceptions import HttpOperationError
 from knack.log import get_logger
 
-import azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2021_09_01_preview.models as openshiftcluster
+import azext_aro.vendored_sdks.azure.mgmt.redhatopenshift.v2020_04_30.models as openshiftcluster
 
 from azext_aro._aad import AADManager
-from azext_aro._rbac import assign_role_to_resource, has_role_assignment_on_resource
-from azext_aro._rbac import ROLE_NETWORK_CONTRIBUTOR, ROLE_READER
+from azext_aro._rbac import assign_network_contributor_to_resource, has_network_contributor_on_resource
 from azext_aro._validators import validate_subnets
 
 logger = get_logger(__name__)
@@ -43,11 +42,7 @@ def aro_create(cmd,  # pylint: disable=too-many-locals
                client_secret=None,
                pod_cidr=None,
                service_cidr=None,
-               software_defined_network=None,
-               disk_encryption_set=None,
-               master_encryption_at_host=False,
                master_vm_size=None,
-               worker_encryption_at_host=False,
                worker_vm_size=None,
                worker_vm_disk_size_gb=None,
                worker_count=None,
@@ -109,13 +104,10 @@ def aro_create(cmd,  # pylint: disable=too-many-locals
         network_profile=openshiftcluster.NetworkProfile(
             pod_cidr=pod_cidr or '10.128.0.0/14',
             service_cidr=service_cidr or '172.30.0.0/16',
-            software_defined_network=software_defined_network or 'OpenShiftSDN'
         ),
         master_profile=openshiftcluster.MasterProfile(
             vm_size=master_vm_size or 'Standard_D8s_v3',
             subnet_id=master_subnet,
-            encryption_at_host='Enabled' if master_encryption_at_host else 'Disabled',
-            disk_encryption_set_id=disk_encryption_set,
         ),
         worker_profiles=[
             openshiftcluster.WorkerProfile(
@@ -124,8 +116,6 @@ def aro_create(cmd,  # pylint: disable=too-many-locals
                 disk_size_gb=worker_vm_disk_size_gb or 128,
                 subnet_id=worker_subnet,
                 count=worker_count or 3,
-                encryption_at_host='Enabled' if worker_encryption_at_host else 'Disabled',
-                disk_encryption_set_id=disk_encryption_set,
             )
         ],
         apiserver_profile=openshiftcluster.APIServerProfile(
@@ -289,13 +279,6 @@ def get_network_resources(cli_ctx, subnets, vnet):
     return resources
 
 
-def get_disk_encryption_resources(oc):
-    disk_encryption_set = oc.master_profile.disk_encryption_set_id
-    resources = set()
-    resources.add(disk_encryption_set)
-    return resources
-
-
 # cluster_application_update manages cluster application & service principal update
 # If called without parameters it should be best-effort
 # If called with parameters it fails if something is not possible
@@ -380,9 +363,8 @@ def resolve_rp_client_id():
 
 def ensure_resource_permissions(cli_ctx, oc, fail, sp_obj_ids):
     try:
-        # Get cluster resources we need to assign permissions on, sort to ensure the same order of operations
-        resources = {ROLE_NETWORK_CONTRIBUTOR: sorted(get_cluster_network_resources(cli_ctx, oc)),
-                     ROLE_READER: sorted(get_disk_encryption_resources(oc))}
+        # Get cluster resources we need to assign network contributor on
+        resources = get_cluster_network_resources(cli_ctx, oc)
     except (CloudError, HttpOperationError) as e:
         if fail:
             logger.error(e.message)
@@ -391,19 +373,18 @@ def ensure_resource_permissions(cli_ctx, oc, fail, sp_obj_ids):
         return
 
     for sp_id in sp_obj_ids:
-        for role in sorted(resources):
-            for resource in resources[role]:
-                # Create the role assignment if it doesn't exist
-                # Assume that the role assignment exists if we fail to look it up
-                resource_contributor_exists = True
-
-                try:
-                    resource_contributor_exists = has_role_assignment_on_resource(cli_ctx, resource, sp_id, role)
-                except CloudError as e:
-                    if fail:
-                        logger.error(e.message)
-                        raise
-                    logger.info(e.message)
-
-                if not resource_contributor_exists:
-                    assign_role_to_resource(cli_ctx, resource, sp_id, role)
+        for resource in sorted(resources):
+            # Create the role assignment if it doesn't exist
+            # Assume that the role assignment exists if we fail to look it up
+            resource_contributor_exists = True
+
+            try:
+                resource_contributor_exists = has_network_contributor_on_resource(cli_ctx, resource, sp_id)
+            except CloudError as e:
+                if fail:
+                    logger.error(e.message)
+                    raise
+                logger.info(e.message)
+
+            if not resource_contributor_exists:
+                assign_network_contributor_to_resource(cli_ctx, resource, sp_id)


Test patch:
diff --git a/.pipelines/e2e.yml b/.pipelines/e2e.yml
index 63130c655..9c871db0b 100644
--- a/.pipelines/e2e.yml
+++ b/.pipelines/e2e.yml
@@ -30,7 +30,6 @@ jobs:
   - template: ./templates/template-push-images-to-acr.yml
     parameters:
       rpImageACR: $(RP_IMAGE_ACR)
-      buildCommand: publish-image-aro
   - script: |
       set -e
       set -o pipefail
diff --git a/pkg/portal/middleware/aad_test.go b/pkg/portal/middleware/aad_test.go
index 39fac60db..78cbec76b 100644
--- a/pkg/portal/middleware/aad_test.go
+++ b/pkg/portal/middleware/aad_test.go
@@ -144,9 +144,8 @@ func TestAAD(t *testing.T) {
 			controller := gomock.NewController(t)
 			defer controller.Finish()
 			env := mock_env.NewMockInterface(controller)
-			env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
 			env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-			env.EXPECT().TenantID().AnyTimes().Return("common")
+			env.EXPECT().TenantID().AnyTimes().Return("")
 
 			_, audit := testlog.NewAudit()
 			_, baseLog := testlog.New()
@@ -244,9 +243,8 @@ func TestCheckAuthentication(t *testing.T) {
 			controller := gomock.NewController(t)
 			defer controller.Finish()
 			env := mock_env.NewMockInterface(controller)
-			env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
 			env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-			env.EXPECT().TenantID().AnyTimes().Return("common")
+			env.EXPECT().TenantID().AnyTimes().Return("")
 
 			_, audit := testlog.NewAudit()
 			_, baseLog := testlog.New()
@@ -325,8 +323,7 @@ func TestLogin(t *testing.T) {
 			defer controller.Finish()
 			env := mock_env.NewMockInterface(controller)
 			env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-			env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
-			env.EXPECT().TenantID().AnyTimes().Return("common")
+			env.EXPECT().TenantID().AnyTimes().Return("")
 
 			_, audit := testlog.NewAudit()
 			_, baseLog := testlog.New()
@@ -416,8 +413,7 @@ func TestLogout(t *testing.T) {
 			defer controller.Finish()
 			env := mock_env.NewMockInterface(controller)
 			env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-			env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
-			env.EXPECT().TenantID().AnyTimes().Return("common")
+			env.EXPECT().TenantID().AnyTimes().Return("")
 
 			_, audit := testlog.NewAudit()
 			_, baseLog := testlog.New()
@@ -743,8 +739,7 @@ func TestCallback(t *testing.T) {
 			defer controller.Finish()
 			env := mock_env.NewMockInterface(controller)
 			env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-			env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
-			env.EXPECT().TenantID().AnyTimes().Return("common")
+			env.EXPECT().TenantID().AnyTimes().Return("")
 
 			_, audit := testlog.NewAudit()
 			_, baseLog := testlog.New()
@@ -835,7 +830,7 @@ func TestClientAssertion(t *testing.T) {
 	env := mock_env.NewMockInterface(controller)
 	env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
 	env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-	env.EXPECT().TenantID().AnyTimes().Return("common")
+	env.EXPECT().TenantID().AnyTimes().Return("")
 
 	clientID := "00000000-0000-0000-0000-000000000000"
 	_, audit := testlog.NewAudit()