Repository: Azure/ARO-RP
Pull request #1581 (2021-07-06 22:36:30)

AAD Manager cloudaware changes
### Which issue this PR addresses:

<!--
https://msazure.visualstudio.com/AzureRedHatOpenShift/_workitems/edit/10146731/

Fix hard coded "az.aro.azure.com"
-->
Fixes

This makes AAD Manager cloud aware between Azure Public Cloud and Azure US Government Cloud

<!--
AAD Manager will examine the current cloud name context and provide the correct application url based on this context. Should the cloud name be set to a cloudname that is not supported it will error out. Supported clouds are Azure Public Cloud and Azure US Government Cloud
-->

### Test plan for issue:

<!--
How did you test that this PR works?

- We were able to write custom checks to extract and display the properly constructed MANAGED_APP_URL value
- Since the AAD Manager uses this functionality on the create feature (determines cloud name context) it will be possible to test this by simply creating resources in either (both) cloud name spaces with the same command.
-->

### Is there any documentation that needs to be updated for this PR?

<!--
Documentation should only be updated to reflect this change was made and AAD Manager now supports both cloud contexts, no procedural changes should have to be documented. 
-->


microsoft-cla[bot]: [![CLA assistant check](https://cla.opensource.microsoft.com/pull/badge/not_signed)](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1581) <br/>Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1581) before we can accept your contribution.<br/><br/>:x: jhoreman [sign now](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1581)<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla.opensource.microsoft.com/check/Azure/ARO-RP?pullRequest=1581) it.</sub>

Patch:
diff --git a/.sha256sum b/.sha256sum
index ff47d50c6..0a5334c47 100644
--- a/.sha256sum
+++ b/.sha256sum
@@ -1,2 +1,2 @@
 d2e11a7924d0cbb70672fb0dd6b1a387ccaec8b97a6968adf5a1516d325374eb  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2020-04-30/redhatopenshift.json
-bbdf867021e306b60677d1d6840e5059fe92f058f09e861a10e7c000d36868f9  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
+2f8edbcdc4b273f0102d3b0d0a02971a82e08457c0e37e50c1ac570542e1861d  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
diff --git a/Makefile b/Makefile
index 2a3300712..6db8e1ddc 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ build-portal:
 	cd portal && npm install && npm run build
 
 pyenv:
-	python3 -m venv pyenv
+	virtualenv --python=/usr/bin/python3 pyenv
 	. pyenv/bin/activate && \
 		pip install -U pip && \
 		pip install autopep8 azdev azure-mgmt-loganalytics==0.2.0 ruamel.yaml wheel && \
diff --git a/cmd/aro/dbtoken.go b/cmd/aro/dbtoken.go
index 25d281264..67129eacd 100644
--- a/cmd/aro/dbtoken.go
+++ b/cmd/aro/dbtoken.go
@@ -83,13 +83,7 @@ func dbtoken(ctx context.Context, log *logrus.Entry) error {
 		return err
 	}
 
-	// example value: https://login.microsoftonline.com/11111111-1111-1111-1111-111111111111/
-	issuer := _env.Environment().ActiveDirectoryEndpoint + _env.TenantID() + "/"
-
-	// example value: https://dbtoken.aro.azure.com/
-	clientID := "https://dbtoken." + _env.Environment().AppSuffix + "/"
-
-	verifier, err := oidc.NewVerifier(ctx, issuer, clientID)
+	verifier, err := oidc.NewVerifier(ctx, "https://sts.windows.net/"+_env.TenantID()+"/", pkgdbtoken.Resource)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/aro/operator.go b/cmd/aro/operator.go
index 04bad913a..8c118c112 100644
--- a/cmd/aro/operator.go
+++ b/cmd/aro/operator.go
@@ -124,7 +124,7 @@ func operator(ctx context.Context, log *logrus.Entry) error {
 		}
 		if err = (routefix.NewReconciler(
 			log.WithField("controller", controllers.RouteFixControllerName),
-			kubernetescli, securitycli, configcli, arocli, restConfig)).SetupWithManager(mgr); err != nil {
+			kubernetescli, securitycli, arocli, restConfig)).SetupWithManager(mgr); err != nil {
 			return fmt.Errorf("unable to create controller RouteFix: %v", err)
 		}
 		if err = (monitoring.NewReconciler(
diff --git a/deploy/env-development.json b/deploy/env-development.json
index 83d2c0ad2..0cd9f48bc 100644
--- a/deploy/env-development.json
+++ b/deploy/env-development.json
@@ -222,7 +222,7 @@
                                     "autoUpgradeMinorVersion": true,
                                     "settings": {},
                                     "protectedSettings": {
-                                        "script": "[base64(concat(base64ToString('c2V0IC1lCgo='),'CIAZPTOKEN=''',parameters('ciAzpToken'),'''\n','CIPOOLNAME=''',parameters('ciPoolName'),'''\n','\n',base64ToString('Cnl1bSAteSB1cGRhdGUgLXggV0FMaW51eEFnZW50CgpsdmV4dGVuZCAtbCArNTAlRlJFRSAvZGV2L3Jvb3R2Zy92YXJsdgp4ZnNfZ3Jvd2ZzIC92YXIKCmx2ZXh0ZW5kIC1sICsxMDAlRlJFRSAvZGV2L3Jvb3R2Zy9ob21lbHYKeGZzX2dyb3dmcyAvaG9tZQoKcnBtIC0taW1wb3J0IGh0dHBzOi8vZGwuZmVkb3JhcHJvamVjdC5vcmcvcHViL2VwZWwvUlBNLUdQRy1LRVktRVBFTC03CnJwbSAtLWltcG9ydCBodHRwczovL3BhY2thZ2VzLm1pY3Jvc29mdC5jb20va2V5cy9taWNyb3NvZnQuYXNjCgp5dW0gLXkgaW5zdGFsbCBodHRwczovL2RsLmZlZG9yYXByb2plY3Qub3JnL3B1Yi9lcGVsL2VwZWwtcmVsZWFzZS1sYXRlc3QtNy5ub2FyY2gucnBtCgpjYXQgPi9ldGMveXVtLnJlcG9zLmQvYXp1cmUucmVwbyA8PCdFT0YnClthenVyZS1jbGldCm5hbWU9YXp1cmUtY2xpCmJhc2V1cmw9aHR0cHM6Ly9wYWNrYWdlcy5taWNyb3NvZnQuY29tL3l1bXJlcG9zL2F6dXJlLWNsaQplbmFibGVkPXllcwpncGdjaGVjaz15ZXMKRU9GCgp5dW0gLS1lbmFibGVyZXBvPXJodWktcmhlbC03LXNlcnZlci1yaHVpLW9wdGlvbmFsLXJwbXMgLXkgaW5zdGFsbCBhenVyZS1jbGkgZG9ja2VyIGpxIGdjYyByaC1naXQyOSByaC1weXRob24zNiB0bXB3YXRjaAoKR09fVkVSU0lPTj0xLjE0LjkKY3VybCBodHRwczovL2RsLmdvb2dsZS5jb20vZ28vZ28ke0dPX1ZFUlNJT059LmxpbnV4LWFtZDY0LnRhci5neiB8IHRhciAtQyAvdXNyL2xvY2FsIC14egpsbiAtcyAvdXNyL2xvY2FsL2dvL2Jpbi8qIC91c3IvbG9jYWwvYmluCgpWU1RTX0FHRU5UX1ZFUlNJT049Mi4xODguMwpta2RpciAvaG9tZS9jbG91ZC11c2VyL2FnZW50CnB1c2hkIC9ob21lL2Nsb3VkLXVzZXIvYWdlbnQKY3VybCBodHRwczovL3ZzdHNhZ2VudHBhY2thZ2UuYXp1cmVlZGdlLm5ldC9hZ2VudC8ke1ZTVFNfQUdFTlRfVkVSU0lPTn0vdnN0cy1hZ2VudC1saW51eC14NjQtJHtWU1RTX0FHRU5UX1ZFUlNJT059LnRhci5neiB8IHRhciAteHoKY2hvd24gLVIgY2xvdWQtdXNlcjpjbG91ZC11c2VyIC4KCi4vYmluL2luc3RhbGxkZXBlbmRlbmNpZXMuc2gKc3VkbyAtdSBjbG91ZC11c2VyIC4vY29uZmlnLnNoIC0tdW5hdHRlbmRlZCAtLXVybCBodHRwczovL2Rldi5henVyZS5jb20vbXNhenVyZSAtLWF1dGggcGF0IC0tdG9rZW4gIiRDSUFaUFRPS0VOIiAtLXBvb2wgIiRDSVBPT0xOQU1FIiAtLWFnZW50ICJBUk8tUkhFTC0kSE9TVE5BTUUiIC0tcmVwbGFjZQouL3N2Yy5zaCBpbnN0YWxsIGNsb3VkLXVzZXIKcG9wZAoKIyBtZXJnZSBpbiAvb3B0L3JoL3JoLSovZW5hYmxlCmNhdCA+L2hvbWUvY2xvdWQtdXNlci9hZ2VudC8ucGF0aCA8PCdFT0YnCi9vcHQvcmgvcmgtcHl0aG9uMzYvcm9vdC91c3IvYmluOi9vcHQvcmgvcmgtZ2l0Mjkvcm9vdC91c3IvYmluOi91c3IvbG9jYWwvYmluOi91c3IvYmluOi91c3IvbG9jYWwvc2JpbjovdXNyL3NiaW46L2hvbWUvY2xvdWQtdXNlci8ubG9jYWwvYmluOi9ob21lL2Nsb3VkLXVzZXIvYmluCkVPRgoKY2F0ID4vaG9tZS9jbG91ZC11c2VyL2FnZW50Ly5lbnYgPDwnRU9GJwpMRF9MSUJSQVJZX1BBVEg9L29wdC9yaC9yaC1weXRob24zNi9yb290L3Vzci9saWI2NDovb3B0L3JoL2h0dHBkMjQvcm9vdC91c3IvbGliNjQKTUFOUEFUSD0vb3B0L3JoL3JoLXB5dGhvbjM2L3Jvb3QvdXNyL3NoYXJlL21hbjovb3B0L3JoL3JoLWdpdDI5L3Jvb3QvdXNyL3NoYXJlL21hbgpQRVJMNUxJQj0vb3B0L3JoL3JoLWdpdDI5L3Jvb3QvdXNyL3NoYXJlL3Blcmw1L3ZlbmRvcl9wZXJsClBLR19DT05GSUdfUEFUSD0vb3B0L3JoL3JoLXB5dGhvbjM2L3Jvb3QvdXNyL2xpYjY0L3BrZ2NvbmZpZwpYREdfREFUQV9ESVJTPS9vcHQvcmgvcmgtcHl0aG9uMzYvcm9vdC91c3Ivc2hhcmU6L3Vzci9sb2NhbC9zaGFyZTovdXNyL3NoYXJlCkVPRgoKc2VkIC1pIC1lICdzL15PUFRJT05TPSdcJycvT1BUSU9OUz0nXCcnLUcgY2xvdWQtdXNlciAvJyAvZXRjL3N5c2NvbmZpZy9kb2NrZXIKCnN5c3RlbWN0bCBlbmFibGUgZG9ja2VyCgpjYXQgPi9ldGMvY3Jvbi5ob3VybHkvdG1wd2F0Y2ggPDwnRU9GJwojIS9iaW4vYmFzaAoKZXhlYyAvc2Jpbi90bXB3YXRjaCAyNGggL3RtcApFT0YKY2htb2QgK3ggL2V0Yy9jcm9uLmhvdXJseS90bXB3YXRjaAoKKHNsZWVwIDMwOyByZWJvb3QpICYK')))]"
+                                        "script": "[base64(concat(base64ToString('c2V0IC1lCgo='),'CIAZPTOKEN=''',parameters('ciAzpToken'),'''\n','CIPOOLNAME=''',parameters('ciPoolName'),'''\n','\n',base64ToString('Cnl1bSAteSB1cGRhdGUgLXggV0FMaW51eEFnZW50CgpsdmV4dGVuZCAtbCArNTAlRlJFRSAvZGV2L3Jvb3R2Zy92YXJsdgp4ZnNfZ3Jvd2ZzIC92YXIKCmx2ZXh0ZW5kIC1sICsxMDAlRlJFRSAvZGV2L3Jvb3R2Zy9ob21lbHYKeGZzX2dyb3dmcyAvaG9tZQoKcnBtIC0taW1wb3J0IGh0dHBzOi8vZGwuZmVkb3JhcHJvamVjdC5vcmcvcHViL2VwZWwvUlBNLUdQRy1LRVktRVBFTC03CnJwbSAtLWltcG9ydCBodHRwczovL3BhY2thZ2VzLm1pY3Jvc29mdC5jb20va2V5cy9taWNyb3NvZnQuYXNjCgp5dW0gLXkgaW5zdGFsbCBodHRwczovL2RsLmZlZG9yYXByb2plY3Qub3JnL3B1Yi9lcGVsL2VwZWwtcmVsZWFzZS1sYXRlc3QtNy5ub2FyY2gucnBtCgpjYXQgPi9ldGMveXVtLnJlcG9zLmQvYXp1cmUucmVwbyA8PCdFT0YnClthenVyZS1jbGldCm5hbWU9YXp1cmUtY2xpCmJhc2V1cmw9aHR0cHM6Ly9wYWNrYWdlcy5taWNyb3NvZnQuY29tL3l1bXJlcG9zL2F6dXJlLWNsaQplbmFibGVkPXllcwpncGdjaGVjaz15ZXMKRU9GCgp5dW0gLS1lbmFibGVyZXBvPXJodWktcmhlbC03LXNlcnZlci1yaHVpLW9wdGlvbmFsLXJwbXMgLXkgaW5zdGFsbCBhenVyZS1jbGkgZG9ja2VyIGpxIGdjYyByaC1naXQyOSByaC1weXRob24zNiB0bXB3YXRjaCBsdHRuZy11c3IKCkdPX1ZFUlNJT049MS4xNC45CmN1cmwgaHR0cHM6Ly9kbC5nb29nbGUuY29tL2dvL2dvJHtHT19WRVJTSU9OfS5saW51eC1hbWQ2NC50YXIuZ3ogfCB0YXIgLUMgL3Vzci9sb2NhbCAteHoKbG4gLXMgL3Vzci9sb2NhbC9nby9iaW4vKiAvdXNyL2xvY2FsL2JpbgoKVlNUU19BR0VOVF9WRVJTSU9OPTIuMTgxLjEKbWtkaXIgL2hvbWUvY2xvdWQtdXNlci9hZ2VudApwdXNoZCAvaG9tZS9jbG91ZC11c2VyL2FnZW50CmN1cmwgaHR0cHM6Ly92c3RzYWdlbnRwYWNrYWdlLmF6dXJlZWRnZS5uZXQvYWdlbnQvJHtWU1RTX0FHRU5UX1ZFUlNJT059L3ZzdHMtYWdlbnQtbGludXgteDY0LSR7VlNUU19BR0VOVF9WRVJTSU9OfS50YXIuZ3ogfCB0YXIgLXh6CmNob3duIC1SIGNsb3VkLXVzZXI6Y2xvdWQtdXNlciAuCgouL2Jpbi9pbnN0YWxsZGVwZW5kZW5jaWVzLnNoCnN1ZG8gLXUgY2xvdWQtdXNlciAuL2NvbmZpZy5zaCAtLXVuYXR0ZW5kZWQgLS11cmwgaHR0cHM6Ly9kZXYuYXp1cmUuY29tL21zYXp1cmUgLS1hdXRoIHBhdCAtLXRva2VuICIkQ0lBWlBUT0tFTiIgLS1wb29sICIkQ0lQT09MTkFNRSIgLS1hZ2VudCAiQVJPLVJIRUwtJEhPU1ROQU1FIiAtLXJlcGxhY2UKLi9zdmMuc2ggaW5zdGFsbCBjbG91ZC11c2VyCnBvcGQKCiMgbWVyZ2UgaW4gL29wdC9yaC9yaC0qL2VuYWJsZQpjYXQgPi9ob21lL2Nsb3VkLXVzZXIvYWdlbnQvLnBhdGggPDwnRU9GJwovb3B0L3JoL3JoLXB5dGhvbjM2L3Jvb3QvdXNyL2Jpbjovb3B0L3JoL3JoLWdpdDI5L3Jvb3QvdXNyL2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2JpbjovdXNyL2xvY2FsL3NiaW46L3Vzci9zYmluOi9ob21lL2Nsb3VkLXVzZXIvLmxvY2FsL2JpbjovaG9tZS9jbG91ZC11c2VyL2JpbgpFT0YKCmNhdCA+L2hvbWUvY2xvdWQtdXNlci9hZ2VudC8uZW52IDw8J0VPRicKTERfTElCUkFSWV9QQVRIPS9vcHQvcmgvcmgtcHl0aG9uMzYvcm9vdC91c3IvbGliNjQ6L29wdC9yaC9odHRwZDI0L3Jvb3QvdXNyL2xpYjY0Ck1BTlBBVEg9L29wdC9yaC9yaC1weXRob24zNi9yb290L3Vzci9zaGFyZS9tYW46L29wdC9yaC9yaC1naXQyOS9yb290L3Vzci9zaGFyZS9tYW4KUEVSTDVMSUI9L29wdC9yaC9yaC1naXQyOS9yb290L3Vzci9zaGFyZS9wZXJsNS92ZW5kb3JfcGVybApQS0dfQ09ORklHX1BBVEg9L29wdC9yaC9yaC1weXRob24zNi9yb290L3Vzci9saWI2NC9wa2djb25maWcKWERHX0RBVEFfRElSUz0vb3B0L3JoL3JoLXB5dGhvbjM2L3Jvb3QvdXNyL3NoYXJlOi91c3IvbG9jYWwvc2hhcmU6L3Vzci9zaGFyZQpFT0YKCnNlZCAtaSAtZSAncy9eT1BUSU9OUz0nXCcnL09QVElPTlM9J1wnJy1HIGNsb3VkLXVzZXIgLycgL2V0Yy9zeXNjb25maWcvZG9ja2VyCgpzeXN0ZW1jdGwgZW5hYmxlIGRvY2tlcgoKY2F0ID4vZXRjL2Nyb24uaG91cmx5L3RtcHdhdGNoIDw8J0VPRicKIyEvYmluL2Jhc2gKCmV4ZWMgL3NiaW4vdG1wd2F0Y2ggMjRoIC90bXAKRU9GCmNobW9kICt4IC9ldGMvY3Jvbi5ob3VybHkvdG1wd2F0Y2gKCihzbGVlcCAzMDsgcmVib290KSAmCg==')))]"
                                     }
                                 }
                             }
diff --git a/docs/deploy-development-rp.md b/docs/deploy-development-rp.md
index f02a9d558..a2abac2ff 100644
--- a/docs/deploy-development-rp.md
+++ b/docs/deploy-development-rp.md
@@ -134,12 +134,6 @@
      ```bash
      journalctl _COMM=aro -o json --since "15 min ago" -f | jq -r 'select (.COMPONENT != null and (.COMPONENT | contains("access"))|not) | .MESSAGE'
      ```
-     
-   * Perform AdminUpdate on a dev cluster
-   
-```bash
-export CLUSTER=cluster
-curl -X PATCH -k "https://localhost:8443/subscriptions/$AZURE_SUBSCRIPTION_ID/resourceGroups/$RESOURCEGROUP/providers/Microsoft.RedHatOpenShift/openShiftClusters/$CLUSTER?api-version=admin" --header "Content-Type: application/json" -d "{}"
 
 ## Debugging
 
diff --git a/go.mod b/go.mod
index f5384a994..a961c45bf 100644
--- a/go.mod
+++ b/go.mod
@@ -243,7 +243,7 @@ replace (
 	github.com/openshift/cluster-api-provider-libvirt => github.com/openshift/cluster-api-provider-libvirt v0.2.1-0.20210324200850-033be25ca038
 	github.com/openshift/cluster-api-provider-ovirt => github.com/openshift/cluster-api-provider-ovirt v0.1.1-0.20210409185359-01b9bf8368a3
 	github.com/openshift/console-operator => github.com/openshift/console-operator v0.0.0-20210323072657-4f933d59784b
-	github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+	github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 	github.com/openshift/library-go => github.com/openshift/library-go v0.0.0-20210205203934-9eb0d970f2f4
 	github.com/openshift/machine-api-operator => github.com/openshift/machine-api-operator v0.2.1-0.20210521181620-e179bb5ce397
 	github.com/openshift/machine-config-operator => github.com/openshift/machine-config-operator v0.0.1-0.20210522053223-c4b7e3f5118d
diff --git a/go.sum b/go.sum
index 82644594a..200238e8b 100644
--- a/go.sum
+++ b/go.sum
@@ -831,7 +831,6 @@ github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgO
 github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-ldap/ldap/v3 v3.1.3/go.mod h1:3rbOH3jRS2u6jg2rJnKAMLE/xQyCKIveG2Sa/Cohzb8=
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
-github.com/go-log/log v0.0.0-20181211034820-a514cf01a3eb/go.mod h1:4mBwpdRMFLiuXZDCwU2lKQFsoSCo72j3HqBK9d81N2M=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0 h1:TrB8swr/68K7m9CcGut2g3UOihhbcbiMAYiuTXdEih4=
@@ -1197,7 +1196,6 @@ github.com/gophercloud/gophercloud v0.6.0/go.mod h1:GICNByuaEBibcjmjvI7QvYJSZEbG
 github.com/gophercloud/gophercloud v0.6.1-0.20191122030953-d8ac278c1c9d/go.mod h1:ozGNgr9KYOVATV5jsgHl/ceCDXGuguqOZAzoQ/2vcNM=
 github.com/gophercloud/gophercloud v0.10.1-0.20200424014253-c3bfe50899e5/go.mod h1:gmC5oQqMDOMO1t1gq5DquX/yAU808e/4mzjjDA76+Ss=
 github.com/gophercloud/gophercloud v0.12.0/go.mod h1:gmC5oQqMDOMO1t1gq5DquX/yAU808e/4mzjjDA76+Ss=
-github.com/gophercloud/gophercloud v0.12.1-0.20200827191144-bb4781e9de45/go.mod h1:w2NJEd88d4igNL1KUHzBsKMvS/ByJTzgltTGWKT7AC8=
 github.com/gophercloud/gophercloud v0.14.0/go.mod h1:VX0Ibx85B60B5XOrZr6kaNwrmPUzcmMpwxvQ1WQIIWM=
 github.com/gophercloud/gophercloud v0.15.1-0.20210202035223-633d73521055 h1:/wFA5WAzWcHNjpUs/Vuf4g2Sbv0wj3MUkZdeYgU4RkI=
 github.com/gophercloud/gophercloud v0.15.1-0.20210202035223-633d73521055/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075O6i+LY+pXsKCBsb4=
@@ -1208,8 +1206,6 @@ github.com/gophercloud/gophercloud v0.17.0/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075
 github.com/gophercloud/utils v0.0.0-20190128072930-fbb6ab446f01/go.mod h1:wjDF8z83zTeg5eMLml5EBSlAhbF7G8DobyI1YsMuyzw=
 github.com/gophercloud/utils v0.0.0-20190313033024-0bcc8e728cb5/go.mod h1:SZ9FTKibIotDtCrxAU/evccoyu1yhKST6hgBvwTB5Eg=
 github.com/gophercloud/utils v0.0.0-20200423144003-7c72efc7435d/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
-github.com/gophercloud/utils v0.0.0-20201101202656-8677e053dcf1/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
-github.com/gophercloud/utils v0.0.0-20201212031956-9dc30e126fea/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
 github.com/gophercloud/utils v0.0.0-20201221031838-d93cf4b3fa50/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
 github.com/gophercloud/utils v0.0.0-20210202040619-eca783186fc4/go.mod h1:wx8HMD8oQD0Ryhz6+6ykq75PJ79iPyEqYHfwZ4l7OsA=
 github.com/gophercloud/utils v0.0.0-20210323225332-7b186010c04f h1:+SO5iEqu9QjNWL9TfAmOE5u0Uizv1T3jpBuMJfMOVJ0=
@@ -1677,8 +1673,6 @@ github.com/lucas-clemente/quic-go-certificates v0.0.0-20160823095156-d2f86524cce
 github.com/lunixbochs/vtclean v0.0.0-20180621232353-2d01aacdc34a/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/lusis/go-artifactory v0.0.0-20160115162124-7e4ce345df82/go.mod h1:y54tfGmO3NKssKveTEFFzH8C/akrSOy/iW9qEAUDV84=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
-github.com/m1kola/installer v0.9.0-master.0.20210630161242-27df43e9d740 h1:8zCYpBox/rp3xPl5VPJd8F3GBbIv0azl3UpbjzDdD7Q=
-github.com/m1kola/installer v0.9.0-master.0.20210630161242-27df43e9d740/go.mod h1:zpOMUCsYL2u6M2QWWfEXeP15GAgxA7zREDQidMVlb6g=
 github.com/magiconair/properties v1.7.6/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
@@ -1826,11 +1820,8 @@ github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mjudeikis/go-cosmosdb v0.0.0-20210518104404-b205b3cefd36 h1:K0yb4fqa1rYPEbdlv3rYz0vh1aHK0Jkd+EscS1Yi5wI=
 github.com/mjudeikis/go-cosmosdb v0.0.0-20210518104404-b205b3cefd36/go.mod h1:l/LMyUQzbW3Pe62a6huel6S/5ED0KrkkqSQdwiGueUI=
-github.com/mjudeikis/installer v0.9.0-master.0.20210429223823-8452b42b403f/go.mod h1:XopVolWA5M92yeZlj7+QLXyKMXKdU0mCUz3B/QiaMqk=
 github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a h1:CUatJN+U9y8AGqzfbvjQcnPKiJaK5gCZEIYpMqZr3/8=
 github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a/go.mod h1:wRAY/doOkyi+sihbkl88EAMg11+3ZvPPBpGqI7iPVq0=
-github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f h1:YFwFCTJ00yKhwCvBXcLEPMMSnrYCxGn2AIQFUORFVtQ=
-github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f/go.mod h1:2NZuOXMJqLgSEHtluChgLLWrZ3QcAVLKPfNYAClFEQk=
 github.com/moby/ipvs v1.0.1/go.mod h1:2pngiyseZbIKXNv7hsKj3O9UEz30c53MT9005gt2hxQ=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/sys/mountinfo v0.1.3/go.mod h1:w2t2Avltqx8vE7gX5l+QiBKxODu2TX0+Syr3h52Tw4o=
@@ -1992,7 +1983,6 @@ github.com/openshift/client-go v0.0.0-20210112165513-ebc401615f47 h1:+TEY29DK0Xh
 github.com/openshift/client-go v0.0.0-20210112165513-ebc401615f47/go.mod h1:u7NRAjtYVAKokiI9LouzTv4mhds8P4S1TwdVAfbjKSk=
 github.com/openshift/cloud-credential-operator v0.0.0-20200316201045-d10080b52c9e h1:2gyl9UVyjHSWzdS56KUXxQwIhENbq2x2olqoMQSA/C8=
 github.com/openshift/cloud-credential-operator v0.0.0-20200316201045-d10080b52c9e/go.mod h1:iPn+uhIe7nkP5BMHe2QnbLtg5m/AIQ1xvz9s3cig5ss=
-github.com/openshift/cluster-api v0.0.0-20191030113141-9a3a7bbe9258/go.mod h1:T18COkr6nLh9RyZKPMP7YjnwBME7RX8P2ar1SQbBltM=
 github.com/openshift/cluster-api-provider-aws v0.2.1-0.20210521181620-82202163e220 h1:1IlB0rbC2/+p7NThPKZLZflRdjgFXKI6RO4/8MkSXjE=
 github.com/openshift/cluster-api-provider-aws v0.2.1-0.20210521181620-82202163e220/go.mod h1:Cgv+fW4yIs1jmMu1c/tMB+OqUYufTEHtMxNW1bqIY+Q=
 github.com/openshift/cluster-api-provider-azure v0.1.0-alpha.3.0.20210318155632-e744815d9f05 h1:CAeRddO33GB66NNlS5jhlogu8BQOpKRkmJn6KDjufA0=
@@ -2156,7 +2146,6 @@ github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7q
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20190104105734-b1c43a6df3ae/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.1.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -2389,7 +2378,6 @@ github.com/tdakkota/asciicheck v0.0.0-20200416200610-e657995f937b h1:HxLVTlqcHhF
 github.com/tdakkota/asciicheck v0.0.0-20200416200610-e657995f937b/go.mod h1:yHp0ai0Z9gUljN3o0xMhYJnH/IcvkdTBOX2fmJ93JEM=
 github.com/tencentcloud/tencentcloud-sdk-go v3.0.82+incompatible/go.mod h1:0PfYow01SHPMhKY31xa+EFz2RStxIqj6JFAJS+IkCi4=
 github.com/tencentyun/cos-go-sdk-v5 v0.0.0-20190808065407-f07404cefc8c/go.mod h1:wk2XFUg6egk4tSDNZtXeKfe2G6690UVyt163PuUxBZk=
-github.com/terraform-provider-openstack/terraform-provider-openstack v1.33.0/go.mod h1:NA2Iaq+p8yIzeHAY9DHEedL/SqrT0AInYP9GTqVLe1k=
 github.com/terraform-provider-openstack/terraform-provider-openstack v1.37.0/go.mod h1:tPCEc/DdR9fVX9rmcJiqa85oTG7BUb5Xc0bSY/aOTf8=
 github.com/terraform-providers/terraform-provider-azuread v0.9.0/go.mod h1:sSDzB/8CD639+yWo5lZf+NJvGSYQBSS6z+GoET9IrzE=
 github.com/terraform-providers/terraform-provider-google v1.20.1-0.20200623174414-27107f2ee160/go.mod h1:QxehqxV8Swl+O2JXJUdS6orHYJXWUEr4HFfYH5JV9ew=
@@ -2731,7 +2719,6 @@ golang.org/x/net v0.0.0-20190619014844-b5b0513f8c1b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -3112,7 +3099,6 @@ google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20200911024640-645f7a48b24f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -3327,7 +3313,6 @@ k8s.io/system-validators v1.1.2/go.mod h1:bPldcLgkIUK22ALflnsXk8pvkTEndYdNuaHH6g
 k8s.io/utils v0.0.0-20190308190857-21c4ce38f2a7/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
 k8s.io/utils v0.0.0-20190712204705-3dccf664f023/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20190801114015-581e00157fb1/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
-k8s.io/utils v0.0.0-20190923111123-69764acb6e8e/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20191114200735-6ca3b61696b6/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20200411171748-3d5a2fe318e4/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20200414100711-2df71ebbae66/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
diff --git a/hack/licenses/licenses.go b/hack/licenses/licenses.go
index f57d2afd5..694d4e045 100644
--- a/hack/licenses/licenses.go
+++ b/hack/licenses/licenses.go
@@ -26,7 +26,7 @@ func applyGoLicense() error {
 		}
 
 		switch path {
-		case "pkg/client", "vendor", ".git":
+		case "pkg/client", "vendor":
 			return filepath.SkipDir
 		}
 
diff --git a/pkg/api/admin/openshiftcluster.go b/pkg/api/admin/openshiftcluster.go
index b72bf14d4..912b3b28f 100644
--- a/pkg/api/admin/openshiftcluster.go
+++ b/pkg/api/admin/openshiftcluster.go
@@ -48,7 +48,6 @@ type OpenShiftClusterProperties struct {
 	Install                 *Install                `json:"install,omitempty"`
 	StorageSuffix           string                  `json:"storageSuffix,omitempty"`
 	RegistryProfiles        []RegistryProfile       `json:"registryProfiles,omitempty"`
-	InfraID                 string                  `json:"infraId,omitempty"`
 }
 
 // ProvisioningState represents a provisioning state.
@@ -92,10 +91,8 @@ type NetworkProfile struct {
 
 // MasterProfile represents a master profile.
 type MasterProfile struct {
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	VMSize   VMSize `json:"vmSize,omitempty"`
+	SubnetID string `json:"subnetId,omitempty"`
 }
 
 // VMSize represents a VM size.
@@ -135,13 +132,11 @@ const (
 
 // WorkerProfile represents a worker profile.
 type WorkerProfile struct {
-	Name                string `json:"name,omitempty"`
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	DiskSizeGB          int    `json:"diskSizeGB,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	Count               int    `json:"count,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	Name       string `json:"name,omitempty"`
+	VMSize     VMSize `json:"vmSize,omitempty"`
+	DiskSizeGB int    `json:"diskSizeGB,omitempty"`
+	SubnetID   string `json:"subnetId,omitempty"`
+	Count      int    `json:"count,omitempty"`
 }
 
 // APIServerProfile represents an API server profile.
diff --git a/pkg/api/admin/openshiftcluster_convert.go b/pkg/api/admin/openshiftcluster_convert.go
index 30d109029..421f152ea 100644
--- a/pkg/api/admin/openshiftcluster_convert.go
+++ b/pkg/api/admin/openshiftcluster_convert.go
@@ -46,10 +46,8 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 				APIServerPrivateEndpointIP: oc.Properties.NetworkProfile.APIServerPrivateEndpointIP,
 			},
 			MasterProfile: MasterProfile{
-				VMSize:              VMSize(oc.Properties.MasterProfile.VMSize),
-				SubnetID:            oc.Properties.MasterProfile.SubnetID,
-				EncryptionAtHost:    oc.Properties.MasterProfile.EncryptionAtHost,
-				DiskEncryptionSetID: oc.Properties.MasterProfile.DiskEncryptionSetID,
+				VMSize:   VMSize(oc.Properties.MasterProfile.VMSize),
+				SubnetID: oc.Properties.MasterProfile.SubnetID,
 			},
 			APIServerProfile: APIServerProfile{
 				Visibility: Visibility(oc.Properties.APIServerProfile.Visibility),
@@ -58,7 +56,6 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 				IntIP:      oc.Properties.APIServerProfile.IntIP,
 			},
 			StorageSuffix: oc.Properties.StorageSuffix,
-			InfraID:       oc.Properties.InfraID,
 		},
 	}
 
@@ -66,13 +63,11 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 		out.Properties.WorkerProfiles = make([]WorkerProfile, 0, len(oc.Properties.WorkerProfiles))
 		for _, p := range oc.Properties.WorkerProfiles {
 			out.Properties.WorkerProfiles = append(out.Properties.WorkerProfiles, WorkerProfile{
-				Name:                p.Name,
-				VMSize:              VMSize(p.VMSize),
-				DiskSizeGB:          p.DiskSizeGB,
-				SubnetID:            p.SubnetID,
-				Count:               p.Count,
-				EncryptionAtHost:    p.EncryptionAtHost,
-				DiskEncryptionSetID: p.DiskEncryptionSetID,
+				Name:       p.Name,
+				VMSize:     VMSize(p.VMSize),
+				DiskSizeGB: p.DiskSizeGB,
+				SubnetID:   p.SubnetID,
+				Count:      p.Count,
 			})
 		}
 	}
@@ -156,7 +151,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 		}
 	}
 	out.Properties.ArchitectureVersion = api.ArchitectureVersion(oc.Properties.ArchitectureVersion)
-	out.Properties.InfraID = oc.Properties.InfraID
 	out.Properties.ProvisioningState = api.ProvisioningState(oc.Properties.ProvisioningState)
 	out.Properties.LastProvisioningState = api.ProvisioningState(oc.Properties.LastProvisioningState)
 	out.Properties.FailedProvisioningState = api.ProvisioningState(oc.Properties.FailedProvisioningState)
@@ -174,8 +168,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 	out.Properties.NetworkProfile.APIServerPrivateEndpointIP = oc.Properties.NetworkProfile.APIServerPrivateEndpointIP
 	out.Properties.MasterProfile.VMSize = api.VMSize(oc.Properties.MasterProfile.VMSize)
 	out.Properties.MasterProfile.SubnetID = oc.Properties.MasterProfile.SubnetID
-	out.Properties.MasterProfile.EncryptionAtHost = oc.Properties.MasterProfile.EncryptionAtHost
-	out.Properties.MasterProfile.DiskEncryptionSetID = oc.Properties.MasterProfile.DiskEncryptionSetID
 	out.Properties.StorageSuffix = oc.Properties.StorageSuffix
 	out.Properties.WorkerProfiles = nil
 	if oc.Properties.WorkerProfiles != nil {
@@ -186,8 +178,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 			out.Properties.WorkerProfiles[i].DiskSizeGB = oc.Properties.WorkerProfiles[i].DiskSizeGB
 			out.Properties.WorkerProfiles[i].SubnetID = oc.Properties.WorkerProfiles[i].SubnetID
 			out.Properties.WorkerProfiles[i].Count = oc.Properties.WorkerProfiles[i].Count
-			out.Properties.WorkerProfiles[i].EncryptionAtHost = oc.Properties.WorkerProfiles[i].EncryptionAtHost
-			out.Properties.WorkerProfiles[i].DiskEncryptionSetID = oc.Properties.WorkerProfiles[i].DiskEncryptionSetID
 		}
 	}
 	out.Properties.APIServerProfile.Visibility = api.Visibility(oc.Properties.APIServerProfile.Visibility)
diff --git a/pkg/api/openshiftcluster.go b/pkg/api/openshiftcluster.go
index bea941228..50b1ecdb8 100644
--- a/pkg/api/openshiftcluster.go
+++ b/pkg/api/openshiftcluster.go
@@ -206,10 +206,8 @@ type NetworkProfile struct {
 type MasterProfile struct {
 	MissingFields
 
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	VMSize   VMSize `json:"vmSize,omitempty"`
+	SubnetID string `json:"subnetId,omitempty"`
 }
 
 // VMSize represents a VM size
@@ -252,13 +250,11 @@ const (
 type WorkerProfile struct {
 	MissingFields
 
-	Name                string `json:"name,omitempty"`
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	DiskSizeGB          int    `json:"diskSizeGB,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	Count               int    `json:"count,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	Name       string `json:"name,omitempty"`
+	VMSize     VMSize `json:"vmSize,omitempty"`
+	DiskSizeGB int    `json:"diskSizeGB,omitempty"`
+	SubnetID   string `json:"subnetId,omitempty"`
+	Count      int    `json:"count,omitempty"`
 }
 
 // APIServerProfile represents an API server profile
diff --git a/pkg/api/v20210131preview/openshiftcluster.go b/pkg/api/v20210131preview/openshiftcluster.go
index d471c4550..b74e4d61c 100644
--- a/pkg/api/v20210131preview/openshiftcluster.go
+++ b/pkg/api/v20210131preview/openshiftcluster.go
@@ -130,12 +130,6 @@ type MasterProfile struct {
 
 	// The Azure resource ID of the master subnet.
 	SubnetID string `json:"subnetId,omitempty"`
-
-	// Whether master virtual machines are encrypted at host.
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
-	// The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // VMSize represents a VM size.
@@ -189,12 +183,6 @@ type WorkerProfile struct {
 
 	// The number of worker VMs.
 	Count int `json:"count,omitempty"`
-
-	// Whether master virtual machines are encrypted at host.
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
-	// The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // APIServerProfile represents an API server profile.
diff --git a/pkg/api/v20210131preview/openshiftcluster_convert.go b/pkg/api/v20210131preview/openshiftcluster_convert.go
index c2fdbdc82..2ada8178a 100644
--- a/pkg/api/v20210131preview/openshiftcluster_convert.go
+++ b/pkg/api/v20210131preview/openshiftcluster_convert.go
@@ -39,10 +39,8 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 				ServiceCIDR: oc.Properties.NetworkProfile.ServiceCIDR,
 			},
 			MasterProfile: MasterProfile{
-				VMSize:              VMSize(oc.Properties.MasterProfile.VMSize),
-				SubnetID:            oc.Properties.MasterProfile.SubnetID,
-				EncryptionAtHost:    oc.Properties.MasterProfile.EncryptionAtHost,
-				DiskEncryptionSetID: oc.Properties.MasterProfile.DiskEncryptionSetID,
+				VMSize:   VMSize(oc.Properties.MasterProfile.VMSize),
+				SubnetID: oc.Properties.MasterProfile.SubnetID,
 			},
 			APIServerProfile: APIServerProfile{
 				Visibility: Visibility(oc.Properties.APIServerProfile.Visibility),
@@ -56,13 +54,11 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 		out.Properties.WorkerProfiles = make([]WorkerProfile, 0, len(oc.Properties.WorkerProfiles))
 		for _, p := range oc.Properties.WorkerProfiles {
 			out.Properties.WorkerProfiles = append(out.Properties.WorkerProfiles, WorkerProfile{
-				Name:                p.Name,
-				VMSize:              VMSize(p.VMSize),
-				DiskSizeGB:          p.DiskSizeGB,
-				SubnetID:            p.SubnetID,
-				Count:               p.Count,
-				EncryptionAtHost:    p.EncryptionAtHost,
-				DiskEncryptionSetID: p.DiskEncryptionSetID,
+				Name:       p.Name,
+				VMSize:     VMSize(p.VMSize),
+				DiskSizeGB: p.DiskSizeGB,
+				SubnetID:   p.SubnetID,
+				Count:      p.Count,
 			})
 		}
 	}
@@ -142,8 +138,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 	out.Properties.NetworkProfile.ServiceCIDR = oc.Properties.NetworkProfile.ServiceCIDR
 	out.Properties.MasterProfile.VMSize = api.VMSize(oc.Properties.MasterProfile.VMSize)
 	out.Properties.MasterProfile.SubnetID = oc.Properties.MasterProfile.SubnetID
-	out.Properties.MasterProfile.EncryptionAtHost = oc.Properties.MasterProfile.EncryptionAtHost
-	out.Properties.MasterProfile.DiskEncryptionSetID = oc.Properties.MasterProfile.DiskEncryptionSetID
 	out.Properties.WorkerProfiles = nil
 	if oc.Properties.WorkerProfiles != nil {
 		out.Properties.WorkerProfiles = make([]api.WorkerProfile, len(oc.Properties.WorkerProfiles))
@@ -153,8 +147,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 			out.Properties.WorkerProfiles[i].DiskSizeGB = oc.Properties.WorkerProfiles[i].DiskSizeGB
 			out.Properties.WorkerProfiles[i].SubnetID = oc.Properties.WorkerProfiles[i].SubnetID
 			out.Properties.WorkerProfiles[i].Count = oc.Properties.WorkerProfiles[i].Count
-			out.Properties.WorkerProfiles[i].EncryptionAtHost = oc.Properties.WorkerProfiles[i].EncryptionAtHost
-			out.Properties.WorkerProfiles[i].DiskEncryptionSetID = oc.Properties.WorkerProfiles[i].DiskEncryptionSetID
 		}
 	}
 	out.Properties.APIServerProfile.Visibility = api.Visibility(oc.Properties.APIServerProfile.Visibility)
diff --git a/pkg/api/validate/dynamic/dynamic.go b/pkg/api/validate/dynamic/dynamic.go
index 90a3eda49..369f114f5 100644
--- a/pkg/api/validate/dynamic/dynamic.go
+++ b/pkg/api/validate/dynamic/dynamic.go
@@ -19,7 +19,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/wait"
 
 	"github.com/Azure/ARO-RP/pkg/api"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/authorization"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/compute"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/features"
@@ -48,7 +47,7 @@ type Dynamic interface {
 type dynamic struct {
 	log            *logrus.Entry
 	authorizerType AuthorizerType
-	azEnv          *azureclient.AROEnvironment
+	azEnv          *azure.Environment
 
 	permissions     authorization.PermissionsClient
 	providers       features.ProvidersClient
@@ -62,7 +61,7 @@ type AuthorizerType string
 const AuthorizerFirstParty AuthorizerType = "resource provider"
 const AuthorizerClusterServicePrincipal AuthorizerType = "cluster"
 
-func NewValidator(log *logrus.Entry, azEnv *azureclient.AROEnvironment, subscriptionID string, authorizer refreshable.Authorizer, authorizerType AuthorizerType) (*dynamic, error) {
+func NewValidator(log *logrus.Entry, azEnv *azure.Environment, subscriptionID string, authorizer refreshable.Authorizer, authorizerType AuthorizerType) (*dynamic, error) {
 	return &dynamic{
 		log:            log,
 		authorizerType: authorizerType,
diff --git a/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go b/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
index b1a2b85d9..5e16e6c1c 100644
--- a/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
+++ b/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
@@ -124,10 +124,6 @@ type MasterProfile struct {
 	VMSize VMSize `json:"vmSize,omitempty"`
 	// SubnetID - The Azure resource ID of the master subnet.
 	SubnetID *string `json:"subnetId,omitempty"`
-	// EncryptionAtHost - Whether master virtual machines are encrypted at host.
-	EncryptionAtHost *bool `json:"encryptionAtHost,omitempty"`
-	// DiskEncryptionSetID - The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID *string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // NetworkProfile networkProfile represents a network profile.
@@ -899,8 +895,4 @@ type WorkerProfile struct {
 	SubnetID *string `json:"subnetId,omitempty"`
 	// Count - The number of worker VMs.
 	Count *int32 `json:"count,omitempty"`
-	// EncryptionAtHost - Whether master virtual machines are encrypted at host.
-	EncryptionAtHost *bool `json:"encryptionAtHost,omitempty"`
-	// DiskEncryptionSetID - The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID *string `json:"diskEncryptionSetId,omitempty"`
 }
diff --git a/pkg/cluster/delete.go b/pkg/cluster/delete.go
index c390e635d..b73fed41e 100644
--- a/pkg/cluster/delete.go
+++ b/pkg/cluster/delete.go
@@ -14,7 +14,6 @@ import (
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
 	"github.com/Azure/go-autorest/autorest/azure"
-	"github.com/davecgh/go-spew/spew"
 
 	"github.com/Azure/ARO-RP/pkg/api"
 	"github.com/Azure/ARO-RP/pkg/env"
@@ -260,21 +259,9 @@ func (m *manager) deleteRoleDefinition(ctx context.Context) error {
 
 func (m *manager) Delete(ctx context.Context) error {
 	resourceGroup := stringutils.LastTokenByte(m.doc.OpenShiftCluster.Properties.ClusterProfile.ResourceGroupID, '/')
-	//In edge case of CRG not being managedBy ARO, we have a different delete path
-	//we will assume normal case and set rgManagedByARO to true CRG is managedby ARO
-	rgManagedByARO := true
-	rg, err := m.resourceGroups.Get(ctx, resourceGroup)
-	if err != nil {
-		m.log.Warnf("failed to get resourceGroup %s", err)
-	} else if !m.env.IsLocalDevelopmentMode() {
-		if rg.ManagedBy == nil || *rg.ManagedBy == "" || !strings.EqualFold(*rg.ManagedBy, m.doc.OpenShiftCluster.ID) {
-			rgManagedByARO = false
-			m.log.Infof("cluster resource group not managed by aro %s", *rg.Name)
-		}
-	}
 
 	m.log.Printf("deleting dns")
-	err = m.dns.Delete(ctx, m.doc.OpenShiftCluster)
+	err := m.dns.Delete(ctx, m.doc.OpenShiftCluster)
 	if err != nil {
 		return err
 	}
@@ -297,35 +284,25 @@ func (m *manager) Delete(ctx context.Context) error {
 		return err
 	}
 
-	// only delete if managedByARO
-	if rgManagedByARO {
-		m.log.Printf("deleting resources")
-		err = m.deleteResources(ctx)
-		if err != nil {
-			return err
-		}
+	m.log.Printf("deleting resources")
+	err = m.deleteResources(ctx)
+	if err != nil {
+		return err
+	}
 
-		m.log.Printf("deleting resource group %s", resourceGroup)
-		err = m.resourceGroups.DeleteAndWait(ctx, resourceGroup)
-		// TODO(mjudeikis): Remove this once we know all the error flavors this is
-		// returning so we can unify checks bellow
-		if err != nil {
-			m.log.Printf("delete resource group failed: %s", spew.Sdump(err))
-		}
-		if detailedErr, ok := err.(autorest.DetailedError); ok &&
-			(detailedErr.StatusCode == http.StatusForbidden || detailedErr.StatusCode == http.StatusNotFound) {
-			err = nil
-		}
-		if azureerrors.HasAuthorizationFailedError(err) {
-			err = nil
-		}
-		if azureerrors.ResourceGroupNotFound(err) {
-			err = nil
-		}
-		if err != nil {
-			return err
-		}
+	m.log.Printf("deleting resource group %s", resourceGroup)
+	err = m.resourceGroups.DeleteAndWait(ctx, resourceGroup)
+	if detailedErr, ok := err.(autorest.DetailedError); ok &&
+		(detailedErr.StatusCode == http.StatusForbidden || detailedErr.StatusCode == http.StatusNotFound) {
+		err = nil
 	}
+	if azureerrors.HasAuthorizationFailedError(err) {
+		err = nil
+	}
+	if err != nil {
+		return err
+	}
+
 	if !m.env.FeatureIsSet(env.FeatureDisableSignedCertificates) {
 		managedDomain, err := dns.ManagedDomain(m.env, m.doc.OpenShiftCluster.Properties.ClusterProfile.Domain)
 		if err != nil {
diff --git a/pkg/cluster/deployresources_resources.go b/pkg/cluster/deployresources_resources.go
index 36e7cb6f5..09b7c6fdb 100644
--- a/pkg/cluster/deployresources_resources.go
+++ b/pkg/cluster/deployresources_resources.go
@@ -87,69 +87,56 @@ func (m *manager) networkMasterNICs(installConfig *installconfig.InstallConfig)
 }
 
 func (m *manager) computeBootstrapVM(installConfig *installconfig.InstallConfig) *arm.Resource {
-	vm := &mgmtcompute.VirtualMachine{
-		VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
-			HardwareProfile: &mgmtcompute.HardwareProfile{
-				VMSize: mgmtcompute.VirtualMachineSizeTypesStandardD4sV3,
-			},
-			StorageProfile: &mgmtcompute.StorageProfile{
-				ImageReference: &mgmtcompute.ImageReference{
-					Publisher: &installConfig.Config.Azure.Image.Publisher,
-					Offer:     &installConfig.Config.Azure.Image.Offer,
-					Sku:       &installConfig.Config.Azure.Image.SKU,
-					Version:   &installConfig.Config.Azure.Image.Version,
+	return &arm.Resource{
+		Resource: &mgmtcompute.VirtualMachine{
+			VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
+				HardwareProfile: &mgmtcompute.HardwareProfile{
+					VMSize: mgmtcompute.VirtualMachineSizeTypesStandardD4sV3,
 				},
-				OsDisk: &mgmtcompute.OSDisk{
-					Name:         to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap_OSDisk"),
-					Caching:      mgmtcompute.CachingTypesReadWrite,
-					CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
-					DiskSizeGB:   to.Int32Ptr(100),
-					ManagedDisk: &mgmtcompute.ManagedDiskParameters{
-						StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+				StorageProfile: &mgmtcompute.StorageProfile{
+					ImageReference: &mgmtcompute.ImageReference{
+						Publisher: &installConfig.Config.Azure.Image.Publisher,
+						Offer:     &installConfig.Config.Azure.Image.Offer,
+						Sku:       &installConfig.Config.Azure.Image.SKU,
+						Version:   &installConfig.Config.Azure.Image.Version,
+					},
+					OsDisk: &mgmtcompute.OSDisk{
+						Name:         to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap_OSDisk"),
+						Caching:      mgmtcompute.CachingTypesReadWrite,
+						CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
+						DiskSizeGB:   to.Int32Ptr(100),
+						ManagedDisk: &mgmtcompute.ManagedDiskParameters{
+							StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+						},
 					},
 				},
-			},
-			OsProfile: &mgmtcompute.OSProfile{
-				ComputerName:  to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-vm"),
-				AdminUsername: to.StringPtr("core"),
-				AdminPassword: to.StringPtr("NotActuallyApplied!"),
-				CustomData:    to.StringPtr(`[base64(concat('{"ignition":{"version":"3.2.0","config":{"replace":{"source":"https://cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `.blob.` + m.env.Environment().StorageEndpointSuffix + `/ignition/bootstrap.ign?', listAccountSas(resourceId('Microsoft.Storage/storageAccounts', 'cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `'), '2019-04-01', parameters('sas')).accountSasToken, '"}}}}'))]`),
-				LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
-					DisablePasswordAuthentication: to.BoolPtr(false),
+				OsProfile: &mgmtcompute.OSProfile{
+					ComputerName:  to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-vm"),
+					AdminUsername: to.StringPtr("core"),
+					AdminPassword: to.StringPtr("NotActuallyApplied!"),
+					CustomData:    to.StringPtr(`[base64(concat('{"ignition":{"version":"3.2.0","config":{"replace":{"source":"https://cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `.blob.` + m.env.Environment().StorageEndpointSuffix + `/ignition/bootstrap.ign?', listAccountSas(resourceId('Microsoft.Storage/storageAccounts', 'cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `'), '2019-04-01', parameters('sas')).accountSasToken, '"}}}}'))]`),
+					LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
+						DisablePasswordAuthentication: to.BoolPtr(false),
+					},
 				},
-			},
-			NetworkProfile: &mgmtcompute.NetworkProfile{
-				NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
-					{
-						ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', '" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic')]"),
+				NetworkProfile: &mgmtcompute.NetworkProfile{
+					NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
+						{
+							ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', '" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic')]"),
+						},
 					},
 				},
-			},
-			DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
-				BootDiagnostics: &mgmtcompute.BootDiagnostics{
-					Enabled:    to.BoolPtr(true),
-					StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+				DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
+					BootDiagnostics: &mgmtcompute.BootDiagnostics{
+						Enabled:    to.BoolPtr(true),
+						StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+					},
 				},
 			},
+			Name:     to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap"),
+			Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
+			Location: &installConfig.Config.Azure.Region,
 		},
-		Name:     to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap"),
-		Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
-		Location: &installConfig.Config.Azure.Region,
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID != "" {
-		vm.StorageProfile.OsDisk.ManagedDisk.DiskEncryptionSet = &mgmtcompute.DiskEncryptionSetParameters{
-			ID: &installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID,
-		}
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost {
-		vm.SecurityProfile = &mgmtcompute.SecurityProfile{
-			EncryptionAtHost: &installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost,
-		}
-	}
-	return &arm.Resource{
-		Resource:   vm,
 		APIVersion: azureclient.APIVersion("Microsoft.Compute"),
 		DependsOn: []string{
 			"Microsoft.Network/networkInterfaces/" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic",
@@ -158,71 +145,57 @@ func (m *manager) computeBootstrapVM(installConfig *installconfig.InstallConfig)
 }
 
 func (m *manager) computeMasterVMs(installConfig *installconfig.InstallConfig, zones *[]string, machineMaster *machine.Master) *arm.Resource {
-	vm := &mgmtcompute.VirtualMachine{
-		VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
-			HardwareProfile: &mgmtcompute.HardwareProfile{
-				VMSize: mgmtcompute.VirtualMachineSizeTypes(installConfig.Config.ControlPlane.Platform.Azure.InstanceType),
-			},
-			StorageProfile: &mgmtcompute.StorageProfile{
-				ImageReference: &mgmtcompute.ImageReference{
-					Publisher: &installConfig.Config.Azure.Image.Publisher,
-					Offer:     &installConfig.Config.Azure.Image.Offer,
-					Sku:       &installConfig.Config.Azure.Image.SKU,
-					Version:   &installConfig.Config.Azure.Image.Version,
+	return &arm.Resource{
+		Resource: &mgmtcompute.VirtualMachine{
+			VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
+				HardwareProfile: &mgmtcompute.HardwareProfile{
+					VMSize: mgmtcompute.VirtualMachineSizeTypes(installConfig.Config.ControlPlane.Platform.Azure.InstanceType),
 				},
-				OsDisk: &mgmtcompute.OSDisk{
-					Name:         to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex(), '_OSDisk')]"),
-					Caching:      mgmtcompute.CachingTypesReadOnly,
-					CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
-					DiskSizeGB:   &installConfig.Config.ControlPlane.Platform.Azure.OSDisk.DiskSizeGB,
-					ManagedDisk: &mgmtcompute.ManagedDiskParameters{
-						StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+				StorageProfile: &mgmtcompute.StorageProfile{
+					ImageReference: &mgmtcompute.ImageReference{
+						Publisher: &installConfig.Config.Azure.Image.Publisher,
+						Offer:     &installConfig.Config.Azure.Image.Offer,
+						Sku:       &installConfig.Config.Azure.Image.SKU,
+						Version:   &installConfig.Config.Azure.Image.Version,
+					},
+					OsDisk: &mgmtcompute.OSDisk{
+						Name:         to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex(), '_OSDisk')]"),
+						Caching:      mgmtcompute.CachingTypesReadOnly,
+						CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
+						DiskSizeGB:   &installConfig.Config.ControlPlane.Platform.Azure.OSDisk.DiskSizeGB,
+						ManagedDisk: &mgmtcompute.ManagedDiskParameters{
+							StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+						},
 					},
 				},
-			},
-			OsProfile: &mgmtcompute.OSProfile{
-				ComputerName:  to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
-				AdminUsername: to.StringPtr("core"),
-				AdminPassword: to.StringPtr("NotActuallyApplied!"),
-				CustomData:    to.StringPtr(base64.StdEncoding.EncodeToString(machineMaster.File.Data)),
-				LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
-					DisablePasswordAuthentication: to.BoolPtr(false),
+				OsProfile: &mgmtcompute.OSProfile{
+					ComputerName:  to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
+					AdminUsername: to.StringPtr("core"),
+					AdminPassword: to.StringPtr("NotActuallyApplied!"),
+					CustomData:    to.StringPtr(base64.StdEncoding.EncodeToString(machineMaster.File.Data)),
+					LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
+						DisablePasswordAuthentication: to.BoolPtr(false),
+					},
 				},
-			},
-			NetworkProfile: &mgmtcompute.NetworkProfile{
-				NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
-					{
-						ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master', copyIndex(), '-nic'))]"),
+				NetworkProfile: &mgmtcompute.NetworkProfile{
+					NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
+						{
+							ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master', copyIndex(), '-nic'))]"),
+						},
 					},
 				},
-			},
-			DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
-				BootDiagnostics: &mgmtcompute.BootDiagnostics{
-					Enabled:    to.BoolPtr(true),
-					StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+				DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
+					BootDiagnostics: &mgmtcompute.BootDiagnostics{
+						Enabled:    to.BoolPtr(true),
+						StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+					},
 				},
 			},
+			Zones:    zones,
+			Name:     to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
+			Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
+			Location: &installConfig.Config.Azure.Region,
 		},
-		Zones:    zones,
-		Name:     to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
-		Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
-		Location: &installConfig.Config.Azure.Region,
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID != "" {
-		vm.StorageProfile.OsDisk.ManagedDisk.DiskEncryptionSet = &mgmtcompute.DiskEncryptionSetParameters{
-			ID: &installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID,
-		}
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost {
-		vm.SecurityProfile = &mgmtcompute.SecurityProfile{
-			EncryptionAtHost: &installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost,
-		}
-	}
-
-	return &arm.Resource{
-		Resource:   vm,
 		APIVersion: azureclient.APIVersion("Microsoft.Compute"),
 		Copy: &arm.Copy{
 			Name:  "computecopy",
diff --git a/pkg/cluster/deploystorage_resources.go b/pkg/cluster/deploystorage_resources.go
index c229f0e17..bec696d29 100644
--- a/pkg/cluster/deploystorage_resources.go
+++ b/pkg/cluster/deploystorage_resources.go
@@ -42,7 +42,6 @@ func (m *manager) denyAssignment() *arm.Resource {
 							"Microsoft.Compute/snapshots/write",
 							"Microsoft.Network/networkInterfaces/effectiveRouteTable/action",
 							"Microsoft.Network/networkSecurityGroups/join/action",
-							"Microsoft.Resources/tags/*", // Enable tagging for Resources RP only
 						},
 					},
 				},
diff --git a/pkg/cluster/generateconfig.go b/pkg/cluster/generateconfig.go
index 6c94f2adc..86454e114 100644
--- a/pkg/cluster/generateconfig.go
+++ b/pkg/cluster/generateconfig.go
@@ -94,7 +94,7 @@ func (m *manager) generateInstallConfig(ctx context.Context) (*installconfig.Ins
 		return nil, nil, err
 	}
 	if len(workerZones) == 0 {
-		workerZones = []string{""}
+		masterZones = []string{""}
 	}
 
 	installConfig := &installconfig.InstallConfig{
@@ -129,12 +129,8 @@ func (m *manager) generateInstallConfig(ctx context.Context) (*installconfig.Ins
 				Replicas: to.Int64Ptr(3),
 				Platform: types.MachinePoolPlatform{
 					Azure: &azuretypes.MachinePool{
-						Zones:            masterZones,
-						InstanceType:     string(m.doc.OpenShiftCluster.Properties.MasterProfile.VMSize),
-						EncryptionAtHost: m.doc.OpenShiftCluster.Properties.MasterProfile.EncryptionAtHost,
-						OSDisk: azuretypes.OSDisk{
-							DiskEncryptionSetID: m.doc.OpenShiftCluster.Properties.MasterProfile.DiskEncryptionSetID,
-						},
+						Zones:        masterZones,
+						InstanceType: string(m.doc.OpenShiftCluster.Properties.MasterProfile.VMSize),
 					},
 				},
 				Hyperthreading: "Enabled",
@@ -146,12 +142,10 @@ func (m *manager) generateInstallConfig(ctx context.Context) (*installconfig.Ins
 					Replicas: to.Int64Ptr(int64(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].Count)),
 					Platform: types.MachinePoolPlatform{
 						Azure: &azuretypes.MachinePool{
-							Zones:            workerZones,
-							InstanceType:     string(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].VMSize),
-							EncryptionAtHost: m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].EncryptionAtHost,
+							Zones:        workerZones,
+							InstanceType: string(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].VMSize),
 							OSDisk: azuretypes.OSDisk{
-								DiskEncryptionSetID: m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskEncryptionSetID,
-								DiskSizeGB:          int32(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskSizeGB),
+								DiskSizeGB: int32(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskSizeGB),
 							},
 						},
 					},
diff --git a/pkg/cluster/install.go b/pkg/cluster/install.go
index 7ce594a8c..5235f29ef 100644
--- a/pkg/cluster/install.go
+++ b/pkg/cluster/install.go
@@ -151,7 +151,7 @@ func (m *manager) Install(ctx context.Context) error {
 
 func (m *manager) runSteps(ctx context.Context, s []steps.Step) error {
 	err := steps.Run(ctx, m.log, 10*time.Second, s)
-	if err != nil {
+	if err != nil && !m.env.IsLocalDevelopmentMode() {
 		m.gatherFailureLogs(ctx)
 	}
 	return err
diff --git a/pkg/dbtoken/api.go b/pkg/dbtoken/api.go
index ad70eb137..ea09b980e 100644
--- a/pkg/dbtoken/api.go
+++ b/pkg/dbtoken/api.go
@@ -3,6 +3,8 @@ package dbtoken
 // Copyright (c) Microsoft Corporation.
 // Licensed under the Apache License 2.0.
 
+const Resource = "https://dbtoken.aro.azure.com/"
+
 type tokenResponse struct {
 	Token string `json:"token,omitempty"`
 }
diff --git a/pkg/deploy/bindata.go b/pkg/deploy/bindata.go
index e5ee823a1..d510becfb 100644
--- a/pkg/deploy/bindata.go
+++ b/pkg/deploy/bindata.go
@@ -131,7 +131,7 @@ func databasesDevelopmentJson() (*asset, error) {
 	return a, nil
 }
 
-var _envDevelopmentJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7b\x69\x6f\xa3\x4a\xf6\xf7\xfb\xfb\x29\xa2\x3c\x23\xa5\x5b\x4f\xa7\x03\x38\xee\x1b\x46\x9a\x17\x18\x07\x8c\x8d\x89\x01\xb3\xce\xb4\xae\xa0\xaa\x82\xb1\x8b\x65\xa0\xc0\xc1\xa3\xfb\xdd\xff\x02\x2f\xf1\x16\xdb\xe9\x45\x1a\xcd\x6d\x5a\xe9\xc4\x70\xce\xa9\xaa\x53\x67\xad\x1f\xfe\xcf\x6f\x57\x57\x57\x57\xd7\x7f\xcb\xc1\x04\x45\xde\xf5\xdf\xaf\xae\x27\x84\xa4\xf9\xdf\xef\xee\x96\x77\x3e\x47\x5e\xec\x05\x28\x42\x31\xf9\xec\x2d\x8a\x0c\x7d\x06\x49\xb4\x7a\x96\xdf\x31\x14\xdd\xbe\xa5\xe8\x5b\x8a\xbe\x83\x28\xc5\x49\x55\xd3\x8d\x51\x94\x62\x8f\xa0\xcf\xd3\x3c\x89\xff\xdf\xf5\xa7\xe5\x08\x20\x89\x09\x8a\x89\x89\xb2\x3c\x4c\xe2\x7a\x20\xfa\x33\x55\xff\x5b\x13\xa4\x5e\xe6\x45\x88\xa0\x2c\xbf\xfe\xfb\xd5\x72\x5a\x4b\xc6\x90\x5b\xa4\xe3\x64\x86\xe2\x9d\xfb\xcd\x33\x52\xa5\xa8\x16\x95\x93\x2c\x8c\x83\x95\xa4\xcd\x53\x88\x9e\xbd\x02\x13\xd3\xc3\x45\x43\x75\xbd\x79\xfc\xe7\xa7\x6d\xf9\xbc\x97\x7a\x20\x24\xd5\xdb\xf2\xc3\x98\x9c\x11\x4e\xbd\x21\x7b\x94\x24\x58\xf1\x22\xf4\x73\xe6\x9e\x66\xc9\x4b\xc5\xa3\x8c\x9c\x15\x7f\x82\x1d\x87\x28\x26\xdf\x29\xa4\x9b\x44\x5e\x18\xd7\x0b\x95\x3d\x1f\xe1\xef\x90\x24\x45\x5e\x70\x5e\x5b\x67\xf8\xb9\x82\x4c\x4e\xc8\x40\xa0\xc8\xd0\x59\x49\x03\x74\xc2\x22\x2e\x90\x51\xf8\x38\x04\xd2\x88\x83\x30\x43\x79\xce\x61\x9c\x00\x8f\x84\x49\x3c\x44\x64\x92\xc0\xef\x35\x08\x9d\x78\x24\x04\x17\x0d\xad\xcf\x8a\x1f\x61\x82\x3a\xf1\x62\xe8\x65\xf0\xf8\x98\x79\x3e\x19\x35\xc3\x9e\x56\xdb\x09\x85\x95\x69\xcc\x73\xb5\x1d\x86\xcf\x21\xf0\xc8\x8f\x74\x99\xdf\xb6\xc6\xba\xce\x50\x9e\x14\x19\x40\x75\x9c\xf9\xe7\x86\x66\x6f\xa8\x7c\x56\x1c\x8c\xdf\x3c\x88\x97\x9a\xbc\xfe\xe7\x6b\xbc\xfa\x70\x73\x5c\xe1\x37\x1f\xbf\x5e\xef\x08\xf8\x73\x6f\xc6\x69\x96\xa4\xf5\x7a\x51\x7e\x7c\xac\x8d\xd8\x43\xdb\x39\x39\xfe\x3e\xfd\xd9\x89\xac\x17\x05\x51\x79\x5b\xa6\xf1\x6d\x1a\xa6\xfb\xda\x5d\xeb\x7e\x18\x82\x2c\xc9\x93\x67\xf2\x59\x41\x64\x9e\x64\xb3\xbb\xbd\xc1\x51\xbe\xcf\xba\x9e\x4c\x33\xed\xb5\xf6\xc5\x2c\x29\xd2\x0f\x1f\x3f\xaf\x1f\x7e\xdd\xe7\x02\x49\x0c\xc3\x0d\x1b\xfa\x77\xe1\xe1\xfc\xc3\xf6\xa2\x5f\x03\xf7\xcd\xc7\x4f\x57\xd4\xc7\x03\x09\x5e\x1a\x6e\xa5\x1b\x86\xa2\xd9\x5b\xea\xf7\x5b\x8a\x3e\x6a\x7e\xff\x79\xdf\xd6\x78\xab\x9d\x4e\x3d\x70\x68\xa8\xfb\x54\xa3\x0c\x3d\x87\x2f\x7b\x06\x77\x40\x4c\x53\xcb\x84\x78\xc7\xb4\xae\x8f\x52\x7d\x3d\xb8\xbb\xb7\x8f\x8d\x98\xbc\xf0\x63\x44\xde\x1e\xeb\xf8\x54\xaf\x2e\x58\xf4\xdb\x4b\x6b\xd2\xf9\x66\xfa\xf7\xc7\xa7\xff\xc6\x84\x37\x12\xd7\x46\x28\x7a\x04\xcd\xbd\x4a\x6f\xd6\x71\x5c\xd4\x1b\x62\x7e\xea\xd2\xe8\xe5\xd2\xde\x5e\xc0\x72\x11\x4b\xa7\xd0\xeb\xf4\x10\x92\xaa\xb1\xf2\xb3\x23\x36\x9c\x21\xdc\xf1\x0f\x09\x7e\xb8\x39\xf4\xb5\x63\xe2\xf3\x9b\x4f\x57\x37\x59\x7a\x1b\xe7\xc1\xcd\x81\x13\x1c\x1d\x8a\x78\x41\xad\x86\xb8\xc0\xf8\x24\xf1\x9f\xdf\xb5\x8f\xe3\x24\xc1\x61\x1c\x9c\xdc\xc7\x83\xbb\x5f\x2f\x8f\x53\xb5\xd4\x8b\x83\x54\x19\x66\xa4\xf0\xf0\xea\xe3\x0f\x0a\x51\x3f\x33\xc0\x84\x29\x9f\xc4\xcf\x61\x50\x64\xcd\xd8\x3f\xdd\x9f\x97\x61\xe3\x07\x9a\xea\x9e\xc6\xef\x56\x71\xa9\x36\xd6\xf5\xf6\xd5\x7f\xef\x78\xfb\x41\xa2\xda\xbf\x4e\xd8\xdd\xd5\x91\xca\xe7\x07\x2e\xe7\x20\xcb\x6d\x16\xb2\xcc\x97\xe7\xa7\xfe\x5d\xce\xb4\x2a\x6e\x2e\x76\xa3\x23\x89\xa1\x4c\xe3\xf1\xca\x3f\xb4\xa4\x20\xa8\xe3\xe5\x08\x1e\x09\x17\x6f\xd6\x3e\x3b\x13\x32\xd3\x58\x9c\xd3\x6f\x44\x9b\x6b\x12\xa2\x6c\x8b\xea\xa2\xc4\x55\xd7\x7f\xcb\x5e\x64\xdb\xf0\xdf\x9e\xc9\x86\x7e\xb5\x25\x75\xab\x75\x72\xc3\xdf\x95\x8e\x1b\x06\x9a\x65\x3e\xd3\x5f\x1e\x3e\x33\xed\xf6\x99\xc4\x76\x98\x9b\xdf\x58\xe6\xee\xd4\xb5\x24\x21\x5b\x25\xef\xe9\x29\x9d\xf1\xe0\x77\x78\xfb\xd5\xab\xaf\xd4\xa3\x77\x3d\xe2\x1d\xd4\x94\xfb\xe5\xf8\x77\xfb\xe6\x7e\x91\x09\xbc\x13\x75\xc2\xf1\x02\xe8\x9c\x3a\x47\x59\x42\x12\x90\xe0\x33\x95\xd6\x53\x8a\x62\x73\xa4\x5c\x5c\x65\xbd\xa7\x76\xfe\xd6\x94\xb4\x8a\x83\xff\xfd\xc5\xf3\x41\xd7\x95\xa2\x18\xe6\x4f\xf1\x51\x95\xff\x88\xa8\x7a\x24\x54\xbc\x2f\xf5\xec\xa4\x9c\x7d\x2b\xfe\x7a\x41\xae\x3e\xdb\x0c\xae\x5b\xe3\x3f\xba\x4c\xfe\x47\xd9\x3a\x36\xe5\x75\x44\xdc\x74\xd1\x47\x68\xc0\xeb\x41\xd4\xae\x2f\x6e\xef\xd6\x77\xf6\x94\x45\x1a\x64\x1e\x44\xa3\x04\x87\xe0\xb0\x51\xdf\x90\x45\x09\x5c\x9a\xad\x17\x17\x1e\xbe\x30\x80\x2f\xd5\x3e\xf4\xc0\x24\x8c\xd1\x28\x4b\x9e\x43\x7c\xa2\x39\x4a\xf2\x73\x24\x4b\xa5\x24\x51\x5a\x10\x94\xd5\x1d\xf5\x6b\x49\x0e\xc2\xdb\x13\x95\xee\xb5\x07\xa3\x30\x36\x72\x94\xad\x77\x08\xe0\xa4\x80\xb7\x45\x8e\xb2\x53\x6c\x38\x8c\x8b\x97\xcb\xd2\xcf\x86\x07\x86\xb9\xe7\x63\x34\xf2\xf2\x7c\x9e\x64\x90\x2b\xc8\x04\xc5\x24\xdc\x78\x2d\xc9\x0a\x74\x26\x32\xe6\xf9\xe1\x69\xd5\x51\xc2\x74\x7d\xc2\x72\x3e\x77\xad\xaf\xf3\x52\x5f\xa5\x7b\xcd\xa9\xd9\xf5\xdd\x24\x89\xd0\xdd\xab\xc6\xee\x3e\xe7\xf9\xe4\xce\x2b\xc8\x24\xc9\xc2\x05\x82\x7f\xcc\xd0\x41\x9c\x3a\x29\x78\x86\xaa\xa3\x29\x66\xfb\xcc\xe8\x6c\x7a\x59\x5f\x6f\xd7\x51\xeb\xeb\x78\x2e\x3e\xcf\x7f\xfc\xc9\x5b\x39\x3c\x27\x49\xe6\x05\x67\xcd\xbc\xa1\x0d\x23\x2f\x40\x1a\x7a\x46\x19\x8a\x4f\x9c\x17\x6c\xe8\x9b\x7d\xce\x27\xcb\x88\xa1\x21\xd8\xf3\xf6\x5b\x9d\x03\x96\xe4\xf9\x79\x45\xde\x7b\x94\xcf\x11\x2f\x03\xda\xf5\xef\xb7\xb2\x39\x3c\x47\x5b\xbe\x66\x01\x5c\x97\x28\x6f\xd4\xa0\x57\x67\x0a\xd9\x24\xef\x86\xf9\xec\xfc\xd2\x41\x86\x3c\x82\x9e\xd2\x75\xf2\x12\xb2\x24\x5a\x9e\x09\x9f\x99\xe7\x12\xa8\x80\x17\x8d\x72\xb5\xb5\x81\x1c\x00\x49\x11\x93\x75\x69\x3c\xca\x50\x14\x16\xd1\x1f\xb2\xa6\x7f\x73\x3d\xff\x2e\x3b\x5a\xb5\xf4\x17\xd9\xd1\x8a\x56\x8a\x09\xca\x9e\x3d\x80\x2e\x6c\x11\xd7\xd7\x05\x4a\xd9\xc4\xcb\xf0\xb6\x8c\xf2\xfc\x36\x0e\xc1\x25\x27\x0a\xef\xac\x3d\x57\x3c\x61\xe4\x65\xd5\x45\x21\x72\xc3\x74\x71\x5b\x7c\xec\xba\x3c\x16\x5e\x1d\xd3\x45\x98\x82\x66\xec\x77\x84\xbe\xab\x6f\x54\xce\x0e\xff\x3b\x5a\xf3\xa3\xfc\x3f\xb2\x5d\xdf\x39\xd4\xb9\x38\x66\x6f\x5f\x67\xda\x84\xa3\x2b\xf8\x16\x53\xd9\x15\xb0\x5b\x67\xbe\x2f\xc5\xbf\x29\x75\xdf\x40\x0e\x8f\xcd\x2f\x9f\xe0\xf7\xd9\xc8\x46\x0e\x8c\x73\x1d\x11\x12\xc6\xc1\xf7\x09\x5a\x0a\x3b\x40\xf5\xae\xbd\x2c\xb9\x05\xe1\xfb\x77\x7d\x7d\x9d\xcf\xde\x3f\x86\xeb\x7d\x1c\x97\x53\x5f\x46\x79\xba\x02\x39\x2f\xe7\xed\xa7\xef\x3b\x67\x40\x2f\x04\xc5\x75\xf6\xbe\x28\xbb\x6c\xa8\x7f\x4a\x26\x01\xf9\xb9\x14\x7e\xf5\xcd\x99\x64\xbb\x5c\x7a\x0d\x6d\x5c\xf3\xbe\xc2\xe3\xeb\xaa\x2e\xcc\x31\xeb\x96\x9d\x2f\x72\x92\x44\x3a\xc8\xc2\xf4\x5c\xf9\xb5\xc3\xdb\xf3\x62\x88\x51\xb6\xdd\x3e\x6f\x5e\x73\x38\x2b\xc0\x2b\x48\x62\x2c\x7b\xb4\x61\x18\x27\x5b\x52\xde\x91\x25\xf3\xad\x10\x70\x61\xbc\xad\x15\x4f\x10\x20\x08\x7e\x53\xfc\xb8\xce\x97\x6a\xaa\x13\x8d\xef\xe5\xe8\xcb\xfd\x07\x90\xc4\xc0\x23\x1f\x96\x9f\xc6\x89\xde\x80\xb6\x1f\x6e\x00\x63\x52\x12\x4f\x63\x3e\x48\xfe\x71\xf3\xf1\xd3\x0d\x2f\x71\xee\x68\xfc\x34\x78\x54\xfe\x71\x73\x73\xf3\x69\xb7\xed\x5d\xbf\xfa\x51\x13\xde\xdc\xfc\x2b\xbe\xa9\xe9\x47\x4f\x4f\xb2\xc2\x0d\x1f\x8f\xd0\xaf\x5f\xb7\xd8\xa2\xaf\xff\xdb\x9f\x03\x1f\x63\xda\xd7\x39\x82\xf4\x0e\x0d\x44\x6d\x02\x45\x23\x90\xed\x20\x30\x29\x61\xe8\x59\x6d\x1a\x3d\x0a\xb1\x6b\xb5\x29\x3e\x48\x73\x18\x99\xf7\x50\x34\x0b\x97\xe7\x88\xcf\x73\x99\x32\xe6\xb0\x86\xfb\x82\xa6\x73\xa5\x2b\x9a\x8c\xdc\xea\x97\x7e\x4b\x63\xdc\x8a\x65\x1c\xbb\x9f\xc3\x20\xbd\x77\x63\xe5\xd9\x6d\xf5\x4b\xc8\xb8\x0b\x89\xaf\xef\x4b\x03\x3e\x7a\x61\x5c\x7b\x42\xb9\x56\x7b\x26\xf1\x74\x2e\xf1\xf9\xcb\xb0\xfb\xa6\xac\xc4\x67\x68\xec\xf7\x9c\x01\x12\xdd\x85\xcd\xc0\xca\x6f\xc1\x08\x54\x5c\xe9\x89\x2c\x71\xd5\x64\x00\xe2\x0e\x91\x78\x8a\x78\x16\x3d\xf7\x5b\x7d\x4a\x12\x27\x14\xec\x75\x16\x4f\xe1\x43\xe9\x8a\xf3\xc2\x8d\xcc\x99\xdf\xea\x4f\x40\xaf\x5f\x7a\x91\x39\x85\x7c\xbb\x04\x11\x28\x41\xcf\x0c\x65\xc6\x9c\xbb\xd6\xbc\x34\x70\x47\x91\x0d\xa8\x6a\x15\x2d\x6b\xe6\x8c\x68\x66\x47\x18\xf3\x54\x8b\x8f\xfb\xf3\x5a\x3f\xb2\x85\x09\x10\xd9\x0a\xf2\x9d\x04\xf6\xb4\x39\x58\x24\xa5\xdc\xea\x4c\x1c\x86\x4c\x5c\xc6\x5c\xc8\x11\x9d\x3a\xad\x7e\x09\x18\x36\x82\x7c\x7b\xea\x33\x54\xe9\x31\x66\x1b\x54\x2c\xf1\x2c\xa5\xf2\x5b\x4a\xe9\xc6\x6a\xe1\xd8\xca\x94\x0f\xd2\x36\xb4\xa8\x40\xb6\x67\x81\x67\xb5\x17\x50\x14\x72\x7f\x5b\x2e\xa3\xe5\x72\xe4\x62\x57\x64\x2b\xc7\xee\x54\x3e\x93\x62\xa7\xa5\x16\x7e\xab\x1f\xcb\xad\x0e\xed\x84\x2c\x06\xa2\x99\xaf\xe6\x4e\x40\x64\xe6\xae\x25\x2c\x5c\x9d\xce\x1d\x5b\xc3\xa0\xa5\x12\xa5\x6a\x17\x3e\x23\x54\x0e\x13\x14\xb5\x7e\xf8\x20\x9d\x3a\xb6\x1a\x8c\x42\x16\x43\x71\x58\x22\xdb\x24\x72\xdc\xc7\x40\x64\x17\x72\xa4\x96\x8e\x9d\xd2\x20\x32\x0a\x10\x99\x73\xbf\xe2\x1e\x46\x3c\x14\xc6\x94\x13\xf3\xb8\x6e\xe2\xcd\xca\xd5\xe9\xa9\x2f\x62\xc8\x47\xed\x89\x6f\x19\xec\x8a\x9e\x38\xcc\x4b\xca\x47\xfd\x09\x60\x4c\x1a\x44\x73\xd6\xeb\x69\x14\xe8\x0d\xbf\xc8\x15\x3b\x77\x2c\x25\x73\x2c\x88\x41\xd5\xde\xd5\x01\xc3\x12\xb9\x85\x69\xdf\x5e\x8d\xcf\x08\x5f\xa0\xdd\xc7\xb2\xa5\xe4\x9e\x9a\x62\x3f\x12\x42\x5f\x34\x67\x23\x1b\x63\x30\x4f\x63\x20\xc2\xa9\x27\x9a\x53\x6f\x41\xb7\x5d\x7b\x38\xd0\x0c\x56\xdc\xe8\x50\xa7\xd7\xf4\x95\x6b\x77\xca\x91\xdd\x4f\xa0\x35\x23\x20\x9a\x60\x9f\xa7\x5a\xb2\xad\x60\x10\xbb\x18\x84\x74\xe5\xf5\xcc\x54\xb6\xd8\x39\x14\x71\xe9\x47\x42\x2e\xdb\xfd\xb9\x6f\x0f\xf7\xf7\x61\x6b\xbd\xb3\xc0\x15\xd9\xa9\xc7\x98\x95\x24\xa6\x2f\x92\x08\xa7\x4e\xd5\xa9\x3c\x9e\x8e\x3d\x5b\xad\x9e\xf4\xe6\xef\x39\xb2\xb5\xc4\x67\xee\x17\x4a\xd8\xa1\x7c\xbb\xd3\x72\x6c\x6d\xea\x71\xc9\x40\xa3\xd8\x67\x73\x66\xea\x06\x85\x47\xe3\x29\xf5\x22\x4f\x1f\x29\x79\x3a\x1b\x38\x2d\xb3\x3a\xdc\x6f\x58\xfa\x0c\xcc\x5d\x7d\x69\x3b\x2e\xf3\x50\xff\xcc\x10\x05\x47\x36\xed\x0a\x06\x56\xfa\x63\xaa\xcd\xca\xd1\x4b\xea\xc7\xe6\xbd\x6c\x09\xc4\xed\x3a\x94\x1c\x6b\x13\x10\xb6\x63\x14\x76\x1e\xa4\x5e\xfd\x37\x47\xd4\x8a\x2b\xa1\xad\x54\x32\xf3\x52\x3a\x8c\x90\x4b\x3c\x7d\x8f\x82\x34\xf7\x43\x8e\x80\xbd\x67\x32\x03\x4b\x99\xe9\xa7\x7e\xf8\xf0\x6f\x89\x67\x69\xd0\x92\x4a\x5f\x64\xa7\x8e\x35\x2f\x9d\x08\x17\x7c\x90\x5a\x06\xad\x8d\x6d\x4a\xe8\x69\x46\xdb\x78\x9d\xcb\x3d\x3b\x0c\xef\x5f\x9e\xba\x41\x31\x9c\xa7\xc4\x63\xb4\x14\x84\x2b\x9f\xd4\xd9\xa9\x2f\xb2\xb4\xcb\xd3\x34\x60\xcc\x4a\x66\x56\x31\x24\xee\xd0\x80\x99\xcc\x24\x7e\xe9\xd3\x32\xa3\xe4\x7e\xcb\x9c\xc9\xb6\xb9\x70\x6d\xa9\xac\x6d\xc5\x8f\xd5\x43\xfd\xb4\xdc\x05\xec\x29\xb5\x9f\x15\xb0\xb7\xf6\x39\xa3\x58\xda\xa0\x89\x5d\x11\x62\x39\x6a\x63\xc8\xb3\x4b\x1a\xfe\x61\x86\x68\x77\x6c\x0a\xca\xb3\x6a\x40\x61\x8c\xb5\xd7\x7d\x88\xa9\x12\xc6\x0a\x05\x2a\x7a\x45\x4b\xe7\x4d\x9c\xe3\xe9\x7b\x65\xaa\x92\x7e\x8f\xbc\xb1\xde\x36\x7b\x4c\xd7\xa8\x97\x0c\x1c\x66\x52\x42\xe6\x3e\x90\x4d\x29\x70\x98\x97\x12\x5a\x2a\x81\xb5\xdd\x4d\xd3\x1d\x3d\x48\xfc\xfd\x80\x0f\xef\x1b\xbd\xca\x0c\x2e\x40\x4b\x9b\xf8\xe2\xcb\xcc\xb5\x3b\xd8\x8f\x34\xec\x47\x4a\xea\xda\xc3\x02\x30\xc1\x00\xb4\xcc\x99\x5f\x71\x04\xea\x9d\x7d\x19\xa5\xc3\xb0\x85\x1b\xe1\x58\x8e\x95\xa4\x8e\x7b\xd0\x6a\x4f\x60\x4f\x6b\x64\xd4\xb1\x59\xb6\x0f\xec\x0b\xc3\xb0\xbd\xb2\xeb\xa5\x7d\xf9\xb6\xb2\xfa\x5c\xc7\x36\x81\x86\x62\x10\x00\x51\xa0\x1a\x79\x22\x9b\xb9\xd6\x7d\x20\x85\x5a\x57\x37\x04\xcf\x10\xb4\x91\x4e\x99\x4f\x52\x58\xcb\xee\x94\x3e\x33\x5f\x3e\x33\x3b\xa3\x31\xf5\xf2\xa4\x1a\xb4\xd0\x3c\xb3\x96\xfb\x2c\xf1\xfd\x8e\x31\x7b\x20\xc6\x6c\x52\xc7\xd0\x99\xfe\xc8\x8e\xcd\xc7\x76\x67\x6c\x18\x61\x2d\xbf\x89\x31\xa2\x30\x75\xd5\xa4\x90\x5b\x0a\xe3\x54\xed\x85\xc7\x77\x52\x3f\x56\x28\xc7\x7a\xc9\x25\x71\xc7\x2e\x06\x40\x64\xe7\x2e\x97\x0c\xa4\xaa\x43\x5c\xbb\x1f\xbb\x7a\x27\xf5\x43\xae\xf4\x5b\x1d\x4a\x6e\xf5\x93\xe6\x47\x4f\x4a\xd7\x6a\x4f\x9c\xe8\x05\xf3\x91\x32\x81\x3c\xf7\xff\x65\x66\x52\xfa\x96\x51\xee\xec\x49\xb8\xb1\x91\xa2\x5e\xaf\xc7\x6f\xc5\xba\x90\x2d\x41\x4f\x2d\x41\x14\xd4\x3f\x04\xf4\x30\xe5\x89\x6c\x31\x5c\x38\x25\x88\xd8\x12\xae\xfc\xa3\xde\xbf\xa7\x3d\x5a\x97\xc1\xd4\x70\x3a\x3b\x46\x77\xe0\x53\xeb\x7b\xc7\x9e\x83\xda\x17\xa7\xc9\xd2\x47\x5b\x4a\xe8\x59\xf7\x5f\x8e\xaf\xe3\xa1\xd8\x93\x79\xdc\xa7\x6a\x1f\x9e\x99\x23\x2d\xa8\xed\x54\xa0\xa4\xee\xfd\x49\x1f\x95\xab\x36\xf6\x63\x27\x18\x75\xe7\x71\x1d\x67\xfb\xf3\x74\xa8\x09\xec\x50\x37\xfa\xba\x6a\xf6\x5d\x9b\xee\x74\xcc\xc7\x80\x95\x19\x76\x0e\x79\xb6\xf2\x9a\x9f\xed\x18\xc8\x56\x3e\xc3\x52\x72\xcb\x5c\x80\x90\xcd\x3d\x4b\x62\x94\x6e\xf2\xba\x57\x4c\x93\x9b\x67\xc3\xa9\xba\xa3\x2b\x5f\xc4\xa1\x32\x55\x07\x63\x43\x78\x32\x1e\x05\x43\xef\x52\xbb\xfb\x6b\x77\xda\x50\x9c\x94\xfe\x74\xb8\xaa\x0d\xd4\xb5\x8e\x12\xa7\xce\x1d\x0c\x3d\xa9\xf5\xb6\xc3\x63\xc1\x14\x76\xa5\xf6\x9b\xf4\x41\xaa\x6a\x66\x7f\xa8\x18\x2f\x7d\x75\x4a\x5d\xce\xdb\xea\x60\x10\xcd\x69\xb9\xe5\xd6\x3e\x57\x02\xcc\xce\x5d\xbb\x9f\xf3\xb8\x23\x6b\x34\xdb\x1d\x53\x6d\x51\x37\xe0\xf3\xbb\xd6\xc1\xbc\xa4\xce\xd4\xa1\xe4\x56\x27\x73\x19\xa5\xf4\x23\x37\x75\xe7\xa9\xa3\x3d\xc2\x67\xed\x51\x30\x54\x93\x7d\xd4\xcd\xfe\x78\xa4\x5f\x66\xa3\x80\x99\x4c\x40\x64\x7c\x59\xef\x83\xcf\x28\x13\x9f\x67\x17\x9e\x28\x54\xee\x38\xd9\x59\xcf\xda\x3e\x00\x63\xd6\xf5\x58\x5a\xd7\xa4\x12\x0f\x17\x32\xdd\x1e\x19\x82\x56\xc7\xbe\xf1\x48\x87\xa0\x5f\x81\x72\x4c\x77\x0c\xdd\x60\x9f\x8c\x05\x15\xdb\x3c\x88\x65\x03\xec\xc6\xbc\x90\x2b\xfb\x15\x57\xba\xb6\x36\x95\x5b\x4a\x1b\xac\xd7\x52\xb1\x33\x9f\x51\xb2\xda\x9f\xf9\x58\x69\x83\x96\x86\x7d\x4b\xa1\x7c\xbe\xb3\xca\xdf\xc6\x26\xd7\xee\xd7\x2a\x75\x5d\xe5\x87\xed\xc4\xaf\xf3\x42\x6f\x56\x42\x91\x9e\x43\x46\xa0\x1c\x26\xd8\xb2\xd3\x64\x2a\xe9\x6c\xed\x2f\xa5\x13\x09\x8b\x3a\xff\xba\xf6\x04\x3b\x15\xb7\xf4\xa9\x90\x7d\xcd\xcd\x3c\x57\x29\x62\x10\xc8\x2d\x8d\x00\x2e\xad\x7d\xbf\x8e\xe1\xc4\x67\xd4\x60\xd0\x0a\x02\x99\x31\x29\xa7\x62\xa7\x20\x62\x0b\x39\x9a\x94\xd0\xee\xe7\x48\x67\x77\x72\xfb\xa0\xa7\xe4\xae\x65\xce\xa5\xee\x70\xfe\x54\x75\x2a\xd7\x6a\xf6\x32\x95\x78\x67\x70\xf3\xf1\xe3\x8f\x3b\xc2\xff\xc1\xed\xf1\x45\xf0\x55\x52\xa2\x2c\xcd\x92\x32\x5c\xf5\x5b\xcf\x1e\xce\xd1\x45\xd0\xef\xaa\xc5\x3d\x0f\xfd\xf2\x4b\x2c\xeb\x6e\x17\x29\xd3\x81\x87\x91\x8e\xc8\x4f\xc1\x7e\x83\xe6\x3c\x3d\xfb\x3e\xf0\x97\xa1\x6e\xa9\x2f\x3f\x1c\xfc\xfd\x1f\x80\x69\xe9\x5f\x58\xec\xf2\xcd\x87\xe6\x8d\xf9\x5f\x90\xec\x2f\x48\xf6\xf8\xf5\x0b\x92\xfd\x05\xc9\xfe\x82\x64\x8f\x5c\xef\x38\x48\x7f\x0d\xb3\xbf\x90\xd9\xe3\x2a\xf9\xab\x02\xb4\x59\xba\xc1\x67\xb3\xf4\x36\xff\x85\xcd\xbe\x6d\x22\x7f\x01\x88\x76\xf7\x9b\x61\x47\xbe\x9d\xf9\x4d\xa6\xb1\xbe\x7e\x01\xb8\x97\xc8\xf9\x5f\x02\x70\xf7\x3c\xe8\x17\x8e\x7b\x91\x80\xbf\x0c\x8e\x8b\xb8\x64\x70\xf3\xf1\xd3\xcd\x48\x7b\xb2\x1d\x69\xc8\x89\x8f\xff\xf8\xdb\x8a\xf8\xea\x16\x5e\xfd\xab\xa0\xa8\x16\xd8\xfe\xff\xe6\x66\x0d\xc8\x7e\x38\x88\x54\x4d\x59\x79\xf3\xb1\x41\x6f\x3f\x36\xf0\xed\xab\x58\xce\x18\xf7\xbe\x57\x74\xdd\x0a\x1e\x8a\xe7\x1f\xb5\xf1\x01\x98\xbc\xf9\x6e\xfd\x16\x96\xbc\xa4\x96\xa5\x47\x65\x7c\x82\x67\xf3\x85\xfa\x7d\xce\xc1\xa3\x73\x9c\xa5\x69\xb6\x4e\x22\xd6\xc8\x36\x89\xc4\xd3\x6d\xa9\x67\xce\x5d\x51\xa0\x5c\x9d\x23\x88\xef\xd8\xaa\xb1\x44\xc6\xd4\x15\x8a\xb4\xa1\x13\xd7\x48\xcb\x7c\xfb\x84\x31\xf2\xec\x3e\x86\x8c\x90\xfb\x3c\x3d\xf5\x2d\x35\x90\x75\x7a\xe2\x8a\xea\x12\xe5\xed\x52\x94\xd2\x1d\x96\x50\x54\xe6\x0d\x62\x21\x9a\x95\x6f\x09\xc5\x0a\x09\xdf\xa0\x5d\xcb\x13\xd7\x87\x62\x23\x77\x8d\x3c\xac\x4e\x76\xe5\x48\x2b\x1d\x86\x60\x10\xb2\x53\x9f\x69\x47\x9e\x05\x0a\x2f\x56\x4a\x3f\xe4\x1e\x46\x8f\xe6\x48\x0b\xd2\xdf\xf9\x60\x16\x3a\xb6\x49\x79\xbd\x61\xf8\x14\x76\xea\xcf\x7d\x29\xd4\x7e\x37\x84\xfe\xc8\x12\x70\x7f\x6c\x08\x3d\x4d\x37\xb0\x5c\xa5\xac\x34\x4d\x02\x34\x4f\xfa\xbc\xba\xe2\xe1\xa5\x2f\x12\x2f\xcd\x76\x68\x0d\xc1\x34\x1f\x83\xb0\x96\xf3\xac\x26\xfd\x67\x35\x65\x97\x27\xbc\xe9\x02\xd9\x0a\xe5\x5a\xf4\x14\x8a\xf3\xa0\xd6\x09\x88\xd5\x8d\x4e\xe4\xb8\x41\x4a\x53\x87\x31\x06\x1b\xd4\xb3\xd7\xa1\x6b\xbd\x49\xa1\xa6\x1a\x33\xd6\xb1\x0c\xac\xa8\x06\x14\xa4\x20\x19\xf8\x16\x99\x79\xb6\xb4\x3e\x2d\x9d\x83\x88\xbd\x47\x6a\x1a\x3a\xb6\x82\x95\xa9\x1a\xc8\x96\x1a\x8c\xba\xf3\x87\x57\x5e\x45\x30\xb0\x1a\x4a\xdd\xfb\xd5\xe9\x70\xa7\xf2\x5b\x93\xf6\xe6\x77\xa4\x54\x90\x3b\xc5\x4f\x04\x4b\x97\x36\xa7\xc2\xa0\xd7\x2f\x51\x6f\xb6\xfe\x5d\x78\x8c\xd9\x5e\x22\xd1\x06\xa3\xf0\x1c\x71\x79\xee\x61\xd4\x9d\x87\x7d\xa1\xa3\x8f\xe9\x89\xab\x52\x2f\x7d\xcd\x68\x1b\x2a\x65\xea\x26\xff\xa6\x9c\x06\xd1\x6e\x90\x90\xe5\x7c\xa6\x9e\xc8\xb6\xfc\x90\x23\x46\xc8\xbd\x0c\xbb\xdc\xfc\x69\xfa\x38\x1f\x76\xb9\xfd\x75\x4f\x3d\x91\x2e\x5d\x9e\x9b\x2b\x53\x6e\x2e\xf1\x27\xe6\xb8\x77\xba\x0d\x5a\x78\xb1\x41\xf4\x56\xba\x90\xba\xf3\x87\x06\xe5\xc6\xcb\xb9\xdb\xd4\x52\xef\x23\x1d\xec\xee\xb5\x0e\xd6\x68\xf8\x81\x4c\x28\x9a\xc4\xe5\xd9\xd5\x9e\x53\x9b\x39\x00\xc6\xac\x60\x84\xa7\xae\xbe\x83\xf2\x9b\x7e\x84\x29\x5b\x4d\x3b\x6e\xac\x61\x30\xa5\xd7\xa7\xf5\xaf\xf4\x6a\xaa\xbb\xb6\x40\xd7\x7e\x03\x16\xc7\x9e\x27\x03\x8b\x5e\xdb\x90\x09\xf9\x99\x59\xc0\x08\x57\x3e\xd3\x26\xb5\x3e\xb5\x08\xe7\xee\x98\x3a\x86\x0c\xac\x75\x28\x20\xd1\x9c\x1a\x8d\x5d\x6a\x2a\x88\x0c\x56\xd6\x5f\x91\x32\x99\x59\xfb\x52\xa7\xf2\x75\x8e\xb8\x21\x87\xfd\x60\x9b\x47\x65\x57\x68\x47\x83\x02\xbc\xda\x70\x9f\xf6\x1b\xe4\xb2\xdf\xbc\x25\xe2\x47\x02\x71\x75\x0e\x37\x68\x38\xcf\xd5\x7e\xfe\xe5\xa9\xab\x52\xc3\x8a\x23\x30\xe4\x76\x6c\xf3\x29\x64\x17\xae\xa5\x54\xae\xad\x2d\x24\x7e\x65\x87\x26\xbb\xd4\xfd\xeb\x7c\x4b\xd0\xa5\x56\x28\x4e\x83\x34\xac\x75\x53\xfb\x58\x09\xf8\x66\x9e\xba\x6b\x2b\x94\x63\xf7\xa9\x91\x25\xe4\x90\x11\xda\x60\xfe\x7a\xcf\x60\xcc\xe9\x68\xfc\x38\x58\xad\x7d\xe8\x59\x74\x0a\x1f\x71\x01\xc5\x5a\xb7\x42\x3e\x1a\x73\x03\x1e\x93\xfe\x1a\x21\xb5\xd5\xd4\x76\xac\x36\xe5\x5a\x1a\x8f\xc6\x34\x81\xd6\x0b\xe5\xe9\x2b\x24\x2f\xd6\x26\x20\x82\x18\xae\x90\x8d\xb7\xd0\x96\x03\x7b\x50\x7f\xa1\x1a\x27\xbe\xd0\xf6\x5a\xf7\xfd\x97\x80\x1b\x6f\x22\x13\xbf\xed\xaa\xe5\xeb\x6f\x7f\xfe\xf6\x7f\x01\x00\x00\xff\xff\xa0\x29\x5f\x26\xdc\x48\x00\x00")
+var _envDevelopmentJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7b\x6b\x6f\xa3\x48\xf6\xf7\xfb\xf9\x14\x51\x9e\x95\xd2\xad\xa7\xd3\x01\x1c\x67\x9a\x91\xe6\x05\xc6\x36\xc6\xc6\xc4\x80\xb9\xee\x8e\x46\x45\x15\xc1\xd8\xc5\x65\xa1\xc0\xc1\xab\xf9\xee\x7f\x81\x2f\xf1\xdd\x4e\x5f\xa4\xd5\x4e\xd3\x4a\x27\x86\x73\x4e\x55\x9d\x3a\xb7\x3a\x3f\xfc\x9f\x5f\x6e\x6e\x6e\x6e\x6e\xff\x91\xc1\x89\x17\x82\xdb\xdf\x6e\x6e\x27\x84\x24\xd9\x6f\x0f\x0f\xcb\x3b\x9f\x43\x10\x01\xdf\x0b\xbd\x88\x7c\x06\x8b\x3c\xf5\x3e\xc3\x38\x5c\x3d\xcb\x1e\x18\x8a\x6e\xde\x53\xf4\x3d\x45\x3f\x20\x2f\xc1\x71\x59\xd1\x8d\xbd\x30\xc1\x80\x78\x9f\xa7\x59\x1c\xfd\xbf\xdb\x4f\xcb\x11\x60\x1c\x11\x2f\x22\x86\x97\x66\x41\x1c\x55\x03\xd1\x9f\xa9\xea\xdf\x9a\x20\x01\x29\x08\x3d\xe2\xa5\xd9\xed\x6f\x37\xcb\x69\x2d\x19\x03\x6e\x91\x8c\xe3\x99\x17\xed\xdc\xaf\x9f\x91\x32\xf1\x2a\x51\x19\x49\x83\xc8\x5f\x49\xda\x3c\x45\xde\x0b\xc8\x31\x31\x00\xce\x6b\xaa\xdb\xcd\xe3\xbf\x3e\x6d\xcb\xe7\x41\x02\x60\x40\xca\xd3\xf2\x83\x88\x5c\x10\x4e\x9d\x90\x3d\x8a\x63\x2c\x83\xd0\xfb\x31\x73\x4f\xd2\xf8\xb5\xe4\xbd\x94\x5c\x14\x7f\x86\x1d\x07\x5e\x44\xbe\x51\x48\x3b\x0e\x41\x10\x55\x0b\x95\x80\xeb\xe1\x6f\x90\x24\x86\xc0\xbf\xac\xad\x0b\xfc\x5c\x4e\x26\x67\x64\x78\x30\x4f\xbd\x8b\x92\x06\xde\x19\x8b\xb8\x42\x46\xee\xe2\x00\x8a\x23\x0e\xa1\xd4\xcb\x32\x0e\xe3\x18\x02\x12\xc4\xd1\xd0\x23\x93\x18\x7d\xab\x41\x68\x04\x90\x00\x5e\x35\xb4\x36\xcb\xbf\x87\x09\x6a\x04\x44\x08\xa4\xe8\xf8\x98\x59\x36\x19\xd5\xc3\x9e\x57\xdb\x19\x85\x15\x49\xc4\x73\x95\x1d\x06\x2f\x01\x04\xe4\x7b\xba\xcc\x2f\x5b\x63\xdd\xa6\x5e\x16\xe7\x29\xf4\xaa\x38\xf3\xcf\x0d\xcd\xde\x50\xd9\x2c\x3f\x18\xbf\x7e\x10\x2d\x35\x79\xfb\xcf\xb7\x78\xf5\xe1\xee\xb8\xc2\xef\x3e\xfe\x71\xbb\x23\xe0\xaf\xbd\x19\x27\x69\x9c\x54\xeb\xf5\xb2\xe3\x63\x6d\xc4\x1e\xda\xce\xd9\xf1\xf7\xe9\x2f\x4e\x64\xbd\x28\xe4\x15\xf7\x45\x12\xdd\x27\x41\xb2\xaf\xdd\xb5\xee\x87\x01\x4c\xe3\x2c\x7e\x21\x9f\x65\x8f\xcc\xe3\x74\xf6\xb0\x37\xb8\x97\xed\xb3\xae\x27\x53\x4f\x7b\xad\x7d\x21\x8d\xf3\xe4\xc3\xc7\xcf\xeb\x87\x7f\xec\x73\xc1\x38\x42\xc1\x86\xcd\xfb\x77\x0e\x70\xf6\x61\x7b\xd1\x6f\x81\xfb\xee\xe3\xa7\x1b\xea\xe3\x81\x04\x90\x04\x5b\xe9\x86\xa1\x68\xf6\x9e\xfa\xf5\x9e\xa2\x8f\x9a\xdf\x7f\xde\xb7\x35\x60\xb5\xd3\x09\x80\x87\x86\xba\x4f\x35\x4a\xbd\x97\xe0\x75\xcf\xe0\x0e\x88\x69\x6a\x99\x10\x1f\x98\xc6\xed\x51\xaa\x3f\x0e\xee\xee\xed\x63\x2d\x26\xcb\xdd\xc8\x23\xa7\xc7\x3a\x3e\xd5\x9b\x2b\x16\x7d\x7a\x69\x75\x3a\xdf\x4c\xff\xf1\xf8\xf4\x4f\x4c\x78\x23\x71\x6d\x84\x02\x20\xde\x1c\x94\x5a\xbd\x8e\xe3\xa2\x4e\x88\xf9\xa1\x4b\xa3\x97\x4b\x3b\xbd\x80\xe5\x22\x96\x4e\xa1\x55\xe9\x21\x20\x65\x6d\xe5\x17\x47\xac\x39\x03\xb4\xe3\x1f\x22\xfa\x70\x77\xe8\x6b\xc7\xc4\x67\x77\x9f\x6e\xee\xd2\xe4\x3e\xca\xfc\xbb\x03\x27\x38\x3a\x14\x01\x7e\xa5\x86\x28\xc7\xf8\x2c\xf1\x5f\xdf\xb4\x8f\xe3\x38\xc6\x41\xe4\x9f\xdd\xc7\x83\xbb\x7f\x5c\x1f\xa7\x2a\xa9\x57\x07\xa9\x22\x48\x49\x0e\xf0\xea\xe3\x77\x0a\x51\x3f\x32\xc0\x04\x09\x1f\x47\x2f\x81\x9f\xa7\xf5\xd8\x3f\xdc\x9f\x97\x61\xe3\x3b\x9a\xea\x9e\xc6\x1f\x56\x71\xa9\x32\xd6\xf5\xf6\x55\x7f\xef\x78\xfb\x41\xa2\xda\xbf\xce\xd8\xdd\xcd\x91\xca\xe7\x3b\x2e\xe7\x20\xcb\x6d\x16\xb2\xcc\x97\x97\xa7\xfe\x4d\xce\xb4\x2a\x6e\xae\x76\xa3\x23\x89\xa1\x48\xa2\xf1\xca\x3f\xd4\x38\x27\x5e\x0b\x64\x1e\x3a\x12\x2e\x4e\xd6\x3e\x3b\x13\x32\x92\x48\x98\xd3\x27\xa2\xcd\x2d\x09\xbc\x74\x8b\xea\xaa\xc4\x55\xd5\x7f\xcb\xb3\xc8\xb6\xe1\x9f\x9e\xc9\x86\x7e\xb5\x25\xd5\x51\xeb\xec\x86\xbf\x2b\x1d\xd7\x0c\x34\xcb\x7c\xa6\x9f\xbe\x7c\x66\x9a\xcd\x0b\x89\xed\x30\x37\x9f\x58\xe6\xee\xd4\xd5\x38\x26\x5b\x25\xef\xf9\x29\x5d\xf0\xe0\x77\x78\xfb\xcd\x9b\xaf\x54\xa3\xb7\x01\x01\x07\x35\xe5\x7e\x39\xfe\xcd\xbe\xb9\x5f\x64\x42\x70\xa6\x4e\x38\x5e\x00\x5d\x52\xe7\x28\x8d\x49\x0c\x63\x7c\xa1\xd2\x7a\x4e\xbc\xc8\x18\xc9\x57\x57\x59\xef\xa9\x9d\xbf\x36\x25\xad\xe2\xe0\x7f\x7f\xf1\x7c\x70\xea\x4a\xbc\x08\x65\xcf\xd1\x51\x95\x7f\x8f\xa8\x7a\x24\x54\xbc\x2f\xf5\xec\xa4\x9c\x7d\x2b\xfe\xe3\x8a\x5c\x7d\xf1\x30\xb8\x3e\x1a\xff\xd9\x66\xb2\x3f\x8b\xc6\xb1\x29\xaf\x23\xe2\xe6\x14\x7d\x84\x06\xbe\x35\xa2\x76\x7d\x71\x7b\xb7\xbe\xf1\x4c\x99\x27\x7e\x0a\x90\x37\x8a\x71\x00\x0f\x0f\xea\x1b\xb2\x30\x46\x4b\xb3\x05\x51\x0e\xf0\x95\x01\x7c\xa9\xf6\x21\x80\x93\x20\xf2\x46\x69\xfc\x12\xe0\x33\x87\xa3\x38\xbb\x44\xb2\x54\x4a\x1c\x26\x39\xf1\xd2\xea\x44\xfd\x56\x92\xc3\xe0\xfe\x4c\xa5\x7b\x0b\x50\x18\x44\x7a\xe6\xa5\xeb\x1d\x82\x38\xce\xd1\x7d\x9e\x79\xe9\x39\x36\x1c\x44\xf9\xeb\x75\xe9\x67\xc3\x83\x82\x0c\xb8\xd8\x1b\x81\x2c\x9b\xc7\x29\xe2\x72\x32\xf1\x22\x12\x6c\xbc\x96\xa4\xb9\x77\x21\x32\x66\xd9\x61\xb7\xea\x28\x61\xb2\xee\xb0\x5c\xce\x5d\xeb\xeb\xb2\xd4\x37\xe9\xa0\xee\x9a\xdd\x3e\x4c\xe2\xd0\x7b\x78\xd3\xd8\xc3\xe7\x2c\x9b\x3c\x80\x9c\x4c\xe2\x34\x58\x78\xe8\xcf\x99\x77\x10\xa7\xce\x0a\x9e\x79\xe5\xd1\x14\xb3\xdd\x33\xba\x98\x5e\xd6\xd7\xe9\x3a\x6a\x7d\x1d\xcf\xc5\x97\xf9\x8f\x3f\x39\x95\xc3\x33\x12\xa7\xc0\xbf\x68\xe6\x35\x6d\x10\x02\xdf\x53\xbd\x17\x2f\xf5\xa2\x33\xfd\x82\x0d\x7d\xbd\xcf\xd9\x64\x19\x31\x54\x0f\xf5\xc0\xfe\x51\xe7\x80\x25\x7e\x79\x59\x91\xf7\x3a\xd2\x25\xe2\x65\x40\xbb\xfd\xf5\x5e\x32\x86\x97\x68\x8b\xb7\x2c\x80\xab\x12\xe5\x44\x0d\x7a\x73\xa1\x90\x8d\xb3\x76\x90\xcd\x2e\x2f\x1d\xa6\x1e\x20\xde\x73\xb2\x4e\x5e\xdd\x34\x0e\x97\x3d\xe1\x0b\xf3\x5c\x02\x15\xe8\xaa\x51\x6e\xb6\x36\x90\x83\x30\xce\x23\xb2\x2e\x8d\x47\xa9\x17\x06\x79\xf8\xa7\xa4\x6a\x5f\x5d\xcf\xbf\xcb\x8e\x56\x47\xfa\xab\xec\x68\x45\x2b\x46\xc4\x4b\x5f\x00\xf4\xae\x3c\x22\xae\xaf\x2b\x94\xb2\x89\x97\xc1\x7d\x11\x66\xd9\x7d\x14\xc0\x6b\x3a\x0a\xef\xac\x3d\x57\x3c\x41\x08\xd2\xf2\xaa\x10\xb9\x61\xba\xfa\x58\x7c\xec\xba\x3e\x16\xde\x1c\xd3\x45\x90\xc0\x7a\xec\x77\x84\xbe\x9b\xaf\x54\xce\x0e\xff\x3b\x8e\xe6\x47\xf9\xbf\xe7\x71\x7d\xa7\xa9\x73\x75\xcc\xde\xbe\x2e\x1c\x13\x8e\xae\xe0\x6b\x4c\x65\x57\xc0\x6e\x9d\xf9\xbe\x14\x7f\x52\xea\xbe\x81\x1c\xb6\xcd\xaf\x9f\xe0\xb7\xd9\xc8\x46\x0e\x8a\x32\xcd\x23\x24\x88\xfc\x6f\x13\xb4\x14\x76\x80\xea\xdd\x82\x34\xbe\x87\xc1\xfb\x77\x7d\x7d\x5d\xce\xde\xdf\x87\xeb\x7d\x1c\xd7\x53\x5f\x47\x79\xbe\x02\xb9\x2c\xe7\xf4\xd3\xf7\xf5\x19\xbc\x57\xe2\x45\x55\xf6\xbe\x2a\xbb\x6c\xa8\x7f\x48\x26\x81\xd9\xa5\x14\x7e\xf3\xd5\x99\x64\xbb\x5c\x7a\x0b\x6d\x5c\xfd\xbe\x42\xe7\x6d\x55\x57\xe6\x98\xf5\x91\x9d\xcf\x33\x12\x87\x1a\x4c\x83\xe4\x52\xf9\xb5\xc3\xdb\x03\x11\xc2\x5e\xba\x7d\x7c\xde\xbc\xe6\x70\x51\x00\xc8\x49\xac\x2f\xcf\x68\xc3\x20\x8a\xb7\xa4\xbc\x23\x4b\x66\x5b\x21\xe0\xca\x78\x5b\x29\x9e\x78\x90\x78\xe8\xab\xe2\xc7\x6d\xb6\x54\x53\x95\x68\x5c\x90\x79\x4f\x8f\x1f\x60\x1c\x41\x40\x3e\x2c\x3f\x8d\x63\xad\x06\x6d\x3f\xdc\x41\xc6\xa0\x44\x9e\xc6\xbc\x1f\xff\x7e\xf7\xf1\xd3\x1d\x2f\x72\xce\x68\xfc\x3c\xe8\xc8\xbf\xdf\xdd\xdd\x7d\xda\x3d\xf6\xae\x5f\xfd\xa8\x08\xef\xee\xfe\x15\xdd\x55\xf4\xa3\xe7\x67\x49\xe6\x86\x9d\x23\xf4\xeb\xd7\x2d\xb6\xe8\xab\xff\xf6\xe7\xc0\x47\x98\x76\x35\x8e\x78\x5a\x8b\x86\x82\x3a\x41\x82\xee\x4b\x96\xef\x1b\x54\x77\x08\xcc\x26\xed\x75\xba\x91\x63\x36\x29\xde\x4f\x32\x14\x1a\x8f\x48\x30\x72\x87\xe7\x88\xcb\x73\xa9\x3c\xe6\xb0\x8a\xfb\x5d\x55\xe3\x0a\x47\x30\x18\xa9\xd1\x2f\xdc\x86\xca\x38\x25\xcb\xd8\x56\x3f\x43\x7e\xf2\xe8\x44\xf2\x8b\xd3\xe8\x17\x88\x71\x16\x22\x5f\xdd\x17\x07\x7c\xf8\xca\x38\xd6\x84\x72\xcc\xe6\x4c\xe4\xe9\x4c\xe4\xb3\xd7\x61\xfb\xa4\xac\xd8\x65\x68\xec\xf6\xec\x81\x27\x38\x0b\x8b\x41\xa5\xdb\x40\x21\x2c\xb9\x02\x08\x2c\x71\x94\x78\x00\xa3\x16\x11\x79\x8a\x00\x93\x9e\xbb\x8d\x3e\x25\x0a\x13\x0a\xf5\x5a\x8b\xe7\xe0\x4b\xe1\x08\xf3\xdc\x09\x8d\x99\xdb\xe8\x4f\x60\xaf\x5f\x80\xd0\x98\x22\xbe\x59\xc0\x10\x16\xb0\x67\x04\x12\x63\xcc\x1d\x73\x5e\xe8\xb8\x25\x4b\x3a\x52\xd4\x92\x96\x54\x63\x46\x54\xa3\xd5\x1d\xf3\x54\x83\x8f\xfa\xf3\x4a\x3f\x92\x89\x09\x14\xd8\x12\xf1\xad\x18\xf5\xd4\x39\x5c\xc4\x85\xd4\x68\x4d\x6c\x86\x4c\x1c\xc6\x58\x48\x21\x9d\xd8\x8d\x7e\x01\x19\x36\x44\x7c\x73\xea\x32\x54\x01\x18\xa3\x09\x4b\x96\x00\x53\x2e\xdd\x86\x5c\x38\x91\x92\xdb\x96\x3c\xe5\xfd\xa4\x89\x4c\xca\x97\xac\x99\x0f\xcc\xe6\x02\x09\xdd\xcc\xdd\x96\xcb\xa8\x99\x14\x3a\xd8\x11\xd8\xd2\xb6\x5a\xa5\xcb\x24\xd8\x6e\x28\xb9\xdb\xe8\x47\x52\xa3\x45\xdb\x01\x8b\xa1\x60\x64\xab\xb9\x13\x18\x1a\x99\x63\x76\x17\x8e\x46\x67\xb6\xa5\x62\xd8\x50\x88\x5c\x36\x73\x97\xe9\x96\x36\xe3\xe7\x95\x7e\x78\x3f\x99\xda\x96\xe2\x8f\x02\x16\x23\x61\x58\x78\x96\x41\xa4\xa8\x8f\xa1\xc0\x2e\xa4\x50\x29\x6c\x2b\xa1\x61\xa8\xe7\x30\x34\xe6\x6e\xc9\x7d\x19\xf1\xa8\x3b\xa6\xec\x88\xc7\xd5\x21\xde\x28\x1d\x8d\x9e\xba\x02\x46\x7c\xd8\x9c\xb8\xa6\xce\xae\xe8\x89\xcd\xbc\x26\x7c\xd8\x9f\x40\xc6\xa0\x61\x38\x67\x41\x4f\xa5\x60\x6f\xf8\x24\x95\xec\xdc\x36\xe5\xd4\x36\x11\x86\x65\x73\x57\x07\x0c\x4b\xa4\x06\xa6\x5d\x6b\x35\x3e\xd3\x7d\x42\x56\x1f\x4b\xa6\x9c\x01\x25\xc1\x6e\xd8\x0d\x5c\xc1\x98\x8d\x2c\x8c\xe1\x3c\x89\xa0\x80\xa6\x40\x30\xa6\x60\x41\x37\x1d\x6b\x38\x50\x75\x56\xd8\xe8\x50\xa3\xd7\xf4\xa5\x63\xb5\x8a\x91\xd5\x8f\x91\x39\x23\x30\x9c\x60\x97\xa7\x1a\x92\x25\x63\x18\x39\x18\x06\x74\x09\x7a\x46\x22\x99\xec\x1c\x09\xb8\x70\xc3\x6e\x26\x59\xfd\xb9\x6b\x0d\xf7\xf7\x61\x6b\xbd\x33\xdf\x11\xd8\x29\x60\x8c\x52\x14\x92\x57\x51\x40\x53\xbb\x6c\x95\x80\xa7\x23\x60\x29\xe5\xb3\x56\xff\x3d\xf7\x2c\x35\x76\x99\xc7\x85\x1c\xb4\x28\xd7\x6a\x35\x6c\x4b\x9d\x02\xbe\x95\xa1\x9e\x9a\x3b\x25\x4d\xc3\x86\x38\xe0\x67\x68\x64\xd1\x4e\x57\xc7\x72\x7f\x4c\x3d\xb2\x43\xed\xf1\x55\xe6\x1f\x9b\x7c\x28\x57\x7a\xf3\xb7\xf4\x36\x73\xf9\x66\xe4\x32\x6c\xe4\x0a\xfa\x52\x57\x0c\x2a\xaa\x9f\x7e\x8f\xf4\xc6\x34\x6b\xaa\x46\x7f\xac\xe9\xec\xf3\x8b\xd6\xcc\x6a\x1f\xe5\xe9\x89\x6b\x2a\x8c\xcc\x37\x29\xdb\x12\x73\xa7\x11\xfb\x2f\x7c\xab\xfa\xdb\x97\xf4\xa1\x2f\x35\x8c\x05\x0c\xd8\xcc\x65\xe4\x89\xcb\x73\xc4\xeb\xc5\x03\x57\x78\xf4\x25\x6b\xff\x19\x1b\xb9\x25\x1b\x00\xf3\xb1\x18\x04\x5c\x81\x2c\xb9\x94\x98\xd7\xc2\x66\xba\x99\xc4\xf4\x13\xd7\x8f\x07\x06\x96\x75\x9d\x66\x5b\x2a\x65\x3c\x1b\xdd\xb7\xb9\x8c\xc6\x62\x3e\x1c\xfb\xaf\xd2\xb4\x33\x70\x4d\x32\x03\xd5\xd8\xcc\xa4\x70\x4d\xbd\xb0\x99\xd7\x02\x99\x0a\x41\xd5\x5e\x04\x6c\xe5\x2f\x39\xe2\x92\x39\xb2\xe4\xd8\xe1\x57\x7e\xac\xb1\x53\x57\x60\x69\x87\xa7\x69\xc8\x18\xa5\xc4\xac\xe2\xce\xa1\x7e\x18\xd8\x50\x17\x95\x5d\xb9\x91\xba\xb1\x31\x29\x5c\xda\x90\x63\xaa\x91\xa3\x35\x73\xc7\x52\x8a\x25\x8d\x52\xe9\xcd\xd4\x69\x75\x6c\x51\xdd\x9e\xaa\x37\xf5\xb7\x7d\x68\xb2\x52\xc3\x59\xa0\xde\x90\xac\x68\x89\x2b\xe0\x1c\x59\x3e\xf1\xda\x36\x25\x69\xea\xaf\xa7\xd6\xfb\xa2\x1d\xd1\xb5\x35\x79\xe2\x43\x39\x76\x1b\x28\x17\x79\x5a\x13\x05\x39\x73\x1b\xc6\x4c\xb2\x8c\x85\x63\x89\x4f\xbb\x7a\xe0\x72\xde\x8f\xf3\x5a\xaf\x01\x9b\xb8\x91\x4c\xd9\xe6\x6b\xe6\x08\x95\x4f\x37\x67\x8e\xd9\x9c\x02\xd3\x58\x48\x91\x1c\xf3\x91\x4c\x3b\xc2\x17\x5f\xb2\x74\x7f\x5f\x86\xc4\xc8\x85\x1b\x3a\x89\x53\x36\x17\x80\xe7\x88\x64\x19\xb9\x6d\xa9\xd4\x52\x86\x52\xf9\xc7\x81\x7d\x39\x96\x9d\xaf\xfd\x7d\x69\x5f\xf4\x62\xf5\xb9\xa2\x9f\x20\x4b\x8d\xc5\x5e\x6b\x82\x6a\x79\x6a\x15\xc7\x72\x91\x17\x67\x0a\x85\x5b\x26\x6e\xe9\x63\x8a\x74\xc7\x81\x58\xd1\xce\x5d\x86\xcd\x56\xcf\x94\x31\xc5\x0e\xc7\xb3\xae\xac\x6a\xf5\xb3\xe5\x3e\xf3\x5c\xa0\x18\xfd\x91\x64\xf4\x45\x55\x9f\x93\x7e\x67\x32\xd2\x69\xf5\x59\xd1\xe9\xae\x18\x54\xf2\xab\x18\xf0\x3a\xb1\x19\x7d\x20\x05\xec\x02\x85\xc3\x1c\x32\xfe\xb6\x3f\xee\xd8\x05\x1f\xb5\x0a\x28\x28\x03\x3e\x18\xfa\xae\x69\x94\x0e\xa3\xfb\xc0\x7c\xf4\x25\x86\x9d\x23\x9e\x2d\x41\xfd\x43\xfd\x5b\x62\x8c\xdc\x36\xfb\x99\xa3\x6c\xe2\x5e\x9d\x47\x24\x66\x67\x4f\x36\x36\x22\x45\xad\x09\x12\x7c\x7f\xd4\x9e\x47\x55\x7c\xe9\xcf\xe3\xc2\x6d\xb4\x28\xa9\xd1\x8f\xeb\x1f\xab\xd5\x44\xc2\xa4\x70\xa7\xc3\x55\x6e\x52\x56\xfe\xd1\x4f\xdc\xe9\x1e\xad\x89\x12\xd4\x16\x9b\xc7\xe8\x0e\x7c\x6a\x73\xef\xc8\xf3\x86\x5c\xf9\xe2\xd3\xca\x47\x17\x76\x88\xf3\xe7\x13\xeb\x90\xc2\x5d\x99\xc7\x7d\xaa\xf2\xe1\xa4\x8a\xeb\x03\x3e\x94\xab\xfd\xfd\xff\x67\x7d\x94\xff\x92\x3b\x66\x93\x11\xdb\xf3\x2f\x7d\xca\x18\xa9\x01\x1c\x8c\x3b\xea\xcb\xb8\x83\x79\x7d\xd6\xd5\x4c\x83\x55\x14\x43\x15\x47\x1a\x5b\xc0\x9e\x52\xc0\xd0\xaf\x7e\x08\xec\x61\x0a\x08\x6c\x3e\x5c\xd8\x05\x0c\xd9\x02\xf1\x6c\x15\x03\x0b\x57\xc0\x81\x3c\x55\x9e\xb6\xf6\xaa\xce\x79\x4e\x5b\xa4\x76\x75\xf5\x9a\xd8\x53\x9b\xe2\x67\x74\x6b\x8c\x5b\x2d\xa3\xe3\xb3\xbb\xfb\xbb\x1d\x73\xd9\xd2\x65\x58\x6a\xad\x23\x20\x74\x4b\x47\x63\x89\x5d\xe9\x6d\x97\x67\x15\xb3\x4f\xd2\x0f\xf4\x8e\xa1\x8d\xdb\xc6\x50\xd3\xc5\xfd\xf1\xce\xf1\xce\x1d\xab\x9f\xc9\x1a\xcb\x54\x3e\xe7\x36\xfa\x2f\x50\x30\x4a\x97\x4b\x14\x8d\x42\x2f\x0a\xc5\x3e\xab\x33\xdc\xb3\xe8\x77\xad\x23\x03\xa6\xc8\xc8\x3c\x3b\x07\x0c\x9a\xba\x4c\x33\x04\x26\x1c\x98\x1d\xb5\x67\x51\x6a\xcb\xe8\x74\x5f\xd4\x0e\xd6\xf4\x05\x75\x9d\x8d\x36\xe4\xd8\xb6\xfa\xf8\x39\x58\xef\x03\x3b\xb5\xcd\x79\x01\x99\xc9\x04\x86\xfa\xd3\xce\x7a\x94\x95\x7d\x44\x32\xae\xea\x3c\xa0\x71\xc4\xd1\xb8\x08\x96\xac\x37\xa6\x5b\x7a\x15\xfb\xf4\x05\x15\x59\x3c\x8c\x24\x8a\x55\x8c\x0e\x1e\x8d\xf1\x90\xed\xd3\xf3\xa8\x5f\xd2\xbd\xbd\x98\xe7\x4b\x25\xf4\x25\xc6\xa0\xec\x92\x5d\x78\x96\xbc\x5e\x4b\xb1\xce\xab\xbc\x9f\x54\xf7\x29\xc7\xa4\xa7\x48\x98\xfb\x8e\xd9\x9c\xd8\xe1\x2b\x16\x05\xb5\xb0\x19\x82\xa1\x1f\x0f\x6c\xa6\x4b\x89\xed\xc7\xc2\xb1\xd4\xa9\xc4\xc8\xa5\xcb\x3c\xe6\x40\x60\x69\x18\xbe\x36\xa5\x86\x4a\x60\x0f\x4d\x90\x20\xc7\xdb\x76\x2a\x96\x9d\xa2\xf2\x17\x89\xa9\x6a\x13\x7f\xc0\x87\xc6\xa3\x63\x56\xf9\xae\xf6\xa9\x02\x09\xf4\x1c\x31\x5d\xca\x66\x7c\x7f\x38\x55\x63\x91\x67\x29\xd7\xe2\x96\xb5\x45\x15\xc3\x4d\x76\x26\xf2\xe4\x51\xe4\x97\xf5\x52\x55\xdb\xb9\x41\x33\x76\x1b\x46\xe9\xf6\x66\xdb\xfc\x03\x3e\x98\x2c\x5c\xc1\xc0\x90\xe7\x16\xc3\x76\xe6\xc3\xd0\x08\xaa\xbd\x1c\x68\x5c\xc8\xfb\xbf\xff\x7e\xf7\xf1\xe3\xf7\x6b\xe9\x7f\xe7\xe3\xf2\x55\x70\x56\x5c\x78\x69\x92\xc6\x45\xb0\x3a\x7f\xbd\x00\x9c\x79\x57\x41\xc1\xab\x23\xef\x65\x28\x98\x5f\x62\x5b\x0f\xbb\xc8\x99\x06\x01\xf6\x34\x8f\xfc\x10\x2c\xd8\xaf\xfb\xeb\xe9\xb7\x81\xc1\x0c\x75\x4f\x3d\x7d\x77\x30\xf8\x7f\x00\xb6\xa5\x7f\x62\xb3\xcb\x37\x21\xea\x37\xe8\x7f\x42\xb4\x3f\x21\xda\xe3\xd7\x4f\x88\xf6\x27\x44\xfb\x13\xa2\x3d\x72\xbd\xa3\xb1\xfe\x16\x66\x7f\x22\xb5\xc7\x55\xf2\x77\x05\x6c\xd3\x64\x83\xd7\xa6\xc9\x7d\xf6\x13\xab\x3d\x6d\x22\x7f\x03\xc8\x76\xf7\x9b\x62\x47\xbe\xad\xf9\x55\xa6\xb1\xbe\x7e\x02\xba\xd7\xc8\xf9\x5f\x02\x74\xf7\x3c\xe8\x27\xae\x7b\x95\x80\xbf\x0d\xae\xeb\x71\xf1\xe0\xee\xe3\xa7\xbb\x91\xfa\x6c\xd9\xe2\x90\x13\x3a\xbf\xff\x63\x45\x7c\x73\x8f\x6e\xfe\x95\x53\x54\x03\x6e\xff\x7f\x77\xb7\x06\x68\x3f\x1c\x44\xaa\xba\xac\xbc\xfb\x58\xa3\xb9\x1f\x6b\x38\xf7\x4d\x2c\xa7\x8f\x7b\xdf\x2a\xba\x3a\x0a\x1e\x8a\xe7\x3b\xea\xf8\x00\x5c\xde\x7c\xd7\x7e\x0b\x5b\x5e\x52\x4b\x62\x47\x1e\x9f\xe1\xd9\x7c\xc1\x7e\x9f\x73\xd0\xb1\x8f\xb3\xd4\x87\xad\xb3\x08\xb6\x67\x19\x44\xe4\xe9\xa6\xd8\x33\xe6\x8e\xd0\xa5\x1c\x8d\x23\x1e\xdf\xb2\x14\xfd\x35\x71\x23\xe3\x51\x59\x76\xf8\x07\x1b\x3a\x01\xe7\xb0\xa1\x4e\x5c\x61\xee\x6f\x75\x21\x43\x60\xf5\x31\x62\xba\x99\xcb\xd3\x53\x77\x89\x9c\x4c\x1c\x41\x59\xa2\xbe\x6d\x8a\x92\xdb\xc3\x02\x09\xf2\x5c\xe4\x29\x52\x77\x78\xcd\x6e\xbe\x42\xc6\x09\x60\xd4\x04\x06\xdc\xaa\xdb\xfd\x25\xdf\xc8\x5d\x77\xd9\x57\xdd\x58\x29\x5c\x75\x35\x03\x76\xdd\x09\xcd\x41\x24\x17\x6e\xc0\x7d\x19\x75\x8c\x91\xea\x27\xbf\xf2\xfe\x2c\xb0\x2d\x83\x02\xbd\x61\xf0\x1c\xb4\xaa\xcf\x7d\x31\x50\x7f\xd5\xbb\xfd\x91\xd9\xc5\xfd\xb1\xde\xed\xa9\x9a\x8e\xa5\x32\x61\xc5\x69\xec\x7b\xf3\xb8\xcf\x2b\x2b\x1e\x5e\x7c\x12\x79\x71\xb6\x43\xab\x77\x0d\xa3\xe3\x07\x95\x9c\x17\x25\xee\xbf\x28\x09\xcb\xcf\xea\xb1\x76\x3a\xaf\x95\x4e\x60\xa4\x6c\x74\x22\x45\x35\x72\x9a\xd8\x8c\x3e\xd8\xa0\xa0\xbd\x16\x5d\xe9\x4d\x0c\x54\x45\x9f\xb1\xb6\xa9\x63\x59\xd1\x51\x57\xf4\xe3\x2d\xd4\xaf\xee\xf6\xce\x61\xc8\x3e\x7a\x4a\x12\xd8\x96\x8c\xe5\xa9\xe2\x4b\xa6\xe2\x8f\xda\xf3\x2f\x6f\xbc\x72\x57\xc7\x4a\xb0\xe9\xec\x36\x5a\xa5\xdb\x98\x34\x37\xbf\x43\xb9\x44\xdc\x39\x7e\xd2\x35\x35\x71\x83\x68\xc3\x5e\xbf\xf0\x7a\xb3\xf5\xef\x1c\x30\x46\x73\x89\x4c\xeb\x8c\xcc\x73\xc4\xe1\xb9\x2f\xa3\xf6\x3c\xe8\x77\x5b\xda\x98\x9e\x38\x0a\xf5\xda\x57\xf5\xa6\xae\x50\x86\x66\xf0\x27\xe5\xd4\x08\x77\xb5\xcf\xab\xf9\x4c\x81\xc0\x36\xdc\x80\x23\x7a\xc0\xbd\x0e\xdb\xdc\xfc\x79\xda\x99\x0f\xdb\xdc\xfe\xba\xa7\x40\xa0\x0b\x87\xe7\xe6\xf2\x94\x9b\xaf\xbb\xc8\x47\xe7\xb8\x87\xcc\xc3\x06\x5e\xd8\x0c\x9b\x3b\x21\x8e\xd6\xba\x10\xdb\xf3\x2f\x75\x67\x1a\x2f\xe7\x6e\x51\x4b\xbd\x8f\x34\xb8\xbb\xd7\x1a\x5c\xa3\xe3\x07\x32\x91\x60\x10\x87\x67\x57\x7b\x4e\x6d\xe6\x00\x19\xa3\x44\x21\x9e\x3a\xda\x0e\xea\x6f\xb8\x21\xa6\x2c\x25\x69\x39\x91\x8a\xe1\x94\x9e\xb9\x8c\x9c\x3a\x96\xf8\x46\xaf\x24\x9a\x63\x75\xe9\xca\x6f\xe0\xe2\xd8\xf3\x78\x60\xd2\x6b\x1b\x32\x10\x3f\x33\x72\x14\xe2\xd2\x65\x9a\xa4\xd2\xa7\x1a\xe2\xcc\x19\x53\xab\xbd\x97\x9b\x70\x83\x64\x6e\x74\xd8\xf5\x04\x63\xaa\xd7\x76\xa9\x2a\x30\xd4\x59\x49\x5b\x22\x18\xcb\xce\xfe\xda\x97\x5a\xa5\xab\x71\xc4\x09\x38\xec\xfa\xdb\x3c\x0a\xbb\x42\x36\xea\x8e\xff\x9b\x0d\xf7\x69\x77\x89\x3c\xd6\x6f\x8d\xb8\x61\x97\x38\x1a\x87\xab\x7b\x90\xe7\x2a\x3f\x7f\x7a\x6e\x2b\xd4\xb0\xe4\x08\x0a\xb8\x1d\xdb\x7c\x0e\xd8\x85\x63\xca\xa5\x63\xa9\x0b\x91\x5f\xd9\xa1\xc1\x2e\x75\xff\x36\xdf\x02\xb6\xa9\x37\x54\x2f\x60\xd7\xba\xa9\x7c\xac\x80\x7c\x3d\x4f\xcd\xb1\x64\xca\xb6\xfa\xd4\xc8\xec\x66\x88\xe9\x36\xe1\xfc\xed\x9e\xce\x18\xd3\xd1\xb8\x33\x58\xad\x7d\x08\x4c\x3a\x41\x1d\x9c\x23\xa1\xd2\x6d\x37\x1b\x8d\xb9\x01\x8f\x49\x7f\x8d\x1a\x5b\x4a\x62\xd9\x66\x93\x72\x4c\x95\xf7\xc6\x34\x41\xe6\x2b\x05\xb4\x15\xea\x17\xa9\x13\x18\x22\x8c\xb8\x0d\xb2\xd3\x84\x0d\x15\xbb\xa6\x4c\xb9\x7c\x6b\xf5\xf6\x84\xee\x1f\xd8\x83\x12\x0f\x06\x3d\x39\x73\x4c\x63\x2e\xb6\x87\xf3\xe7\xb2\x55\x3a\x66\x1d\xc7\x12\x91\xb7\x07\x7f\x63\x54\x63\xb7\xee\xfb\x2f\x01\x37\x4e\x22\x13\xbf\xec\xaa\xe5\x8f\x5f\xfe\xfa\xe5\xff\x02\x00\x00\xff\xff\xa9\x6a\xdd\x57\xec\x48\x00\x00")
 
 func envDevelopmentJsonBytes() ([]byte, error) {
 	return bindataRead(
diff --git a/pkg/deploy/deploy_rp.go b/pkg/deploy/deploy_rp.go
index 84d7c54d4..3bcf54759 100644
--- a/pkg/deploy/deploy_rp.go
+++ b/pkg/deploy/deploy_rp.go
@@ -61,11 +61,23 @@ func (d *deployer) DeployRP(ctx context.Context) error {
 	parameters.Parameters["keyvaultDNSSuffix"] = &arm.ParametersParameter{
 		Value: d.env.Environment().KeyVaultDNSSuffix,
 	}
+
 	parameters.Parameters["fpServicePrincipalId"] = &arm.ParametersParameter{
 		Value: *d.config.Configuration.FPServicePrincipalID,
 	}
+
+	// Cloud name is used by az cli.
+	// Therfore must translate cloud names, only Public and USGov needed
+	// https://github.com/Azure/go-autorest/issues/624
+	cloudName := d.env.Environment().Name // Default, we'll translate only those we need
+	switch cloudName {
+	case azure.PublicCloud.Name:
+		cloudName = "AzureCloud"
+	case azure.USGovernmentCloud.Name:
+		cloudName = "AzureUSGovernment"
+	}
 	parameters.Parameters["azureCloudName"] = &arm.ParametersParameter{
-		Value: d.env.Environment().ActualCloudName,
+		Value: cloudName,
 	}
 
 	for i := 0; i < 2; i++ {
diff --git a/pkg/deploy/generator/resources_dev.go b/pkg/deploy/generator/resources_dev.go
index 7e4370c75..b2240b242 100644
--- a/pkg/deploy/generator/resources_dev.go
+++ b/pkg/deploy/generator/resources_dev.go
@@ -318,13 +318,13 @@ enabled=yes
 gpgcheck=yes
 EOF
 
-yum --enablerepo=rhui-rhel-7-server-rhui-optional-rpms -y install azure-cli docker jq gcc rh-git29 rh-python36 tmpwatch
+yum --enablerepo=rhui-rhel-7-server-rhui-optional-rpms -y install azure-cli docker jq gcc rh-git29 rh-python36 tmpwatch lttng-usr
 
 GO_VERSION=1.14.9
 curl https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz | tar -C /usr/local -xz
 ln -s /usr/local/go/bin/* /usr/local/bin
 
-VSTS_AGENT_VERSION=2.188.3
+VSTS_AGENT_VERSION=2.181.1
 mkdir /home/cloud-user/agent
 pushd /home/cloud-user/agent
 curl https://vstsagentpackage.azureedge.net/agent/${VSTS_AGENT_VERSION}/vsts-agent-linux-x64-${VSTS_AGENT_VERSION}.tar.gz | tar -xz
diff --git a/pkg/deploy/upgrade.go b/pkg/deploy/upgrade.go
index 169faa7ad..415b62152 100644
--- a/pkg/deploy/upgrade.go
+++ b/pkg/deploy/upgrade.go
@@ -37,7 +37,7 @@ func (d *deployer) SaveVersion(ctx context.Context) error {
 	}
 
 	blobClient := azstorage.NewAccountSASClient(
-		*d.config.Configuration.RPVersionStorageAccountName, v, (*d.env.Environment()).Environment).GetBlobService()
+		*d.config.Configuration.RPVersionStorageAccountName, v, *d.env.Environment()).GetBlobService()
 
 	containerRef := blobClient.GetContainerReference("rpversion")
 
diff --git a/pkg/env/core.go b/pkg/env/core.go
index 46bed2886..bf5ec4163 100644
--- a/pkg/env/core.go
+++ b/pkg/env/core.go
@@ -5,8 +5,10 @@ package env
 
 import (
 	"context"
+	"errors"
 
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/sirupsen/logrus"
 
 	"github.com/Azure/ARO-RP/pkg/util/instancemetadata"
@@ -42,6 +44,10 @@ func NewCore(ctx context.Context, log *logrus.Entry) (Core, error) {
 		return nil, err
 	}
 
+	err = validateCloudEnvironment(im.Environment().Name)
+	if err != nil {
+		return nil, err
+	}
 	log.Infof("InstanceMetadata: running on %s", im.Environment().Name)
 
 	return &core{
@@ -67,8 +73,22 @@ func NewCoreForCI(ctx context.Context, log *logrus.Entry) (Core, error) {
 		return nil, err
 	}
 
+	err = validateCloudEnvironment(im.Environment().Name)
+	if err != nil {
+		return nil, err
+	}
+
 	return &core{
 		InstanceMetadata:       im,
 		isLocalDevelopmentMode: isLocalDevelopmentMode,
 	}, nil
 }
+
+func validateCloudEnvironment(name string) error {
+	switch name {
+	case azure.PublicCloud.Name, azure.USGovernmentCloud.Name:
+		return nil
+	default:
+		return errors.New("unsupported Azure cloud environment")
+	}
+}
diff --git a/pkg/env/prod.go b/pkg/env/prod.go
index 4f32df29a..e29f09764 100644
--- a/pkg/env/prod.go
+++ b/pkg/env/prod.go
@@ -18,7 +18,6 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/Azure/ARO-RP/pkg/proxy"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/compute"
 	"github.com/Azure/ARO-RP/pkg/util/clientauthorizer"
 	"github.com/Azure/ARO-RP/pkg/util/keyvault"
@@ -168,7 +167,7 @@ func newProd(ctx context.Context, log *logrus.Entry) (*prod, error) {
 		}
 		p.acrDomain = acrResource.ResourceName + "." + p.Environment().ContainerRegistryDNSSuffix
 	} else {
-		p.acrDomain = "arointsvc" + "." + azureclient.PublicCloud.ContainerRegistryDNSSuffix // TODO: make cloud aware once this is set up for US Gov Cloud
+		p.acrDomain = "arointsvc" + "." + azure.PublicCloud.ContainerRegistryDNSSuffix // TODO: make cloud aware once this is set up for US Gov Cloud
 	}
 
 	p.ARMHelper, err = newARMHelper(ctx, log, p)
@@ -232,13 +231,7 @@ func (p *prod) AROOperatorImage() string {
 func (p *prod) populateZones(ctx context.Context, rpAuthorizer autorest.Authorizer) error {
 	c := compute.NewResourceSkusClient(p.Environment(), p.SubscriptionID(), rpAuthorizer)
 
-	// Filtering is poorly documented, but currently (API version 2019-04-01)
-	// it seems that the API returns all SKUs without a filter and with invalid
-	// value in the filter.
-	// Filtering gives significant optimisation: at the moment of writing,
-	// we get ~1.2M response in eastus vs ~37M unfiltered (467 items vs 16618).
-	filter := fmt.Sprintf("location eq '%s'", p.Location())
-	skus, err := c.List(ctx, filter)
+	skus, err := c.List(ctx, "")
 	if err != nil {
 		return err
 	}
diff --git a/pkg/frontend/adminactions/vmserialconsole.go b/pkg/frontend/adminactions/vmserialconsole.go
index 70aab9f46..f322c2dce 100644
--- a/pkg/frontend/adminactions/vmserialconsole.go
+++ b/pkg/frontend/adminactions/vmserialconsole.go
@@ -64,7 +64,7 @@ func (a *azureActions) VMSerialConsole(ctx context.Context, w http.ResponseWrite
 	}
 
 	blobService := azstorage.NewAccountSASClient(
-		"cluster"+a.oc.Properties.StorageSuffix, v, (*a.env.Environment()).Environment).GetBlobService()
+		"cluster"+a.oc.Properties.StorageSuffix, v, *a.env.Environment()).GetBlobService()
 
 	c := blobService.GetContainerReference(parts[1])
 
diff --git a/pkg/operator/controllers/azurensg/azurensg_controller.go b/pkg/operator/controllers/azurensg/azurensg_controller.go
index c0982f656..dbf5b7795 100644
--- a/pkg/operator/controllers/azurensg/azurensg_controller.go
+++ b/pkg/operator/controllers/azurensg/azurensg_controller.go
@@ -25,7 +25,6 @@ import (
 	aroclient "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers"
 	"github.com/Azure/ARO-RP/pkg/util/aad"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/network"
 	"github.com/Azure/ARO-RP/pkg/util/clusterauthorizer"
 )
@@ -61,7 +60,7 @@ func (r *AzureNSGReconciler) Reconcile(ctx context.Context, request ctrl.Request
 	}
 
 	// Get endpoints from operator
-	azEnv, err := azureclient.EnvironmentFromName(instance.Spec.AZEnvironment)
+	azEnv, err := azure.EnvironmentFromName(instance.Spec.AZEnvironment)
 	if err != nil {
 		return reconcile.Result{}, err
 	}
diff --git a/pkg/operator/controllers/checker/serviceprincipalchecker.go b/pkg/operator/controllers/checker/serviceprincipalchecker.go
index fd031180c..9612d269d 100644
--- a/pkg/operator/controllers/checker/serviceprincipalchecker.go
+++ b/pkg/operator/controllers/checker/serviceprincipalchecker.go
@@ -20,7 +20,6 @@ import (
 	aroclient "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers"
 	"github.com/Azure/ARO-RP/pkg/util/aad"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/clusterauthorizer"
 )
 
@@ -64,7 +63,7 @@ func (r *ServicePrincipalChecker) Check(ctx context.Context) error {
 		return err
 	}
 
-	azEnv, err := azureclient.EnvironmentFromName(cluster.Spec.AZEnvironment)
+	azEnv, err := azure.EnvironmentFromName(cluster.Spec.AZEnvironment)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/operator/controllers/monitoring/monitoring_controller.go b/pkg/operator/controllers/monitoring/monitoring_controller.go
index 50acbf788..c2d6bd84a 100644
--- a/pkg/operator/controllers/monitoring/monitoring_controller.go
+++ b/pkg/operator/controllers/monitoring/monitoring_controller.go
@@ -5,7 +5,7 @@ package monitoring
 
 import (
 	"context"
-	"encoding/json"
+	"reflect"
 
 	"github.com/ghodss/yaml"
 	"github.com/sirupsen/logrus"
@@ -29,10 +29,7 @@ import (
 	"github.com/Azure/ARO-RP/pkg/operator/controllers"
 )
 
-var (
-	monitoringName   = types.NamespacedName{Name: "cluster-monitoring-config", Namespace: "openshift-monitoring"}
-	prometheusLabels = "app=prometheus,prometheus=k8s"
-)
+var monitoringName = types.NamespacedName{Name: "cluster-monitoring-config", Namespace: "openshift-monitoring"}
 
 // Config represents cluster monitoring stack configuration.
 // Reconciler reconciles retention and storage settings,
@@ -41,15 +38,21 @@ type Config struct {
 	api.MissingFields
 	PrometheusK8s struct {
 		api.MissingFields
-		Retention           string           `json:"retention,omitempty"`
-		VolumeClaimTemplate *json.RawMessage `json:"volumeClaimTemplate,omitempty"`
+		Retention           string `json:"retention,omitempty"`
+		VolumeClaimTemplate struct {
+			api.MissingFields
+		} `json:"volumeClaimTemplate,omitempty"`
 	} `json:"prometheusK8s,omitempty"`
 	AlertManagerMain struct {
 		api.MissingFields
-		VolumeClaimTemplate *json.RawMessage `json:"volumeClaimTemplate,omitempty"`
+		VolumeClaimTemplate struct {
+			api.MissingFields
+		} `json:"volumeClaimTemplate,omitempty"`
 	} `json:"alertmanagerMain,omitempty"`
 }
 
+var defaultConfig = `prometheusK8s: {}`
+
 type Reconciler struct {
 	arocli        aroclient.Interface
 	kubernetescli kubernetes.Interface
@@ -67,39 +70,10 @@ func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, arocli
 }
 
 func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
-	for _, f := range []func(context.Context, ctrl.Request) (ctrl.Result, error){
-		r.reconcileConfiguration,
-		r.reconcilePVC, // TODO(mj): This should be removed once we don't have PVC anymore
-	} {
-		result, err := f(ctx, request)
-		if err != nil {
-			return result, err
-		}
-	}
-	return reconcile.Result{}, nil
-}
-
-func (r *Reconciler) reconcilePVC(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
-	pvcList, err := r.kubernetescli.CoreV1().PersistentVolumeClaims(monitoringName.Namespace).List(ctx, metav1.ListOptions{LabelSelector: prometheusLabels})
-	if err != nil {
-		return reconcile.Result{}, err
-	}
-
-	for _, pvc := range pvcList.Items {
-		err = r.kubernetescli.CoreV1().PersistentVolumeClaims(monitoringName.Namespace).Delete(ctx, pvc.Name, metav1.DeleteOptions{})
-		if err != nil {
-			return reconcile.Result{}, err
-		}
-	}
-	return reconcile.Result{}, nil
-}
-
-func (r *Reconciler) reconcileConfiguration(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
 	cm, isCreate, err := r.monitoringConfigMap(ctx)
 	if err != nil {
 		return reconcile.Result{}, err
 	}
-
 	if cm.Data == nil {
 		cm.Data = map[string]string{}
 	}
@@ -116,20 +90,19 @@ func (r *Reconciler) reconcileConfiguration(ctx context.Context, request ctrl.Re
 	}
 
 	changed := false
-
-	// Nil out the fields we don't want set
-	if configData.AlertManagerMain.VolumeClaimTemplate != nil {
-		configData.AlertManagerMain.VolumeClaimTemplate = nil
-		changed = true
-	}
-
+	// we are disabling persistence. We use omitempty on the struct to
+	// clean the fields
 	if configData.PrometheusK8s.Retention != "" {
 		configData.PrometheusK8s.Retention = ""
 		changed = true
 	}
+	if !reflect.DeepEqual(configData.PrometheusK8s.VolumeClaimTemplate, struct{ api.MissingFields }{}) {
+		configData.PrometheusK8s.VolumeClaimTemplate = struct{ api.MissingFields }{}
+		changed = true
+	}
 
-	if configData.PrometheusK8s.VolumeClaimTemplate != nil {
-		configData.PrometheusK8s.VolumeClaimTemplate = nil
+	if !reflect.DeepEqual(configData.AlertManagerMain.VolumeClaimTemplate, struct{ api.MissingFields }{}) {
+		configData.AlertManagerMain.VolumeClaimTemplate = struct{ api.MissingFields }{}
 		changed = true
 	}
 
@@ -167,7 +140,9 @@ func (r *Reconciler) monitoringConfigMap(ctx context.Context) (*corev1.ConfigMap
 				Name:      monitoringName.Name,
 				Namespace: monitoringName.Namespace,
 			},
-			Data: nil,
+			Data: map[string]string{
+				"config.yaml": defaultConfig,
+			},
 		}, true, nil
 	}
 	if err != nil {
diff --git a/pkg/operator/controllers/routefix/routefix_controller.go b/pkg/operator/controllers/routefix/routefix_controller.go
index 2221b6561..1a28ff11f 100644
--- a/pkg/operator/controllers/routefix/routefix_controller.go
+++ b/pkg/operator/controllers/routefix/routefix_controller.go
@@ -7,12 +7,10 @@ import (
 	"context"
 
 	securityv1 "github.com/openshift/api/security/v1"
-	configclient "github.com/openshift/client-go/config/clientset/versioned"
 	securityclient "github.com/openshift/client-go/security/clientset/versioned"
 	"github.com/sirupsen/logrus"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
@@ -26,32 +24,25 @@ import (
 	aroclient "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
-	"github.com/Azure/ARO-RP/pkg/util/version"
 )
 
 //RouteFixReconciler is the controller struct
 type RouteFixReconciler struct {
 	kubernetescli kubernetes.Interface
 	securitycli   securityclient.Interface
-	configcli     configclient.Interface
 	arocli        aroclient.Interface
 	restConfig    *rest.Config
 	log           *logrus.Entry
-	verFixed      *version.Version
 }
 
 //NewReconciler creates a new Reconciler
-func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, securitycli securityclient.Interface, configcli configclient.Interface, arocli aroclient.Interface, restConfig *rest.Config) *RouteFixReconciler {
-	verFixed, _ := version.ParseVersion("4.7.15")
-
+func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, securitycli securityclient.Interface, arocli aroclient.Interface, restConfig *rest.Config) *RouteFixReconciler {
 	return &RouteFixReconciler{
 		securitycli:   securitycli,
 		kubernetescli: kubernetescli,
-		configcli:     configcli,
 		arocli:        arocli,
 		restConfig:    restConfig,
 		log:           log,
-		verFixed:      verFixed,
 	}
 }
 
@@ -63,22 +54,6 @@ func (r *RouteFixReconciler) Reconcile(ctx context.Context, request ctrl.Request
 		return reconcile.Result{}, err
 	}
 
-	// cluster version is not set to final until upgrade is completed. We need to
-	// detect if desired version is with the fix, so we can prevent stuck upgrade
-	// by deleting fix resources
-	clusterVersion, err := version.GetClusterDesiredVersion(ctx, r.configcli)
-	if err != nil {
-		r.log.Errorf("error getting the OpenShift desired version: %v", err)
-		return reconcile.Result{}, err
-	}
-
-	if r.isRequired(clusterVersion) {
-		return r.deploy(ctx, instance)
-	}
-	return r.remove(ctx, instance)
-}
-
-func (r *RouteFixReconciler) deploy(ctx context.Context, instance *arov1alpha1.Cluster) (ctrl.Result, error) {
 	// TODO: dh should be a field in r, but the fact that it is initialised here
 	// each time currently saves us in the case that the controller runs before
 	// the SCC API is registered.
@@ -115,19 +90,6 @@ func (r *RouteFixReconciler) deploy(ctx context.Context, instance *arov1alpha1.C
 	return reconcile.Result{}, nil
 }
 
-func (r *RouteFixReconciler) remove(ctx context.Context, instance *arov1alpha1.Cluster) (ctrl.Result, error) {
-	err := r.kubernetescli.CoreV1().Namespaces().Delete(ctx, kubeNamespace, metav1.DeleteOptions{})
-	if !kerrors.IsNotFound(err) {
-		return reconcile.Result{}, err
-	}
-	err = r.kubernetescli.RbacV1().ClusterRoleBindings().Delete(ctx, kubeName, metav1.DeleteOptions{})
-	if kerrors.IsNotFound(err) {
-		return reconcile.Result{}, nil
-	}
-
-	return reconcile.Result{}, err
-}
-
 //SetupWithManager creates the controller
 func (r *RouteFixReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	aroClusterPredicate := predicate.NewPredicateFuncs(func(o client.Object) bool {
@@ -142,7 +104,3 @@ func (r *RouteFixReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Named(controllers.RouteFixControllerName).
 		Complete(r)
 }
-
-func (r *RouteFixReconciler) isRequired(clusterVersion *version.Version) bool {
-	return clusterVersion.Lt(r.verFixed)
-}
diff --git a/pkg/operator/controllers/workaround/cleanprompvc.go b/pkg/operator/controllers/workaround/cleanprompvc.go
new file mode 100644
index 000000000..747f966d3
--- /dev/null
+++ b/pkg/operator/controllers/workaround/cleanprompvc.go
@@ -0,0 +1,100 @@
+package workaround
+
+// Copyright (c) Microsoft Corporation.
+// Licensed under the Apache License 2.0.
+
+// Clean the remaining PVCs in openshift-monitoring namespace.
+// These PVCs with labels: app=prometheus,prometheus=k8s are left
+// behind after switching back to use emptydir as persistent storage
+// for prometheus by disabling featureflag in monitoing controller.
+// This workaround is in effect for all clusters set to
+// have non-persistent prometheus.
+// The cleanup loop removes only up to 2 PVCs as this is the
+// production configuration at the time of the workaround release.
+
+import (
+	"context"
+	"reflect"
+
+	"github.com/ghodss/yaml"
+	"github.com/sirupsen/logrus"
+	"github.com/ugorji/go/codec"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/util/retry"
+
+	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator/controllers/monitoring"
+	"github.com/Azure/ARO-RP/pkg/util/version"
+)
+
+const (
+	prometheusLabels    = "app=prometheus,prometheus=k8s"
+	monitoringName      = "cluster-monitoring-config"
+	monitoringNamespace = "openshift-monitoring"
+)
+
+type cleanPromPVC struct {
+	log *logrus.Entry
+	cli kubernetes.Interface
+}
+
+func NewCleanFromPVCWorkaround(log *logrus.Entry, cli kubernetes.Interface) Workaround {
+	return &cleanPromPVC{
+		log: log,
+		cli: cli,
+	}
+}
+
+func (*cleanPromPVC) Name() string {
+	return "Clean prometheus PVC after disabling persistency"
+}
+
+func (c *cleanPromPVC) IsRequired(clusterVersion *version.Version) bool {
+	cm, err := c.cli.CoreV1().ConfigMaps(monitoringNamespace).Get(context.Background(), monitoringName, metav1.GetOptions{})
+	if err != nil {
+		return false
+	}
+
+	configDataJSON, err := yaml.YAMLToJSON([]byte(cm.Data["config.yaml"]))
+	if err != nil {
+		return false
+	}
+	var configData monitoring.Config
+	handle := new(codec.JsonHandle)
+	err = codec.NewDecoderBytes(configDataJSON, handle).Decode(&configData)
+	if err != nil {
+		return false
+	}
+
+	if configData.PrometheusK8s.Retention == "" && reflect.DeepEqual(configData.PrometheusK8s.VolumeClaimTemplate, struct{ api.MissingFields }{}) {
+		return true
+	}
+
+	return false
+}
+
+func (c *cleanPromPVC) Ensure(ctx context.Context) error {
+
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		pvcList, err := c.cli.CoreV1().PersistentVolumeClaims(monitoringNamespace).List(ctx, metav1.ListOptions{LabelSelector: prometheusLabels})
+		if err != nil {
+			return err
+		}
+
+		for _, pvc := range pvcList.Items {
+			err = c.cli.CoreV1().PersistentVolumeClaims(monitoringNamespace).Delete(ctx, pvc.Name, metav1.DeleteOptions{})
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+
+	return err
+}
+
+func (c *cleanPromPVC) Remove(ctx context.Context) error {
+	return nil
+}
diff --git a/pkg/operator/controllers/workaround/workaround_controller.go b/pkg/operator/controllers/workaround/workaround_controller.go
index b009f0472..1e80c0108 100644
--- a/pkg/operator/controllers/workaround/workaround_controller.go
+++ b/pkg/operator/controllers/workaround/workaround_controller.go
@@ -44,7 +44,7 @@ func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, config
 		configcli:     configcli,
 		arocli:        arocli,
 		restConfig:    restConfig,
-		workarounds:   []Workaround{NewSystemReserved(log, mcocli, dh), NewIfReload(log, kubernetescli)},
+		workarounds:   []Workaround{NewSystemReserved(log, mcocli, dh), NewIfReload(log, kubernetescli), NewCleanFromPVCWorkaround(log, kubernetescli)},
 		log:           log,
 	}
 }
diff --git a/pkg/operator/deploy/deploy.go b/pkg/operator/deploy/deploy.go
index ba356c354..1b01314c8 100644
--- a/pkg/operator/deploy/deploy.go
+++ b/pkg/operator/deploy/deploy.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/sirupsen/logrus"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -128,6 +129,16 @@ func (o *operator) resources() ([]runtime.Object, error) {
 		return nil, err
 	}
 
+	var monitoringEndpoint string
+	switch o.env.Environment().Name {
+	case azure.PublicCloud.Name:
+		monitoringEndpoint = "https://gcs.prod.monitoring.core.windows.net/"
+	case azure.USGovernmentCloud.Name:
+		monitoringEndpoint = "https://gcs.monitoring.core.usgovcloudapi.net/"
+	default:
+		return nil, fmt.Errorf("unsupported cloud environment")
+	}
+
 	vnetID, _, err := subnet.Split(o.oc.Properties.MasterProfile.SubnetID)
 	if err != nil {
 		return nil, err
@@ -174,7 +185,7 @@ func (o *operator) resources() ([]runtime.Object, error) {
 						fmt.Sprintf("https://%s/", o.env.ACRDomain()),
 						o.env.Environment().ActiveDirectoryEndpoint,
 						o.env.Environment().ResourceManagerEndpoint,
-						o.env.Environment().GenevaMonitoringEndpoint,
+						monitoringEndpoint,
 					},
 				},
 				APIIntIP:  o.oc.Properties.APIServerProfile.IntIP,
diff --git a/pkg/util/azureclient/environments.go b/pkg/util/azureclient/environments.go
deleted file mode 100644
index 23f8c036e..000000000
--- a/pkg/util/azureclient/environments.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package azureclient
-
-// Copyright (c) Microsoft Corporation.
-// Licensed under the Apache License 2.0.
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/Azure/go-autorest/autorest/azure"
-)
-
-// AROEnvironment contains additional, cloud-specific information needed by ARO.
-type AROEnvironment struct {
-	azure.Environment
-	ActualCloudName          string
-	GenevaMonitoringEndpoint string
-	AppSuffix                string
-}
-
-var (
-	// PublicCloud contains additional ARO information for the public Azure cloud environment.
-	PublicCloud = AROEnvironment{
-		Environment:              azure.PublicCloud,
-		ActualCloudName:          "AzureCloud",
-		GenevaMonitoringEndpoint: "https://gcs.prod.monitoring.core.windows.net/",
-		AppSuffix:                "aro.azure.com",
-	}
-
-	// USGovernmentCloud contains additional ARO information for the US Gov cloud environment.
-	USGovernmentCloud = AROEnvironment{
-		Environment:              azure.USGovernmentCloud,
-		ActualCloudName:          "AzureUSGovernment",
-		GenevaMonitoringEndpoint: "https://gcs.monitoring.core.usgovcloudapi.net/",
-		AppSuffix:                "aro.azure.us",
-	}
-)
-
-// EnvironmentFromName returns the AROEnvironment corresponding to the common name specified.
-func EnvironmentFromName(name string) (AROEnvironment, error) {
-	switch strings.ToUpper(name) {
-	case "AZUREPUBLICCLOUD":
-		return PublicCloud, nil
-	case "AZUREUSGOVERNMENTCLOUD":
-		return USGovernmentCloud, nil
-	}
-	return AROEnvironment{}, fmt.Errorf("cloud environment %q is unsupported by ARO", name)
-}
diff --git a/pkg/util/azureclient/graphrbac/applications.go b/pkg/util/azureclient/graphrbac/applications.go
index 24fb98dfa..335c89ece 100644
--- a/pkg/util/azureclient/graphrbac/applications.go
+++ b/pkg/util/azureclient/graphrbac/applications.go
@@ -8,8 +8,7 @@ import (
 
 	azgraphrbac "github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ApplicationsClient is a minimal interface for azure ApplicationsClient
@@ -27,7 +26,7 @@ type applicationsClient struct {
 var _ ApplicationsClient = &applicationsClient{}
 
 // NewApplicationsClient creates a new ApplicationsClient
-func NewApplicationsClient(environment *azureclient.AROEnvironment, tenantID string, authorizer autorest.Authorizer) ApplicationsClient {
+func NewApplicationsClient(environment *azure.Environment, tenantID string, authorizer autorest.Authorizer) ApplicationsClient {
 	client := azgraphrbac.NewApplicationsClientWithBaseURI(environment.GraphEndpoint, tenantID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/graphrbac/serviceprincipals.go b/pkg/util/azureclient/graphrbac/serviceprincipals.go
index 268315fde..76e9d79fe 100644
--- a/pkg/util/azureclient/graphrbac/serviceprincipals.go
+++ b/pkg/util/azureclient/graphrbac/serviceprincipals.go
@@ -8,8 +8,7 @@ import (
 
 	azgraphrbac "github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ServicePrincipalClient is a minimal interface for azure ApplicationsClient
@@ -25,7 +24,7 @@ type servicePrincipalClient struct {
 var _ ServicePrincipalClient = &servicePrincipalClient{}
 
 // NewServicePrincipalClient creates a new ServicePrincipalClient
-func NewServicePrincipalClient(environment *azureclient.AROEnvironment, tenantID string, authorizer autorest.Authorizer) ServicePrincipalClient {
+func NewServicePrincipalClient(environment *azure.Environment, tenantID string, authorizer autorest.Authorizer) ServicePrincipalClient {
 	client := azgraphrbac.NewServicePrincipalsClientWithBaseURI(environment.GraphEndpoint, tenantID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/authorization/denyassignment.go b/pkg/util/azureclient/mgmt/authorization/denyassignment.go
index 5e4b8e25f..3ae0460f4 100644
--- a/pkg/util/azureclient/mgmt/authorization/denyassignment.go
+++ b/pkg/util/azureclient/mgmt/authorization/denyassignment.go
@@ -6,8 +6,7 @@ package authorization
 import (
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // DenyAssignmentClient is a minimal interface for azure DenyAssignmentClient
@@ -22,7 +21,7 @@ type denyAssignmentClient struct {
 var _ DenyAssignmentClient = &denyAssignmentClient{}
 
 // NewDenyAssignmentsClient creates a new DenyAssignmentsClient
-func NewDenyAssignmentsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) DenyAssignmentClient {
+func NewDenyAssignmentsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) DenyAssignmentClient {
 	client := mgmtauthorization.NewDenyAssignmentsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/authorization/permissions.go b/pkg/util/azureclient/mgmt/authorization/permissions.go
index 478c59317..4ac84dcd9 100644
--- a/pkg/util/azureclient/mgmt/authorization/permissions.go
+++ b/pkg/util/azureclient/mgmt/authorization/permissions.go
@@ -6,8 +6,7 @@ package authorization
 import (
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // PermissionsClient is a minimal interface for azure PermissionsClient
@@ -22,7 +21,7 @@ type permissionsClient struct {
 var _ PermissionsClient = &permissionsClient{}
 
 // NewPermissionsClient creates a new PermissionsClient
-func NewPermissionsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) PermissionsClient {
+func NewPermissionsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) PermissionsClient {
 	client := mgmtauthorization.NewPermissionsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/authorization/roleassignments.go b/pkg/util/azureclient/mgmt/authorization/roleassignments.go
index daa98cf2c..af5c87658 100644
--- a/pkg/util/azureclient/mgmt/authorization/roleassignments.go
+++ b/pkg/util/azureclient/mgmt/authorization/roleassignments.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // RoleAssignmentsClient is a minimal interface for azure RoleAssignmentsClient
@@ -26,7 +25,7 @@ type roleAssignmentsClient struct {
 var _ RoleAssignmentsClient = &roleAssignmentsClient{}
 
 // NewRoleAssignmentsClient creates a new RoleAssignmentsClient
-func NewRoleAssignmentsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) RoleAssignmentsClient {
+func NewRoleAssignmentsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) RoleAssignmentsClient {
 	client := mgmtauthorization.NewRoleAssignmentsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/authorization/roledefinitions.go b/pkg/util/azureclient/mgmt/authorization/roledefinitions.go
index 29ff633cd..a5483b0cb 100644
--- a/pkg/util/azureclient/mgmt/authorization/roledefinitions.go
+++ b/pkg/util/azureclient/mgmt/authorization/roledefinitions.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // RoleDefinitionsClient is a minimal interface for azure RoleDefinitionsClient
@@ -25,7 +24,7 @@ type roleDefinitionsClient struct {
 var _ RoleDefinitionsClient = &roleDefinitionsClient{}
 
 // NewRoleDefinitionsClient creates a new RoleDefinitionsClient
-func NewRoleDefinitionsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) RoleDefinitionsClient {
+func NewRoleDefinitionsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) RoleDefinitionsClient {
 	client := mgmtauthorization.NewRoleDefinitionsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/compute/disks.go b/pkg/util/azureclient/mgmt/compute/disks.go
index 31f95cab0..f5e26dd4a 100644
--- a/pkg/util/azureclient/mgmt/compute/disks.go
+++ b/pkg/util/azureclient/mgmt/compute/disks.go
@@ -6,8 +6,7 @@ package compute
 import (
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // DisksClient is a minimal interface for azure DisksClient
@@ -22,7 +21,7 @@ type disksClient struct {
 var _ DisksClient = &disksClient{}
 
 // NewDisksClient creates a new DisksClient
-func NewDisksClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) DisksClient {
+func NewDisksClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) DisksClient {
 	client := mgmtcompute.NewDisksClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/compute/resourceskus.go b/pkg/util/azureclient/mgmt/compute/resourceskus.go
index ac0006023..e573fe0a7 100644
--- a/pkg/util/azureclient/mgmt/compute/resourceskus.go
+++ b/pkg/util/azureclient/mgmt/compute/resourceskus.go
@@ -6,8 +6,7 @@ package compute
 import (
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ResourceSkusClient is a minimal interface for azure ResourceSkusClient
@@ -22,7 +21,7 @@ type resourceSkusClient struct {
 var _ ResourceSkusClient = &resourceSkusClient{}
 
 // NewResourceSkusClient creates a new ResourceSkusClient
-func NewResourceSkusClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ResourceSkusClient {
+func NewResourceSkusClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ResourceSkusClient {
 	client := mgmtcompute.NewResourceSkusClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/compute/usage.go b/pkg/util/azureclient/mgmt/compute/usage.go
index a3937d405..0db8643f3 100644
--- a/pkg/util/azureclient/mgmt/compute/usage.go
+++ b/pkg/util/azureclient/mgmt/compute/usage.go
@@ -6,8 +6,7 @@ package compute
 import (
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // UsageClient is a minimal interface for azure UsageClient
@@ -22,7 +21,7 @@ type usageClient struct {
 var _ UsageClient = &usageClient{}
 
 // NewUsageClient creates a new UsageClient
-func NewUsageClient(environment *azureclient.AROEnvironment, tenantID string, authorizer autorest.Authorizer) UsageClient {
+func NewUsageClient(environment *azure.Environment, tenantID string, authorizer autorest.Authorizer) UsageClient {
 	client := mgmtcompute.NewUsageClientWithBaseURI(environment.ResourceManagerEndpoint, tenantID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/compute/virtualmachines.go b/pkg/util/azureclient/mgmt/compute/virtualmachines.go
index 4988cc3d8..b8b389ce6 100644
--- a/pkg/util/azureclient/mgmt/compute/virtualmachines.go
+++ b/pkg/util/azureclient/mgmt/compute/virtualmachines.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // VirtualMachinesClient is a minimal interface for azure VirtualMachinesClient
@@ -25,7 +24,7 @@ type virtualMachinesClient struct {
 var _ VirtualMachinesClient = &virtualMachinesClient{}
 
 // NewVirtualMachinesClient creates a new VirtualMachinesClient
-func NewVirtualMachinesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachinesClient {
+func NewVirtualMachinesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachinesClient {
 	client := mgmtcompute.NewVirtualMachinesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/compute/virtualmachinescalesetvms.go b/pkg/util/azureclient/mgmt/compute/virtualmachinescalesetvms.go
index 3a59e35e2..04c05a84d 100644
--- a/pkg/util/azureclient/mgmt/compute/virtualmachinescalesetvms.go
+++ b/pkg/util/azureclient/mgmt/compute/virtualmachinescalesetvms.go
@@ -9,8 +9,7 @@ import (
 
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // VirtualMachineScaleSetVMsClient is a minimal interface for azure VirtualMachineScaleSetVMsClient
@@ -26,7 +25,7 @@ type virtualMachineScaleSetVMsClient struct {
 var _ VirtualMachineScaleSetVMsClient = &virtualMachineScaleSetVMsClient{}
 
 // NewVirtualMachineScaleSetVMsClient creates a new VirtualMachineScaleSetVMsClient
-func NewVirtualMachineScaleSetVMsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachineScaleSetVMsClient {
+func NewVirtualMachineScaleSetVMsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachineScaleSetVMsClient {
 	client := mgmtcompute.NewVirtualMachineScaleSetVMsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 	client.PollingDuration = time.Hour
diff --git a/pkg/util/azureclient/mgmt/compute/virtualmachinesscalesets.go b/pkg/util/azureclient/mgmt/compute/virtualmachinesscalesets.go
index 31664dd15..b81b767c2 100644
--- a/pkg/util/azureclient/mgmt/compute/virtualmachinesscalesets.go
+++ b/pkg/util/azureclient/mgmt/compute/virtualmachinesscalesets.go
@@ -6,8 +6,7 @@ package compute
 import (
 	mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2020-06-01/compute"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 type VirtualMachineScaleSetsClient interface {
@@ -21,7 +20,7 @@ type virtualMachineScaleSetsClient struct {
 var _ VirtualMachineScaleSetsClient = &virtualMachineScaleSetsClient{}
 
 // NewVirtualMachineScaleSetsClient creates a new VirtualMachineScaleSetsClient
-func NewVirtualMachineScaleSetsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachineScaleSetsClient {
+func NewVirtualMachineScaleSetsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualMachineScaleSetsClient {
 	client := mgmtcompute.NewVirtualMachineScaleSetsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/containerregistry/registries.go b/pkg/util/azureclient/mgmt/containerregistry/registries.go
index 97ac29184..c5397c535 100644
--- a/pkg/util/azureclient/mgmt/containerregistry/registries.go
+++ b/pkg/util/azureclient/mgmt/containerregistry/registries.go
@@ -6,8 +6,7 @@ package containerregistry
 import (
 	mgmtcontainerregistry "github.com/Azure/azure-sdk-for-go/services/preview/containerregistry/mgmt/2020-11-01-preview/containerregistry"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // RegistriesClient is a minimal interface for azure RegistriesClient
@@ -22,7 +21,7 @@ type registriesClient struct {
 var _ RegistriesClient = &registriesClient{}
 
 // NewRegistriesClient creates a new RegistriesClient
-func NewRegistriesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) RegistriesClient {
+func NewRegistriesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) RegistriesClient {
 	client := mgmtcontainerregistry.NewRegistriesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/containerregistry/tokens.go b/pkg/util/azureclient/mgmt/containerregistry/tokens.go
index f340adcd4..ca0dbfc28 100644
--- a/pkg/util/azureclient/mgmt/containerregistry/tokens.go
+++ b/pkg/util/azureclient/mgmt/containerregistry/tokens.go
@@ -6,8 +6,7 @@ package containerregistry
 import (
 	mgmtcontainerregistry "github.com/Azure/azure-sdk-for-go/services/preview/containerregistry/mgmt/2020-11-01-preview/containerregistry"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // TokensClient is a minimal interface for azure TokensClient
@@ -22,7 +21,7 @@ type tokensClient struct {
 var _ TokensClient = &tokensClient{}
 
 // NewTokensClient creates a new TokensClient
-func NewTokensClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) TokensClient {
+func NewTokensClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) TokensClient {
 	client := mgmtcontainerregistry.NewTokensClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/dns/recordsets.go b/pkg/util/azureclient/mgmt/dns/recordsets.go
index e688da2d2..29434f998 100644
--- a/pkg/util/azureclient/mgmt/dns/recordsets.go
+++ b/pkg/util/azureclient/mgmt/dns/recordsets.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtdns "github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2018-05-01/dns"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // RecordSetsClient is a minimal interface for azure RecordSetsClient
@@ -26,7 +25,7 @@ type recordSetsClient struct {
 var _ RecordSetsClient = &recordSetsClient{}
 
 // NewRecordSetsClient creates a new RecordSetsClient
-func NewRecordSetsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) RecordSetsClient {
+func NewRecordSetsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) RecordSetsClient {
 	client := mgmtdns.NewRecordSetsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/dns/zones.go b/pkg/util/azureclient/mgmt/dns/zones.go
index babd9912d..15cee3652 100644
--- a/pkg/util/azureclient/mgmt/dns/zones.go
+++ b/pkg/util/azureclient/mgmt/dns/zones.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtdns "github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2018-05-01/dns"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ZonesClient is a minimal interface for azure ZonesClient
@@ -24,7 +23,7 @@ type zonesClient struct {
 var _ ZonesClient = &zonesClient{}
 
 // NewZonesClient creates a new ZonesClient
-func NewZonesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ZonesClient {
+func NewZonesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ZonesClient {
 	client := mgmtdns.NewZonesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/documentdb/databaseaccounts.go b/pkg/util/azureclient/mgmt/documentdb/databaseaccounts.go
index 984b804dc..3c1d67347 100644
--- a/pkg/util/azureclient/mgmt/documentdb/databaseaccounts.go
+++ b/pkg/util/azureclient/mgmt/documentdb/databaseaccounts.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtdocumentdb "github.com/Azure/azure-sdk-for-go/services/cosmos-db/mgmt/2019-08-01/documentdb"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // DatabaseAccountsClient is a minimal interface for azure DatabaseAccountsClient
@@ -24,7 +23,7 @@ type databaseAccountsClient struct {
 var _ DatabaseAccountsClient = &databaseAccountsClient{}
 
 // NewDatabaseAccountsClient creates a new DatabaseAccountsClient
-func NewDatabaseAccountsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) DatabaseAccountsClient {
+func NewDatabaseAccountsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) DatabaseAccountsClient {
 	client := mgmtdocumentdb.NewDatabaseAccountsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/features/deployments.go b/pkg/util/azureclient/mgmt/features/deployments.go
index 128d21de0..939a1c3af 100644
--- a/pkg/util/azureclient/mgmt/features/deployments.go
+++ b/pkg/util/azureclient/mgmt/features/deployments.go
@@ -9,8 +9,7 @@ import (
 
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // DeploymentsClient is a minimal interface for azure DeploymentsClient
@@ -26,7 +25,7 @@ type deploymentsClient struct {
 var _ DeploymentsClient = &deploymentsClient{}
 
 // NewDeploymentsClient creates a new DeploymentsClient
-func NewDeploymentsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) DeploymentsClient {
+func NewDeploymentsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) DeploymentsClient {
 	client := mgmtfeatures.NewDeploymentsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 	client.PollingDelay = 10 * time.Second
diff --git a/pkg/util/azureclient/mgmt/features/features.go b/pkg/util/azureclient/mgmt/features/features.go
index c0b074a0b..c3617dad3 100644
--- a/pkg/util/azureclient/mgmt/features/features.go
+++ b/pkg/util/azureclient/mgmt/features/features.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2015-12-01/features"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // Client is a minimal interface for azure Client
@@ -25,7 +24,7 @@ type client struct {
 var _ Client = &client{}
 
 // NewClient creates a new Client
-func NewClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) Client {
+func NewClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) Client {
 	_client := mgmtfeatures.NewClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	_client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/features/providers.go b/pkg/util/azureclient/mgmt/features/providers.go
index 016d649ac..825388440 100644
--- a/pkg/util/azureclient/mgmt/features/providers.go
+++ b/pkg/util/azureclient/mgmt/features/providers.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ProvidersClient is a minimal interface for azure ProvidersClient
@@ -25,7 +24,7 @@ type providersClient struct {
 var _ ProvidersClient = &providersClient{}
 
 // NewProvidersClient creates a new ProvidersClient
-func NewProvidersClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ProvidersClient {
+func NewProvidersClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ProvidersClient {
 	client := mgmtfeatures.NewProvidersClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/features/resourcegroups.go b/pkg/util/azureclient/mgmt/features/resourcegroups.go
index a4cc1123d..aa767559e 100644
--- a/pkg/util/azureclient/mgmt/features/resourcegroups.go
+++ b/pkg/util/azureclient/mgmt/features/resourcegroups.go
@@ -9,8 +9,7 @@ import (
 
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ResourceGroupsClient is a minimal interface for azure ResourceGroupsClient
@@ -28,7 +27,7 @@ type resourceGroupsClient struct {
 var _ ResourceGroupsClient = &resourceGroupsClient{}
 
 // NewResourceGroupsClient creates a new ResourceGroupsClient
-func NewResourceGroupsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ResourceGroupsClient {
+func NewResourceGroupsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ResourceGroupsClient {
 	client := mgmtfeatures.NewResourceGroupsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 	client.PollingDelay = 10 * time.Second
diff --git a/pkg/util/azureclient/mgmt/features/resources.go b/pkg/util/azureclient/mgmt/features/resources.go
index b3b3e6210..b10db4092 100644
--- a/pkg/util/azureclient/mgmt/features/resources.go
+++ b/pkg/util/azureclient/mgmt/features/resources.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // ResourcesClient is a minimal interface for azure ResourcesClient
@@ -26,7 +25,7 @@ type resourcesClient struct {
 var _ ResourcesClient = &resourcesClient{}
 
 // NewResourcesClient creates a new ResourcesClient
-func NewResourcesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ResourcesClient {
+func NewResourcesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ResourcesClient {
 	client := mgmtfeatures.NewResourcesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/insights/activitylogs.go b/pkg/util/azureclient/mgmt/insights/activitylogs.go
index d59c3d654..6c07f8888 100644
--- a/pkg/util/azureclient/mgmt/insights/activitylogs.go
+++ b/pkg/util/azureclient/mgmt/insights/activitylogs.go
@@ -5,8 +5,8 @@ package insights
 
 import (
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/insights/insights"
 )
 
@@ -33,7 +33,7 @@ type activityLogsClient struct {
 var _ ActivityLogsClient = &activityLogsClient{}
 
 // NewActivityLogsClient creates a new ActivityLogsClient
-func NewActivityLogsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) ActivityLogsClient {
+func NewActivityLogsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) ActivityLogsClient {
 	client := insights.NewActivityLogsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/msi/userassignedidentities.go b/pkg/util/azureclient/mgmt/msi/userassignedidentities.go
index 2c5eee797..5f9371547 100644
--- a/pkg/util/azureclient/mgmt/msi/userassignedidentities.go
+++ b/pkg/util/azureclient/mgmt/msi/userassignedidentities.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtmsi "github.com/Azure/azure-sdk-for-go/services/msi/mgmt/2018-11-30/msi"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // UserAssignedIdentitiesClient is a minimal interface for azure UserAssignedIdentitiesClient
@@ -24,7 +23,7 @@ type userAssignedIdentitiesClient struct {
 var _ UserAssignedIdentitiesClient = &userAssignedIdentitiesClient{}
 
 // NewUserAssignedIdentitiesClient creates a new UserAssignedIdentitiesClient
-func NewUserAssignedIdentitiesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) UserAssignedIdentitiesClient {
+func NewUserAssignedIdentitiesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) UserAssignedIdentitiesClient {
 	client := mgmtmsi.NewUserAssignedIdentitiesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/interfaces.go b/pkg/util/azureclient/mgmt/network/interfaces.go
index d6c7b0c58..191806d8b 100644
--- a/pkg/util/azureclient/mgmt/network/interfaces.go
+++ b/pkg/util/azureclient/mgmt/network/interfaces.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // InterfacesClient is a minimal interface for azure InterfacesClient
@@ -25,7 +24,7 @@ type interfacesClient struct {
 var _ InterfacesClient = &interfacesClient{}
 
 // NewInterfacesClient creates a new InterfacesClient
-func NewInterfacesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) InterfacesClient {
+func NewInterfacesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) InterfacesClient {
 	client := mgmtnetwork.NewInterfacesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/loadbalancers.go b/pkg/util/azureclient/mgmt/network/loadbalancers.go
index 5e45f22e1..1c18f3983 100644
--- a/pkg/util/azureclient/mgmt/network/loadbalancers.go
+++ b/pkg/util/azureclient/mgmt/network/loadbalancers.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // LoadBalancersClient is a minimal interface for Azure LoadBalancersClient
@@ -25,7 +24,7 @@ type loadBalancersClient struct {
 var _ LoadBalancersClient = &loadBalancersClient{}
 
 // NewLoadBalancersClient creates a new LoadBalancersClient
-func NewLoadBalancersClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) LoadBalancersClient {
+func NewLoadBalancersClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) LoadBalancersClient {
 	client := mgmtnetwork.NewLoadBalancersClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/privateendpoints.go b/pkg/util/azureclient/mgmt/network/privateendpoints.go
index 13d4e26fe..623e0ed92 100644
--- a/pkg/util/azureclient/mgmt/network/privateendpoints.go
+++ b/pkg/util/azureclient/mgmt/network/privateendpoints.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // PrivateEndpointsClient is a minimal interface for azure PrivateEndpointsClient
@@ -25,7 +24,7 @@ type privateEndpointsClient struct {
 var _ PrivateEndpointsClient = &privateEndpointsClient{}
 
 // NewPrivateEndpointsClient creates a new PrivateEndpointsClient
-func NewPrivateEndpointsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) PrivateEndpointsClient {
+func NewPrivateEndpointsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) PrivateEndpointsClient {
 	client := mgmtnetwork.NewPrivateEndpointsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/privatelinkservices.go b/pkg/util/azureclient/mgmt/network/privatelinkservices.go
index de4bd947c..3d6fbef3d 100644
--- a/pkg/util/azureclient/mgmt/network/privatelinkservices.go
+++ b/pkg/util/azureclient/mgmt/network/privatelinkservices.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // PrivateLinkServicesClient is a minimal interface for azure PrivateLinkServicesClient
@@ -25,7 +24,7 @@ type privateLinkServicesClient struct {
 var _ PrivateLinkServicesClient = &privateLinkServicesClient{}
 
 // NewPrivateLinkServicesClient creates a new PrivateLinkServicesClient
-func NewPrivateLinkServicesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) PrivateLinkServicesClient {
+func NewPrivateLinkServicesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) PrivateLinkServicesClient {
 	client := mgmtnetwork.NewPrivateLinkServicesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/publicipaddresses.go b/pkg/util/azureclient/mgmt/network/publicipaddresses.go
index 1a0b9ce2c..804a3c2ba 100644
--- a/pkg/util/azureclient/mgmt/network/publicipaddresses.go
+++ b/pkg/util/azureclient/mgmt/network/publicipaddresses.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // PublicIPAddressesClient is a minimal interface for azure PublicIPAddressesClient
@@ -26,7 +25,7 @@ type publicIPAddressesClient struct {
 var _ PublicIPAddressesClient = &publicIPAddressesClient{}
 
 // NewPublicIPAddressesClient creates a new PublicIPAddressesClient
-func NewPublicIPAddressesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) PublicIPAddressesClient {
+func NewPublicIPAddressesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) PublicIPAddressesClient {
 	client := mgmtnetwork.NewPublicIPAddressesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/routetable.go b/pkg/util/azureclient/mgmt/network/routetable.go
index abcf891e9..c55a7622d 100644
--- a/pkg/util/azureclient/mgmt/network/routetable.go
+++ b/pkg/util/azureclient/mgmt/network/routetable.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // RouteTablesClient is a minimal interface for azure RouteTablesClient
@@ -25,7 +24,7 @@ type routeTablesClient struct {
 var _ RouteTablesClient = &routeTablesClient{}
 
 // NewRouteTablesClient creates a new RouteTablesClient
-func NewRouteTablesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) RouteTablesClient {
+func NewRouteTablesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) RouteTablesClient {
 	client := mgmtnetwork.NewRouteTablesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/securitygroups.go b/pkg/util/azureclient/mgmt/network/securitygroups.go
index 84d96ac92..3736416cc 100644
--- a/pkg/util/azureclient/mgmt/network/securitygroups.go
+++ b/pkg/util/azureclient/mgmt/network/securitygroups.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // SecurityGroupsClient is a minimal interface for azure SecurityGroupsClient
@@ -25,7 +24,7 @@ type securityGroupsClient struct {
 var _ SecurityGroupsClient = &securityGroupsClient{}
 
 // NewSecurityGroupsClient creates a new SecurityGroupsClient
-func NewSecurityGroupsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) SecurityGroupsClient {
+func NewSecurityGroupsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) SecurityGroupsClient {
 	client := mgmtnetwork.NewSecurityGroupsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/subnets.go b/pkg/util/azureclient/mgmt/network/subnets.go
index 52397902d..afb60cc95 100644
--- a/pkg/util/azureclient/mgmt/network/subnets.go
+++ b/pkg/util/azureclient/mgmt/network/subnets.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // SubnetsClient is a minimal interface for azure SubnetsClient
@@ -25,7 +24,7 @@ type subnetsClient struct {
 var _ SubnetsClient = &subnetsClient{}
 
 // NewSubnetsClient creates a new SubnetsClient
-func NewSubnetsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) SubnetsClient {
+func NewSubnetsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) SubnetsClient {
 	client := mgmtnetwork.NewSubnetsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/usage.go b/pkg/util/azureclient/mgmt/network/usage.go
index 4ca845f77..73a932a9a 100644
--- a/pkg/util/azureclient/mgmt/network/usage.go
+++ b/pkg/util/azureclient/mgmt/network/usage.go
@@ -6,8 +6,7 @@ package network
 import (
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // UsageClient is a minimal interface for azure UsageClient
@@ -22,7 +21,7 @@ type usageClient struct {
 var _ UsageClient = &usageClient{}
 
 // NewUsageClient creates a new UsageClient
-func NewUsageClient(environment *azureclient.AROEnvironment, tenantID string, authorizer autorest.Authorizer) UsageClient {
+func NewUsageClient(environment *azure.Environment, tenantID string, authorizer autorest.Authorizer) UsageClient {
 	client := mgmtnetwork.NewUsagesClientWithBaseURI(environment.ResourceManagerEndpoint, tenantID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/virtualnetworkpeerings.go b/pkg/util/azureclient/mgmt/network/virtualnetworkpeerings.go
index d50085b62..1a0279af0 100644
--- a/pkg/util/azureclient/mgmt/network/virtualnetworkpeerings.go
+++ b/pkg/util/azureclient/mgmt/network/virtualnetworkpeerings.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 type VirtualNetworkPeeringsClient interface {
@@ -26,7 +25,7 @@ type virtualNetworkPeeringsClient struct {
 var _ VirtualNetworkPeeringsClient = &virtualNetworkPeeringsClient{}
 
 // NewVirtualNetworkPeeringsClient creates a new VirtualNetworkPeeringsClient
-func NewVirtualNetworkPeeringsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworkPeeringsClient {
+func NewVirtualNetworkPeeringsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworkPeeringsClient {
 	client := mgmtnetwork.NewVirtualNetworkPeeringsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/network/virtualnetworks.go b/pkg/util/azureclient/mgmt/network/virtualnetworks.go
index 3c1a4a680..b3728808e 100644
--- a/pkg/util/azureclient/mgmt/network/virtualnetworks.go
+++ b/pkg/util/azureclient/mgmt/network/virtualnetworks.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2019-07-01/network"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // VirtualNetworksClient is a minimal interface for azure VirtualNetworksClient
@@ -26,7 +25,7 @@ type virtualNetworksClient struct {
 var _ VirtualNetworksClient = &virtualNetworksClient{}
 
 // NewVirtualNetworksClient creates a new VirtualNetworksClient
-func NewVirtualNetworksClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworksClient {
+func NewVirtualNetworksClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworksClient {
 	client := mgmtnetwork.NewVirtualNetworksClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/privatedns/privatezones.go b/pkg/util/azureclient/mgmt/privatedns/privatezones.go
index 8fb2c402f..452c2e7dd 100644
--- a/pkg/util/azureclient/mgmt/privatedns/privatezones.go
+++ b/pkg/util/azureclient/mgmt/privatedns/privatezones.go
@@ -6,8 +6,7 @@ package privatedns
 import (
 	mgmtprivatedns "github.com/Azure/azure-sdk-for-go/services/privatedns/mgmt/2018-09-01/privatedns"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // PrivateZonesClient is a minimal interface for azure PrivateZonesClient
@@ -22,7 +21,7 @@ type privateZonesClient struct {
 var _ PrivateZonesClient = &privateZonesClient{}
 
 // NewPrivateZonesClient creates a new PrivateZonesClient
-func NewPrivateZonesClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) PrivateZonesClient {
+func NewPrivateZonesClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) PrivateZonesClient {
 	client := mgmtprivatedns.NewPrivateZonesClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/privatedns/virtualnetworklinks.go b/pkg/util/azureclient/mgmt/privatedns/virtualnetworklinks.go
index 9872e8460..982c0b324 100644
--- a/pkg/util/azureclient/mgmt/privatedns/virtualnetworklinks.go
+++ b/pkg/util/azureclient/mgmt/privatedns/virtualnetworklinks.go
@@ -6,8 +6,7 @@ package privatedns
 import (
 	mgmtprivatedns "github.com/Azure/azure-sdk-for-go/services/privatedns/mgmt/2018-09-01/privatedns"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // VirtualNetworkLinksClient is a minimal interface for azure VirtualNetworkLinksClient
@@ -22,7 +21,7 @@ type virtualNetworkLinksClient struct {
 var _ VirtualNetworkLinksClient = &virtualNetworkLinksClient{}
 
 // NewVirtualNetworkLinksClient creates a new VirtualNetworkLinksClient
-func NewVirtualNetworkLinksClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworkLinksClient {
+func NewVirtualNetworkLinksClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) VirtualNetworkLinksClient {
 	client := mgmtprivatedns.NewVirtualNetworkLinksClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/openshiftclusters.go b/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/openshiftclusters.go
index 1fe18d47d..65f1e704a 100644
--- a/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/openshiftclusters.go
+++ b/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/openshiftclusters.go
@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 
 	mgmtredhatopenshift20200430 "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2020-04-30/redhatopenshift"
 	"github.com/Azure/ARO-RP/pkg/env"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 // OpenShiftClustersClient is a minimal interface for azure OpenshiftClustersClient
@@ -30,7 +30,7 @@ type openShiftClustersClient struct {
 var _ OpenShiftClustersClient = &openShiftClustersClient{}
 
 // NewOpenShiftClustersClient creates a new OpenShiftClustersClient
-func NewOpenShiftClustersClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) OpenShiftClustersClient {
+func NewOpenShiftClustersClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) OpenShiftClustersClient {
 	var client mgmtredhatopenshift20200430.OpenShiftClustersClient
 	if env.IsLocalDevelopmentMode() {
 		client = mgmtredhatopenshift20200430.NewOpenShiftClustersClientWithBaseURI("https://localhost:8443", subscriptionID)
diff --git a/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/operations.go b/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/operations.go
index a1590761c..22c1fedd8 100644
--- a/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/operations.go
+++ b/pkg/util/azureclient/mgmt/redhatopenshift/2020-04-30/redhatopenshift/operations.go
@@ -8,10 +8,10 @@ import (
 	"net/http"
 
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 
 	mgmtredhatopenshift20200430 "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2020-04-30/redhatopenshift"
 	"github.com/Azure/ARO-RP/pkg/env"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 // OperationsClient is a minimal interface for azure OperationsClient
@@ -26,7 +26,7 @@ type operationsClient struct {
 var _ OperationsClient = &operationsClient{}
 
 // NewOperationsClient creates a new OperationsClient
-func NewOperationsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) OperationsClient {
+func NewOperationsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) OperationsClient {
 	var client mgmtredhatopenshift20200430.OperationsClient
 	if env.IsLocalDevelopmentMode() {
 		client = mgmtredhatopenshift20200430.NewOperationsClientWithBaseURI("https://localhost:8443", subscriptionID)
diff --git a/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/openshiftclusters.go b/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/openshiftclusters.go
index 8db00f578..cdf9cc6d8 100644
--- a/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/openshiftclusters.go
+++ b/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/openshiftclusters.go
@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 
 	mgmtredhatopenshift20210131preview "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift"
 	"github.com/Azure/ARO-RP/pkg/env"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 // OpenShiftClustersClient is a minimal interface for azure OpenshiftClustersClient
@@ -30,7 +30,7 @@ type openShiftClustersClient struct {
 var _ OpenShiftClustersClient = &openShiftClustersClient{}
 
 // NewOpenShiftClustersClient creates a new OpenShiftClustersClient
-func NewOpenShiftClustersClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) OpenShiftClustersClient {
+func NewOpenShiftClustersClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) OpenShiftClustersClient {
 	var client mgmtredhatopenshift20210131preview.OpenShiftClustersClient
 	if env.IsLocalDevelopmentMode() {
 		client = mgmtredhatopenshift20210131preview.NewOpenShiftClustersClientWithBaseURI("https://localhost:8443", subscriptionID)
diff --git a/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/operations.go b/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/operations.go
index cd97601e1..2e8226338 100644
--- a/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/operations.go
+++ b/pkg/util/azureclient/mgmt/redhatopenshift/2021-01-31-preview/redhatopenshift/operations.go
@@ -8,10 +8,10 @@ import (
 	"net/http"
 
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 
 	mgmtredhatopenshift20210131preview "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift"
 	"github.com/Azure/ARO-RP/pkg/env"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 // OperationsClient is a minimal interface for azure OperationsClient
@@ -26,7 +26,7 @@ type operationsClient struct {
 var _ OperationsClient = &operationsClient{}
 
 // NewOperationsClient creates a new OperationsClient
-func NewOperationsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) OperationsClient {
+func NewOperationsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) OperationsClient {
 	var client mgmtredhatopenshift20210131preview.OperationsClient
 	if env.IsLocalDevelopmentMode() {
 		client = mgmtredhatopenshift20210131preview.NewOperationsClientWithBaseURI("https://localhost:8443", subscriptionID)
diff --git a/pkg/util/azureclient/mgmt/storage/accounts.go b/pkg/util/azureclient/mgmt/storage/accounts.go
index cc70d4b2e..2a9803bd2 100644
--- a/pkg/util/azureclient/mgmt/storage/accounts.go
+++ b/pkg/util/azureclient/mgmt/storage/accounts.go
@@ -8,8 +8,7 @@ import (
 
 	mgmtstorage "github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2019-04-01/storage"
 	"github.com/Azure/go-autorest/autorest"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 // AccountsClient is a minimal interface for azure AccountsClient
@@ -26,7 +25,7 @@ type accountsClient struct {
 var _ AccountsClient = &accountsClient{}
 
 // NewAccountsClient returns a new AccountsClient
-func NewAccountsClient(environment *azureclient.AROEnvironment, subscriptionID string, authorizer autorest.Authorizer) AccountsClient {
+func NewAccountsClient(environment *azure.Environment, subscriptionID string, authorizer autorest.Authorizer) AccountsClient {
 	client := mgmtstorage.NewAccountsClientWithBaseURI(environment.ResourceManagerEndpoint, subscriptionID)
 	client.Authorizer = authorizer
 
diff --git a/pkg/util/azureerrors/error.go b/pkg/util/azureerrors/error.go
index 6184e9a19..7b8a2673c 100644
--- a/pkg/util/azureerrors/error.go
+++ b/pkg/util/azureerrors/error.go
@@ -89,20 +89,3 @@ func IsInvalidSecretError(err error) bool {
 func IsUnauthorizedClientError(err error) bool {
 	return strings.Contains(err.Error(), "AADSTS700016")
 }
-
-// ResourceGroupNotFound returns true if the error is an ResourceGroupNotFound error
-func ResourceGroupNotFound(err error) bool {
-	if detailedErr, ok := err.(autorest.DetailedError); ok {
-		if serviceErr, ok := detailedErr.Original.(*azure.ServiceError); ok {
-			if serviceErr.Code == "ResourceGroupNotFound" {
-				return true
-			}
-		}
-		if requestErr, ok := detailedErr.Original.(*azure.RequestError); ok &&
-			requestErr.ServiceError != nil &&
-			requestErr.ServiceError.Code == "ResourceGroupNotFound" {
-			return true
-		}
-	}
-	return false
-}
diff --git a/pkg/util/cluster/aad.go b/pkg/util/cluster/aad.go
index fcc217cb4..b6d0d335a 100644
--- a/pkg/util/cluster/aad.go
+++ b/pkg/util/cluster/aad.go
@@ -38,12 +38,9 @@ func (c *Cluster) getServicePrincipal(ctx context.Context, appID string) (string
 func (c *Cluster) createApplication(ctx context.Context, displayName string) (string, string, error) {
 	password := uuid.Must(uuid.NewV4()).String()
 
-	// example value: https://test.aro.azure.com/11111111-1111-1111-1111-111111111111
-	identifierURI := "https://test." + c.env.Environment().AppSuffix + "/" + uuid.Must(uuid.NewV4()).String()
-
 	app, err := c.applications.Create(ctx, azgraphrbac.ApplicationCreateParameters{
 		DisplayName:    &displayName,
-		IdentifierUris: &[]string{identifierURI},
+		IdentifierUris: &[]string{"https://test.aro.azure.com/" + uuid.Must(uuid.NewV4()).String()},
 		PasswordCredentials: &[]azgraphrbac.PasswordCredential{
 			{
 				EndDate: &date.Time{Time: time.Now().AddDate(1, 0, 0)},
diff --git a/pkg/util/cluster/cluster.go b/pkg/util/cluster/cluster.go
index eb0a5b610..b658f0c76 100644
--- a/pkg/util/cluster/cluster.go
+++ b/pkg/util/cluster/cluster.go
@@ -19,6 +19,7 @@ import (
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/Azure/go-autorest/autorest/to"
 	"github.com/gofrs/uuid"
@@ -44,9 +45,10 @@ import (
 )
 
 type Cluster struct {
-	log *logrus.Entry
-	env env.Core
-	ci  bool
+	log          *logrus.Entry
+	env          env.Core
+	ci           bool
+	ciParentVnet string
 
 	deployments                       features.DeploymentsClient
 	groups                            features.ResourceGroupsClient
@@ -59,6 +61,7 @@ type Cluster struct {
 	routetables                       network.RouteTablesClient
 	roleassignments                   authorization.RoleAssignmentsClient
 	peerings                          network.VirtualNetworkPeeringsClient
+	ciParentVnetPeerings              network.VirtualNetworkPeeringsClient
 }
 
 type errors []error
@@ -113,6 +116,28 @@ func New(log *logrus.Entry, env env.Core, ci bool) (*Cluster, error) {
 		peerings:                          network.NewVirtualNetworkPeeringsClient(env.Environment(), env.SubscriptionID(), authorizer),
 	}
 
+	if ci {
+		if env.IsLocalDevelopmentMode() {
+			c.ciParentVnet = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/dev-vnet", c.env.SubscriptionID(), c.env.ResourceGroup())
+		} else {
+			// This is dirty, but it used to be hard coded only for pub cloud.
+			// TODO pick right config value to get sub and resource group
+			if env.Environment().Name == azure.USGovernmentCloud.Name {
+				c.ciParentVnet = "/subscriptions/28015960-ee66-4844-8037-fc28b0560bf1/resourceGroups/e2einfra-usgovvirginia/providers/Microsoft.Network/virtualNetworks/dev-vnet"
+			} else {
+				// default to prior behavior, public cloud int
+				c.ciParentVnet = "/subscriptions/46626fc5-476d-41ad-8c76-2ec49c6994eb/resourceGroups/e2einfra-eastus/providers/Microsoft.Network/virtualNetworks/dev-vnet"
+			}
+		}
+
+		r, err := azure.ParseResourceID(c.ciParentVnet)
+		if err != nil {
+			return nil, err
+		}
+
+		c.ciParentVnetPeerings = network.NewVirtualNetworkPeeringsClient(env.Environment(), r.SubscriptionID, authorizer)
+	}
+
 	return c, nil
 }
 
@@ -150,6 +175,8 @@ func (c *Cluster) Create(ctx context.Context, vnetResourceGroup, clusterName str
 		if err != nil {
 			return err
 		}
+
+		visibility = api.VisibilityPrivate
 	}
 
 	b, err := deploy.Asset(generator.FileClusterPredeploy)
@@ -248,6 +275,12 @@ func (c *Cluster) Create(ctx context.Context, vnetResourceGroup, clusterName str
 		if err != nil {
 			return err
 		}
+
+		c.log.Info("peering subnets to CI infra")
+		err = c.peerSubnetsToCI(ctx, vnetResourceGroup, clusterName)
+		if err != nil {
+			return err
+		}
 	}
 
 	c.log.Info("done")
@@ -300,6 +333,14 @@ func (c *Cluster) Delete(ctx context.Context, vnetResourceGroup, clusterName str
 			}
 		}
 
+		r, err := azure.ParseResourceID(c.ciParentVnet)
+		if err == nil {
+			err = c.ciParentVnetPeerings.DeleteAndWait(ctx, r.ResourceGroup, r.ResourceName, vnetResourceGroup+"-peer")
+		}
+		if err != nil {
+			errs = append(errs, err)
+		}
+
 	} else {
 		// Deleting the deployment does not clean up the associated resources
 		c.log.Info("deleting deployment")
@@ -493,6 +534,42 @@ func (c *Cluster) fixupNSGs(ctx context.Context, vnetResourceGroup, clusterName
 	return nil
 }
 
+func (c *Cluster) peerSubnetsToCI(ctx context.Context, vnetResourceGroup, clusterName string) error {
+	cluster := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/dev-vnet", c.env.SubscriptionID(), vnetResourceGroup)
+
+	r, err := azure.ParseResourceID(c.ciParentVnet)
+	if err != nil {
+		return err
+	}
+
+	clusterProp := &mgmtnetwork.VirtualNetworkPeeringPropertiesFormat{
+		RemoteVirtualNetwork: &mgmtnetwork.SubResource{
+			ID: &c.ciParentVnet,
+		},
+		AllowVirtualNetworkAccess: to.BoolPtr(true),
+		AllowForwardedTraffic:     to.BoolPtr(true),
+	}
+	rpProp := &mgmtnetwork.VirtualNetworkPeeringPropertiesFormat{
+		RemoteVirtualNetwork: &mgmtnetwork.SubResource{
+			ID: &cluster,
+		},
+		AllowVirtualNetworkAccess: to.BoolPtr(true),
+		AllowForwardedTraffic:     to.BoolPtr(true),
+	}
+
+	err = c.peerings.CreateOrUpdateAndWait(ctx, vnetResourceGroup, "dev-vnet", r.ResourceGroup+"-peer", mgmtnetwork.VirtualNetworkPeering{VirtualNetworkPeeringPropertiesFormat: clusterProp})
+	if err != nil {
+		return err
+	}
+
+	err = c.ciParentVnetPeerings.CreateOrUpdateAndWait(ctx, r.ResourceGroup, r.ResourceName, vnetResourceGroup+"-peer", mgmtnetwork.VirtualNetworkPeering{VirtualNetworkPeeringPropertiesFormat: rpProp})
+	if err != nil {
+		return err
+	}
+
+	return err
+}
+
 func (c *Cluster) deleteRoleAssignments(ctx context.Context, vnetResourceGroup, appID string) error {
 	spObjID, err := c.getServicePrincipal(ctx, appID)
 	if err != nil {
diff --git a/pkg/util/clusterdata/worker_profiles_task.go b/pkg/util/clusterdata/worker_profiles_task.go
index 6f50759b1..411f7532c 100644
--- a/pkg/util/clusterdata/worker_profiles_task.go
+++ b/pkg/util/clusterdata/worker_profiles_task.go
@@ -95,14 +95,6 @@ func (ef *workerProfilesEnricherTask) FetchData(ctx context.Context, callbacks c
 			"/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/%s/subnets/%s",
 			r.SubscriptionID, machineProviderSpec.NetworkResourceGroup, machineProviderSpec.Vnet, machineProviderSpec.Subnet,
 		)
-
-		workerProfiles[i].EncryptionAtHost = machineProviderSpec.SecurityProfile != nil &&
-			machineProviderSpec.SecurityProfile.EncryptionAtHost != nil &&
-			*machineProviderSpec.SecurityProfile.EncryptionAtHost
-
-		if machineProviderSpec.OSDisk.ManagedDisk.DiskEncryptionSet != nil {
-			workerProfiles[i].DiskEncryptionSetID = machineProviderSpec.OSDisk.ManagedDisk.DiskEncryptionSet.ID
-		}
 	}
 
 	sort.Slice(workerProfiles, func(i, j int) bool { return workerProfiles[i].Name < workerProfiles[j].Name })
diff --git a/pkg/util/dynamichelper/discovery/bindata.go b/pkg/util/dynamichelper/discovery/bindata.go
index 6f09482f2..33d293d14 100644
--- a/pkg/util/dynamichelper/discovery/bindata.go
+++ b/pkg/util/dynamichelper/discovery/bindata.go
@@ -340,7 +340,7 @@ func aroOpenshiftIoV1alpha1ServerresourcesJson() (*asset, error) {
 	return a, nil
 }
 
-var _assets_version = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x32\xd1\x33\xd7\x33\xb4\xe0\x02\x04\x00\x00\xff\xff\xa0\x5c\xe9\x7d\x07\x00\x00\x00")
+var _assets_version = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x32\xd1\x33\xd7\x33\x34\xe2\x02\x04\x00\x00\xff\xff\x2a\xb4\x06\x87\x07\x00\x00\x00")
 
 func assets_versionBytes() ([]byte, error) {
 	return bindataRead(
diff --git a/pkg/util/dynamichelper/discovery/cache/assets_version b/pkg/util/dynamichelper/discovery/cache/assets_version
index bdc778938..aca932939 100644
--- a/pkg/util/dynamichelper/discovery/cache/assets_version
+++ b/pkg/util/dynamichelper/discovery/cache/assets_version
@@ -1,1 +1,1 @@
-4.7.18
+4.7.12
diff --git a/pkg/util/instancemetadata/dev.go b/pkg/util/instancemetadata/dev.go
index 22b410685..a307b7507 100644
--- a/pkg/util/instancemetadata/dev.go
+++ b/pkg/util/instancemetadata/dev.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 func NewDev(checkEnv bool) (InstanceMetadata, error) {
@@ -24,10 +24,10 @@ func NewDev(checkEnv bool) (InstanceMetadata, error) {
 		}
 	}
 
-	environment := azureclient.PublicCloud
+	environment := azure.PublicCloud
 	if value, found := os.LookupEnv("AZURE_ENVIRONMENT"); found {
 		var err error
-		environment, err = azureclient.EnvironmentFromName(value)
+		environment, err = azure.EnvironmentFromName(value)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/util/instancemetadata/instancemetadata.go b/pkg/util/instancemetadata/instancemetadata.go
index 4d09c037e..8cf125d33 100644
--- a/pkg/util/instancemetadata/instancemetadata.go
+++ b/pkg/util/instancemetadata/instancemetadata.go
@@ -7,9 +7,8 @@ import (
 	"context"
 	"os"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/sirupsen/logrus"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 type InstanceMetadata interface {
@@ -18,7 +17,7 @@ type InstanceMetadata interface {
 	SubscriptionID() string
 	Location() string
 	ResourceGroup() string
-	Environment() *azureclient.AROEnvironment
+	Environment() *azure.Environment
 }
 
 type instanceMetadata struct {
@@ -27,7 +26,7 @@ type instanceMetadata struct {
 	subscriptionID string
 	location       string
 	resourceGroup  string
-	environment    *azureclient.AROEnvironment
+	environment    *azure.Environment
 }
 
 func (im *instanceMetadata) Hostname() string {
@@ -50,11 +49,10 @@ func (im *instanceMetadata) ResourceGroup() string {
 	return im.resourceGroup
 }
 
-func (im *instanceMetadata) Environment() *azureclient.AROEnvironment {
+func (im *instanceMetadata) Environment() *azure.Environment {
 	return im.environment
 }
 
-// New returns a new InstanceMetadata for the given mode, environment, and deployment system
 func New(ctx context.Context, log *logrus.Entry, isLocalDevelopmentMode bool) (InstanceMetadata, error) {
 	if isLocalDevelopmentMode {
 		log.Info("creating development InstanceMetadata")
@@ -64,8 +62,8 @@ func New(ctx context.Context, log *logrus.Entry, isLocalDevelopmentMode bool) (I
 	if os.Getenv("AZURE_EV2") != "" {
 		log.Info("creating InstanceMetadata from Environment")
 		return newProdFromEnv(ctx)
+	} else {
+		log.Info("creating InstanceMetadata from Azure Instance Metadata Service (AIMS)")
+		return newProd(ctx)
 	}
-
-	log.Info("creating InstanceMetadata from Azure Instance Metadata Service (AIMS)")
-	return newProd(ctx)
 }
diff --git a/pkg/util/instancemetadata/prod.go b/pkg/util/instancemetadata/prod.go
index 3fcc57cc4..7844b4445 100644
--- a/pkg/util/instancemetadata/prod.go
+++ b/pkg/util/instancemetadata/prod.go
@@ -12,10 +12,10 @@ import (
 	"strings"
 
 	"github.com/Azure/go-autorest/autorest/adal"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/form3tech-oss/jwt-go"
 
 	"github.com/Azure/ARO-RP/pkg/util/azureclaim"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 type ServicePrincipalToken interface {
@@ -112,7 +112,7 @@ func (p *prod) populateInstanceMetadata() error {
 		return err
 	}
 
-	environment, err := azureclient.EnvironmentFromName(m.AzEnvironment)
+	environment, err := azure.EnvironmentFromName(m.AzEnvironment)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/util/instancemetadata/prodfromenv.go b/pkg/util/instancemetadata/prodfromenv.go
index 403371ba1..abeba4b25 100644
--- a/pkg/util/instancemetadata/prodfromenv.go
+++ b/pkg/util/instancemetadata/prodfromenv.go
@@ -9,8 +9,7 @@ import (
 	"os"
 
 	"github.com/Azure/go-autorest/autorest/adal"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
+	"github.com/Azure/go-autorest/autorest/azure"
 )
 
 type prodFromEnv struct {
@@ -55,11 +54,13 @@ func (p *prodFromEnv) populateInstanceMetadata() error {
 	// optional env variables
 	// * HOSTNAME_OVERRIDE: defaults to os.Hostname()
 
-	environment, err := azureclient.EnvironmentFromName(p.Getenv("AZURE_ENVIRONMENT"))
+	envStr := p.Getenv("AZURE_ENVIRONMENT")
+	environment, err := azure.EnvironmentFromName(envStr)
 	if err != nil {
 		return err
 	}
 	p.environment = &environment
+
 	p.subscriptionID = p.Getenv("AZURE_SUBSCRIPTION_ID")
 	p.tenantID = p.Getenv("AZURE_TENANT_ID")
 	p.location = p.Getenv("LOCATION")
diff --git a/pkg/util/mocks/env/env.go b/pkg/util/mocks/env/env.go
index 30056eb35..1658ca702 100644
--- a/pkg/util/mocks/env/env.go
+++ b/pkg/util/mocks/env/env.go
@@ -12,10 +12,10 @@ import (
 	reflect "reflect"
 
 	autorest "github.com/Azure/go-autorest/autorest"
+	azure "github.com/Azure/go-autorest/autorest/azure"
 	gomock "github.com/golang/mock/gomock"
 
 	env "github.com/Azure/ARO-RP/pkg/env"
-	azureclient "github.com/Azure/ARO-RP/pkg/util/azureclient"
 	clientauthorizer "github.com/Azure/ARO-RP/pkg/util/clientauthorizer"
 	keyvault "github.com/Azure/ARO-RP/pkg/util/keyvault"
 	refreshable "github.com/Azure/ARO-RP/pkg/util/refreshable"
@@ -45,10 +45,10 @@ func (m *MockCore) EXPECT() *MockCoreMockRecorder {
 }
 
 // Environment mocks base method.
-func (m *MockCore) Environment() *azureclient.AROEnvironment {
+func (m *MockCore) Environment() *azure.Environment {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Environment")
-	ret0, _ := ret[0].(*azureclient.AROEnvironment)
+	ret0, _ := ret[0].(*azure.Environment)
 	return ret0
 }
 
@@ -351,10 +351,10 @@ func (mr *MockInterfaceMockRecorder) EnsureARMResourceGroupRoleAssignment(arg0,
 }
 
 // Environment mocks base method.
-func (m *MockInterface) Environment() *azureclient.AROEnvironment {
+func (m *MockInterface) Environment() *azure.Environment {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Environment")
-	ret0, _ := ret[0].(*azureclient.AROEnvironment)
+	ret0, _ := ret[0].(*azure.Environment)
 	return ret0
 }
 
diff --git a/pkg/util/mocks/instancemetadata/instancemetadata.go b/pkg/util/mocks/instancemetadata/instancemetadata.go
index d27bbf6dd..cdf394275 100644
--- a/pkg/util/mocks/instancemetadata/instancemetadata.go
+++ b/pkg/util/mocks/instancemetadata/instancemetadata.go
@@ -8,9 +8,8 @@ import (
 	context "context"
 	reflect "reflect"
 
+	azure "github.com/Azure/go-autorest/autorest/azure"
 	gomock "github.com/golang/mock/gomock"
-
-	azureclient "github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 // MockServicePrincipalToken is a mock of ServicePrincipalToken interface.
@@ -88,10 +87,10 @@ func (m *MockInstanceMetadata) EXPECT() *MockInstanceMetadataMockRecorder {
 }
 
 // Environment mocks base method.
-func (m *MockInstanceMetadata) Environment() *azureclient.AROEnvironment {
+func (m *MockInstanceMetadata) Environment() *azure.Environment {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Environment")
-	ret0, _ := ret[0].(*azureclient.AROEnvironment)
+	ret0, _ := ret[0].(*azure.Environment)
 	return ret0
 }
 
diff --git a/pkg/util/storage/manager.go b/pkg/util/storage/manager.go
index 2db2f8c0b..066367b18 100644
--- a/pkg/util/storage/manager.go
+++ b/pkg/util/storage/manager.go
@@ -52,7 +52,7 @@ func (m *manager) BlobService(ctx context.Context, resourceGroup, account string
 		return nil, err
 	}
 
-	blobcli := azstorage.NewAccountSASClient(account, v, (*m.env.Environment()).Environment).GetBlobService()
+	blobcli := azstorage.NewAccountSASClient(account, v, *m.env.Environment()).GetBlobService()
 
 	return &blobcli, nil
 }
diff --git a/pkg/util/version/clusterversion.go b/pkg/util/version/clusterversion.go
index 15519278a..2cd3d6ffe 100644
--- a/pkg/util/version/clusterversion.go
+++ b/pkg/util/version/clusterversion.go
@@ -26,12 +26,3 @@ func GetClusterVersion(ctx context.Context, configcli configclient.Interface) (*
 
 	return nil, errors.New("unknown cluster version")
 }
-
-func GetClusterDesiredVersion(ctx context.Context, configcli configclient.Interface) (*Version, error) {
-	cv, err := configcli.ConfigV1().ClusterVersions().Get(ctx, "version", metav1.GetOptions{})
-	if err != nil {
-		return nil, err
-	}
-
-	return ParseVersion(cv.Status.Desired.Version)
-}
diff --git a/pkg/util/version/const.go b/pkg/util/version/const.go
index 3b52873c9..51399af58 100644
--- a/pkg/util/version/const.go
+++ b/pkg/util/version/const.go
@@ -20,8 +20,8 @@ var GitCommit = "unknown"
 
 // InstallStream describes stream we are defaulting to for all new clusters
 var InstallStream = &Stream{
-	Version:  NewVersion(4, 7, 18),
-	PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:afcb309425d45a240de2df8e376f9632e6144052177fd62a0347934657b3573f",
+	Version:  NewVersion(4, 7, 12),
+	PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:2029c5779202293f23418d47a1a823c4e4c8539c1ab25e8bda30d48335b4892e",
 }
 
 // Streams describes list of streams we support for upgrades
@@ -29,12 +29,12 @@ var (
 	Streams = []*Stream{
 		InstallStream,
 		{
-			Version:  NewVersion(4, 6, 36),
-			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:4205c6709ec4b8523eb18144f7c5bed17a32ba71348fd4c2b6ab43a636cf028e",
+			Version:  NewVersion(4, 6, 26),
+			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:e867135cd5a09192635b46ccab6ca7543e642378dc72fa22ea54961b05e322f2",
 		},
 		{
-			Version:  NewVersion(4, 5, 39),
-			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:c4b9eb565c64df97afe7841bbcc0469daec7973e46ae588739cc30ea9062172b",
+			Version:  NewVersion(4, 5, 38),
+			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:688ca8e365fbd4ee4cc8524e2732395560446d2ff90c3d9b8407b159c571ca1c",
 		},
 		{
 			Version:  NewVersion(4, 4, 33),
diff --git a/python/az/aro/azext_aro/_aad.py b/python/az/aro/azext_aro/_aad.py
index 6c737a42e..df4e70d0f 100644
--- a/python/az/aro/azext_aro/_aad.py
+++ b/python/az/aro/azext_aro/_aad.py
@@ -6,8 +6,9 @@ import time
 import uuid
 
 from azure.cli.core._profile import Profile
+from azure.cli.core.cloud import get_active_cloud_name
 from azure.cli.core.commands.client_factory import configure_common_settings
-from azure.cli.core.azclierror import BadRequestError
+from azure.cli.core.azclierror import BadRequestError, InvalidArgumentValueError
 from azure.graphrbac import GraphRbacManagementClient
 from azure.graphrbac.models import ApplicationCreateParameters
 from azure.graphrbac.models import GraphErrorException
@@ -19,10 +20,11 @@ logger = get_logger(__name__)
 
 
 class AADManager:
-    MANAGED_APP_PREFIX = 'https://az.aro.azure.com/'
+    MANAGED_APP = {'AzureUSGovernment': 'https://az.aro.azure.us/', 'AzureCloud': 'https://az.aro.azure.com/'}
 
     def __init__(self, cli_ctx):
         profile = Profile(cli_ctx=cli_ctx)
+        self.cli_ctx = cli_ctx
         credentials, _, tenant_id = profile.get_login_credentials(
             resource=cli_ctx.cloud.endpoints.active_directory_graph_resource_id)
         self.client = GraphRbacManagementClient(
@@ -37,7 +39,7 @@ class AADManager:
         app = self.client.applications.create(ApplicationCreateParameters(
             display_name=display_name,
             identifier_uris=[
-                self.MANAGED_APP_PREFIX + str(uuid.uuid4()),
+                self.get_managed_app_url()
             ],
             password_credentials=[
                 PasswordCredential(
@@ -51,6 +53,12 @@ class AADManager:
 
         return app, password
 
+    def get_managed_app_url(self):
+        cloud_name = get_active_cloud_name(self.cli_ctx)
+        if cloud_name not in self.MANAGED_APP.keys():
+            raise InvalidArgumentValueError("ARO not supported in: " + cloud_name)
+        return self.MANAGED_APP[cloud_name] + str(uuid.uuid4())
+
     def get_service_principal(self, app_id):
         sps = list(self.client.service_principals.list(
             filter="appId eq '%s'" % app_id))
diff --git a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
index d1a9940f6..d792c652c 100644
--- a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
+++ b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
@@ -299,27 +299,17 @@ class MasterProfile(Model):
      ~azure.mgmt.redhatopenshift.v2021_01_31_preview.models.VMSize
     :param subnet_id: The Azure resource ID of the master subnet.
     :type subnet_id: str
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
         'vm_size': {'key': 'vmSize', 'type': 'str'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
     def __init__(self, **kwargs):
         super(MasterProfile, self).__init__(**kwargs)
         self.vm_size = kwargs.get('vm_size', None)
         self.subnet_id = kwargs.get('subnet_id', None)
-        self.encryption_at_host = kwargs.get('encryption_at_host', None)
-        self.disk_encryption_set_id = kwargs.get('disk_encryption_set_id', None)
 
 
 class NetworkProfile(Model):
@@ -735,12 +725,6 @@ class WorkerProfile(Model):
     :type subnet_id: str
     :param count: The number of worker VMs.
     :type count: int
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
@@ -749,8 +733,6 @@ class WorkerProfile(Model):
         'disk_size_gb': {'key': 'diskSizeGB', 'type': 'int'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
         'count': {'key': 'count', 'type': 'int'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
     def __init__(self, **kwargs):
@@ -760,5 +742,3 @@ class WorkerProfile(Model):
         self.disk_size_gb = kwargs.get('disk_size_gb', None)
         self.subnet_id = kwargs.get('subnet_id', None)
         self.count = kwargs.get('count', None)
-        self.encryption_at_host = kwargs.get('encryption_at_host', None)
-        self.disk_encryption_set_id = kwargs.get('disk_encryption_set_id', None)
diff --git a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
index 1d68c5993..2b203a81f 100644
--- a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
+++ b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
@@ -299,27 +299,17 @@ class MasterProfile(Model):
      ~azure.mgmt.redhatopenshift.v2021_01_31_preview.models.VMSize
     :param subnet_id: The Azure resource ID of the master subnet.
     :type subnet_id: str
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
         'vm_size': {'key': 'vmSize', 'type': 'str'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
-    def __init__(self, *, vm_size=None, subnet_id: str=None, encryption_at_host: bool=None, disk_encryption_set_id: str=None, **kwargs) -> None:
+    def __init__(self, *, vm_size=None, subnet_id: str=None, **kwargs) -> None:
         super(MasterProfile, self).__init__(**kwargs)
         self.vm_size = vm_size
         self.subnet_id = subnet_id
-        self.encryption_at_host = encryption_at_host
-        self.disk_encryption_set_id = disk_encryption_set_id
 
 
 class NetworkProfile(Model):
@@ -735,12 +725,6 @@ class WorkerProfile(Model):
     :type subnet_id: str
     :param count: The number of worker VMs.
     :type count: int
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
@@ -749,16 +733,12 @@ class WorkerProfile(Model):
         'disk_size_gb': {'key': 'diskSizeGB', 'type': 'int'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
         'count': {'key': 'count', 'type': 'int'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
-    def __init__(self, *, name: str=None, vm_size=None, disk_size_gb: int=None, subnet_id: str=None, count: int=None, encryption_at_host: bool=None, disk_encryption_set_id: str=None, **kwargs) -> None:
+    def __init__(self, *, name: str=None, vm_size=None, disk_size_gb: int=None, subnet_id: str=None, count: int=None, **kwargs) -> None:
         super(WorkerProfile, self).__init__(**kwargs)
         self.name = name
         self.vm_size = vm_size
         self.disk_size_gb = disk_size_gb
         self.subnet_id = subnet_id
         self.count = count
-        self.encryption_at_host = encryption_at_host
-        self.disk_encryption_set_id = disk_encryption_set_id
diff --git a/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json b/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
index 471ef7aed..03eeffb74 100644
--- a/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
+++ b/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
@@ -575,14 +575,6 @@
         "subnetId": {
           "description": "The Azure resource ID of the master subnet.",
           "type": "string"
-        },
-        "encryptionAtHost": {
-          "description": "Whether master virtual machines are encrypted at host.",
-          "type": "boolean"
-        },
-        "diskEncryptionSetId": {
-          "description": "The resource ID of an associated DiskEncryptionSet, if applicable.",
-          "type": "string"
         }
       }
     },
@@ -851,14 +843,6 @@
         "count": {
           "description": "The number of worker VMs.",
           "type": "integer"
-        },
-        "encryptionAtHost": {
-          "description": "Whether master virtual machines are encrypted at host.",
-          "type": "boolean"
-        },
-        "diskEncryptionSetId": {
-          "description": "The resource ID of an associated DiskEncryptionSet, if applicable.",
-          "type": "string"
         }
       }
     }
diff --git a/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go b/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
index 69b4e1e6d..dc759b4b0 100644
--- a/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
+++ b/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
@@ -40,7 +40,7 @@ Before=bootkube.service
 # This file is a product of user DNS settings on the VNET. We will replace this file to point to
 # dnsmasq instance on the node. dnsmasq will inject certain dns records we need and forward rest of the queries to
 # resolv.conf.dnsmasq upstream customer dns.
-ExecStartPre=/bin/bash /usr/local/bin/aro-dnsmasq-pre.sh
+ExecStartPre=/bin/bash -c 'if /usr/bin/test -f "/etc/resolv.conf.dnsmasq"; then echo "already replaced resolv.conf.dnsmasq"; else /bin/cp /etc/resolv.conf /etc/resolv.conf.dnsmasq; fi; /bin/sed -ni -e "/^nameserver /!p; \\$$a nameserver $$(ip -f inet -o addr show eth0|cut -d\  -f 7 | cut -d/ -f 1)" /etc/resolv.conf; /usr/sbin/restorecon /etc/resolv.conf'
 ExecStart=/usr/sbin/dnsmasq -k
 ExecStopPost=/bin/bash -c '/bin/mv /etc/resolv.conf.dnsmasq /etc/resolv.conf; /usr/sbin/restorecon /etc/resolv.conf'
 Restart=always
@@ -49,62 +49,6 @@ Restart=always
 WantedBy=multi-user.target
 {{ end }}
 
-{{ define "aro-dnsmasq-pre.sh" }}
-#!/bin/bash
-set -euo pipefail
-
-# This bash script is a part of the ARO DnsMasq configuration
-# It's deployed as part of the 99-aro-dns-* machine config
-# See https://github.com/Azure/ARO-RP
-
-# This file can be rerun and the effect is idempotent, output might change if the DHCP configuration changes
-
-TMPSELFRESOLV=$(mktemp)
-TMPNETRESOLV=$(mktemp)
-
-echo "# Generated for dnsmasq.service - should point to self" > $TMPSELFRESOLV
-echo "# Generated for dnsmasq.service - should contain DHCP configured DNS" > $TMPNETRESOLV
-
-if nmcli device show br-ex; then
-    echo "OVN mode - br-ex device exists"
-    #getting DNS search strings
-    SEARCH_RAW=$(nmcli --get IP4.DOMAIN device show br-ex)
-    #getting DNS servers
-    NAMESERVER_RAW=$(nmcli --get IP4.DNS device show br-ex)
-    LOCAL_IPS_RAW=$(nmcli --get IP4.ADDRESS device show br-ex)
-else
-    NETDEV=$(nmcli --get device connection show --active | head -n 1) #there should be only one active device
-    echo "OVS SDN mode - br-ex not found, using device $NETDEV"
-    SEARCH_RAW=$(nmcli --get IP4.DOMAIN device show $NETDEV)
-    NAMESERVER_RAW=$(nmcli --get IP4.DNS device show $NETDEV)
-    LOCAL_IPS_RAW=$(nmcli --get IP4.ADDRESS device show $NETDEV)
-fi
-
-#search line
-echo "search $SEARCH_RAW" | tr '\n' ' ' >> $TMPNETRESOLV
-echo "" >> $TMPNETRESOLV
-echo "search $SEARCH_RAW" | tr '\n' ' ' >> $TMPSELFRESOLV
-echo "" >> $TMPSELFRESOLV
-
-#nameservers as separate lines
-echo "$NAMESERVER_RAW" | while read -r line
-do
-    echo "nameserver $line" >> $TMPNETRESOLV
-done
-# device IPs are returned in address/mask format
-echo "$LOCAL_IPS_RAW" | while read -r line
-do
-    echo "nameserver $line" | cut -d'/' -f 1 >> $TMPSELFRESOLV
-done
-
-# done, copying files to destination locations and cleaning up
-/bin/cp $TMPNETRESOLV /etc/resolv.conf.dnsmasq
-chmod 0744 /etc/resolv.conf.dnsmasq
-/bin/cp $TMPSELFRESOLV /etc/resolv.conf
-/usr/sbin/restorecon /etc/resolv.conf
-/bin/rm $TMPNETRESOLV
-/bin/rm $TMPSELFRESOLV
-{{ end }}
 `))
 
 func config(clusterDomain, apiIntIP, ingressIP string) ([]byte, error) {
@@ -137,17 +81,6 @@ func service() (string, error) {
 	return buf.String(), nil
 }
 
-func startpre() ([]byte, error) {
-	buf := &bytes.Buffer{}
-
-	err := t.ExecuteTemplate(buf, "aro-dnsmasq-pre.sh", nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return buf.Bytes(), nil
-}
-
 func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Config, error) {
 	service, err := service()
 	if err != nil {
@@ -159,11 +92,6 @@ func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Conf
 		return nil, err
 	}
 
-	startpre, err := startpre()
-	if err != nil {
-		return nil, err
-	}
-
 	return &ign2types.Config{
 		Ignition: ign2types.Ignition{
 			Version: ign2types.MaxVersion.String(),
@@ -186,22 +114,6 @@ func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Conf
 						Mode: ignutil.IntToPtr(0644),
 					},
 				},
-				{
-					Node: ign2types.Node{
-						Filesystem: "root",
-						Overwrite:  ignutil.BoolToPtr(true),
-						Path:       "/usr/local/bin/aro-dnsmasq-pre.sh",
-						User: &ign2types.NodeUser{
-							Name: "root",
-						},
-					},
-					FileEmbedded1: ign2types.FileEmbedded1{
-						Contents: ign2types.FileContents{
-							Source: dataurl.EncodeBytes(startpre),
-						},
-						Mode: ignutil.IntToPtr(0744),
-					},
-				},
 			},
 		},
 		Systemd: ign2types.Systemd{
@@ -227,11 +139,6 @@ func Ignition3Config(clusterDomain, apiIntIP, ingressIP string) (*ign3types.Conf
 		return nil, err
 	}
 
-	startpre, err := startpre()
-	if err != nil {
-		return nil, err
-	}
-
 	return &ign3types.Config{
 		Ignition: ign3types.Ignition{
 			Version: ign3types.MaxVersion.String(),
@@ -253,21 +160,6 @@ func Ignition3Config(clusterDomain, apiIntIP, ingressIP string) (*ign3types.Conf
 						Mode: ignutil.IntToPtr(0644),
 					},
 				},
-				{
-					Node: ign3types.Node{
-						Overwrite: ignutil.BoolToPtr(true),
-						Path:      "/usr/local/bin/aro-dnsmasq-pre.sh",
-						User: ign3types.NodeUser{
-							Name: ignutil.StrToPtr("root"),
-						},
-					},
-					FileEmbedded1: ign3types.FileEmbedded1{
-						Contents: ign3types.Resource{
-							Source: ignutil.StrToPtr(dataurl.EncodeBytes(startpre)),
-						},
-						Mode: ignutil.IntToPtr(0744),
-					},
-				},
 			},
 		},
 		Systemd: ign3types.Systemd{
diff --git a/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go b/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
index f03a2367d..af762f28e 100644
--- a/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
+++ b/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
@@ -144,18 +144,6 @@ func provider(platform *azure.Platform, mpool *azure.MachinePool, osImage string
 		}
 	}
 
-	if mpool.OSDisk.DiskEncryptionSetID != "" {
-		spec.OSDisk.ManagedDisk.DiskEncryptionSet = &azureprovider.DiskEncryptionSetParameters{
-			ID: mpool.OSDisk.DiskEncryptionSetID,
-		}
-	}
-
-	if mpool.EncryptionAtHost {
-		spec.SecurityProfile = &azureprovider.SecurityProfile{
-			EncryptionAtHost: &mpool.EncryptionAtHost,
-		}
-	}
-
 	if platform.ARO {
 		spec.ManagedIdentity = ""
 	}
diff --git a/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go b/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
index 87f768206..e97753eb0 100644
--- a/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
+++ b/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
@@ -15,11 +15,6 @@ type MachinePool struct {
 	// +optional
 	InstanceType string `json:"type"`
 
-	// EncryptionAtHost
-	//
-	// +optional
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
 	// OSDisk defines the storage for instance.
 	//
 	// +optional
@@ -39,10 +34,6 @@ type OSDisk struct {
 	// +optional
 	// +kubebuilder:validation:Enum=Standard_LRS;Premium_LRS;StandardSSD_LRS
 	DiskType string `json:"diskType"`
-
-	// DiskEncryptionSetID is a resource ID of disk encryption set
-	// +optional
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // Set sets the values from `required` to `a`.
@@ -59,10 +50,6 @@ func (a *MachinePool) Set(required *MachinePool) {
 		a.InstanceType = required.InstanceType
 	}
 
-	if required.EncryptionAtHost {
-		a.EncryptionAtHost = required.EncryptionAtHost
-	}
-
 	if required.OSDisk.DiskSizeGB != 0 {
 		a.OSDisk.DiskSizeGB = required.OSDisk.DiskSizeGB
 	}
@@ -70,8 +57,4 @@ func (a *MachinePool) Set(required *MachinePool) {
 	if required.OSDisk.DiskType != "" {
 		a.OSDisk.DiskType = required.OSDisk.DiskType
 	}
-
-	if required.OSDisk.DiskEncryptionSetID != "" {
-		a.OSDisk.DiskEncryptionSetID = required.OSDisk.DiskEncryptionSetID
-	}
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e109197dc..f0d2703fd 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -793,7 +793,7 @@ github.com/openshift/console-operator/pkg/api
 # github.com/openshift/custom-resource-status v1.1.0
 ## explicit
 github.com/openshift/custom-resource-status/conditions/v1
-# github.com/openshift/installer v0.16.1 => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+# github.com/openshift/installer v0.16.1 => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 ## explicit
 github.com/openshift/installer/data
 github.com/openshift/installer/pkg/aro/dnsmasq
@@ -1917,7 +1917,7 @@ sigs.k8s.io/yaml
 # github.com/openshift/cluster-api-provider-libvirt => github.com/openshift/cluster-api-provider-libvirt v0.2.1-0.20210324200850-033be25ca038
 # github.com/openshift/cluster-api-provider-ovirt => github.com/openshift/cluster-api-provider-ovirt v0.1.1-0.20210409185359-01b9bf8368a3
 # github.com/openshift/console-operator => github.com/openshift/console-operator v0.0.0-20210323072657-4f933d59784b
-# github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+# github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 # github.com/openshift/library-go => github.com/openshift/library-go v0.0.0-20210205203934-9eb0d970f2f4
 # github.com/openshift/machine-api-operator => github.com/openshift/machine-api-operator v0.2.1-0.20210521181620-e179bb5ce397
 # github.com/openshift/machine-config-operator => github.com/openshift/machine-config-operator v0.0.1-0.20210522053223-c4b7e3f5118d


Test patch:
diff --git a/.pipelines/templates/template-prod-e2e-steps.yml b/.pipelines/templates/template-prod-e2e-steps.yml
index 64b31668c..1272aee2e 100644
--- a/.pipelines/templates/template-prod-e2e-steps.yml
+++ b/.pipelines/templates/template-prod-e2e-steps.yml
@@ -33,7 +33,7 @@ steps:
       export AZURE_FP_SERVICE_PRINCIPAL_ID=fe9d206f-a6af-46db-8bda-303aae45e469
     else
       export AZURE_FP_CLIENT_ID=f1dd0a37-89c6-4e07-bcd1-ffd3d43d8875
-      export AZURE_FP_SERVICE_PRINCIPAL_ID=50c17c64-bc11-4fdd-a339-0ecd396bf911
+      export AZURE_FP_SERVICE_PRINCIPAL_ID=de2829de-2392-40ee-b3a8-79b70a18c2a1
     fi
     # TODO: remove --env RESOURCEGROUP after next RP deployment.
 
diff --git a/pkg/api/validate/dynamic/dynamic_test.go b/pkg/api/validate/dynamic/dynamic_test.go
index 45368e59b..e56c331c6 100644
--- a/pkg/api/validate/dynamic/dynamic_test.go
+++ b/pkg/api/validate/dynamic/dynamic_test.go
@@ -44,6 +44,9 @@ func TestValidateVnetPermissions(t *testing.T) {
 	resourceType := "virtualNetworks"
 	resourceProvider := "Microsoft.Network"
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name    string
 		mocks   func(*mock_authorization.MockPermissionsClient, func())
@@ -108,9 +111,6 @@ func TestValidateVnetPermissions(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
 
@@ -161,9 +161,6 @@ func TestGetRouteTableID(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
 			vnet := &mgmtnetwork.VirtualNetwork{
 				ID: &vnetID,
 				VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
@@ -197,6 +194,9 @@ func TestGetRouteTableID(t *testing.T) {
 func TestValidateRouteTablesPermissions(t *testing.T) {
 	ctx := context.Background()
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name            string
 		subnet          Subnet
@@ -299,9 +299,6 @@ func TestValidateRouteTablesPermissions(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
 
@@ -359,6 +356,9 @@ func TestValidateRouteTablesPermissions(t *testing.T) {
 func TestValidateCIDRRanges(t *testing.T) {
 	ctx := context.Background()
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name      string
 		modifyOC  func(*api.OpenShiftCluster)
@@ -392,102 +392,100 @@ func TestValidateCIDRRanges(t *testing.T) {
 			wantErr: "400: InvalidLinkedVNet: : The provided CIDRs must not overlap: '10.0.0.0/24 overlaps with 10.0.0.0/24'.",
 		},
 	} {
-		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
-			oc := &api.OpenShiftCluster{
-				Properties: api.OpenShiftClusterProperties{
-					ClusterProfile: api.ClusterProfile{
-						ResourceGroupID: resourceGroupID,
-					},
-					NetworkProfile: api.NetworkProfile{
-						PodCIDR:     "10.0.2.0/24",
-						ServiceCIDR: "10.0.3.0/24",
-					},
-					MasterProfile: api.MasterProfile{
-						SubnetID: masterSubnet,
+		oc := &api.OpenShiftCluster{
+			Properties: api.OpenShiftClusterProperties{
+				ClusterProfile: api.ClusterProfile{
+					ResourceGroupID: resourceGroupID,
+				},
+				NetworkProfile: api.NetworkProfile{
+					PodCIDR:     "10.0.2.0/24",
+					ServiceCIDR: "10.0.3.0/24",
+				},
+				MasterProfile: api.MasterProfile{
+					SubnetID: masterSubnet,
+				},
+				WorkerProfiles: []api.WorkerProfile{
+					{
+						SubnetID: workerSubnet,
 					},
-					WorkerProfiles: []api.WorkerProfile{
-						{
-							SubnetID: workerSubnet,
-						},
-						{
-							SubnetID: workerSubnet,
-						},
+					{
+						SubnetID: workerSubnet,
 					},
 				},
-			}
-
-			vnet := mgmtnetwork.VirtualNetwork{
-				ID:       &vnetID,
-				Location: to.StringPtr("eastus"),
-				VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
-					Subnets: &[]mgmtnetwork.Subnet{
-						{
-							ID: &masterSubnet,
-							SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
-								AddressPrefix: to.StringPtr("10.0.0.0/24"),
-								NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
-									ID: &masterNSGv1,
-								},
-								ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
-									{
-										Service:           to.StringPtr("Microsoft.ContainerRegistry"),
-										ProvisioningState: mgmtnetwork.Succeeded,
-									},
+			},
+		}
+
+		vnet := mgmtnetwork.VirtualNetwork{
+			ID:       &vnetID,
+			Location: to.StringPtr("eastus"),
+			VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
+				Subnets: &[]mgmtnetwork.Subnet{
+					{
+						ID: &masterSubnet,
+						SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
+							AddressPrefix: to.StringPtr("10.0.0.0/24"),
+							NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
+								ID: &masterNSGv1,
+							},
+							ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
+								{
+									Service:           to.StringPtr("Microsoft.ContainerRegistry"),
+									ProvisioningState: mgmtnetwork.Succeeded,
 								},
-								PrivateLinkServiceNetworkPolicies: to.StringPtr("Disabled"),
 							},
+							PrivateLinkServiceNetworkPolicies: to.StringPtr("Disabled"),
 						},
-						{
-							ID: &workerSubnet,
-							SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
-								AddressPrefix: to.StringPtr("10.0.1.0/24"),
-								NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
-									ID: &workerNSGv1,
-								},
-								ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
-									{
-										Service:           to.StringPtr("Microsoft.ContainerRegistry"),
-										ProvisioningState: mgmtnetwork.Succeeded,
-									},
+					},
+					{
+						ID: &workerSubnet,
+						SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
+							AddressPrefix: to.StringPtr("10.0.1.0/24"),
+							NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
+								ID: &workerNSGv1,
+							},
+							ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
+								{
+									Service:           to.StringPtr("Microsoft.ContainerRegistry"),
+									ProvisioningState: mgmtnetwork.Succeeded,
 								},
 							},
 						},
 					},
 				},
-			}
-
-			if tt.modifyOC != nil {
-				tt.modifyOC(oc)
-			}
-
-			vnetClient := mock_network.NewMockVirtualNetworksClient(controller)
-			if tt.vnetMocks != nil {
-				tt.vnetMocks(vnetClient, vnet)
-			}
-
-			dv := &dynamic{
-				log:             logrus.NewEntry(logrus.StandardLogger()),
-				virtualNetworks: vnetClient,
-			}
-
-			err := dv.validateCIDRRanges(ctx, []Subnet{
-				{ID: masterSubnet},
-				{ID: workerSubnet}},
-				oc.Properties.NetworkProfile.PodCIDR, oc.Properties.NetworkProfile.ServiceCIDR)
-			if err != nil && err.Error() != tt.wantErr ||
-				err == nil && tt.wantErr != "" {
-				t.Error(err)
-			}
-		})
+			},
+		}
+
+		if tt.modifyOC != nil {
+			tt.modifyOC(oc)
+		}
+
+		vnetClient := mock_network.NewMockVirtualNetworksClient(controller)
+		if tt.vnetMocks != nil {
+			tt.vnetMocks(vnetClient, vnet)
+		}
+
+		dv := &dynamic{
+			log:             logrus.NewEntry(logrus.StandardLogger()),
+			virtualNetworks: vnetClient,
+		}
+
+		err := dv.validateCIDRRanges(ctx, []Subnet{
+			{ID: masterSubnet},
+			{ID: workerSubnet}},
+			oc.Properties.NetworkProfile.PodCIDR, oc.Properties.NetworkProfile.ServiceCIDR)
+		if err != nil && err.Error() != tt.wantErr ||
+			err == nil && tt.wantErr != "" {
+			t.Error(err)
+		}
 	}
 }
 
 func TestValidateVnetLocation(t *testing.T) {
 	ctx := context.Background()
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name     string
 		location string
@@ -504,8 +502,6 @@ func TestValidateVnetLocation(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
 
 			vnet := mgmtnetwork.VirtualNetwork{
 				ID:       to.StringPtr(vnetID),
@@ -539,6 +535,9 @@ func TestValidateVnetLocation(t *testing.T) {
 func TestValidateSubnets(t *testing.T) {
 	ctx := context.Background()
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name      string
 		modifyOC  func(*api.OpenShiftCluster)
@@ -679,9 +678,6 @@ func TestValidateSubnets(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
 			oc := &api.OpenShiftCluster{
 				Properties: api.OpenShiftClusterProperties{
 					ClusterProfile: api.ClusterProfile{
diff --git a/pkg/api/validate/dynamic/provider_test.go b/pkg/api/validate/dynamic/provider_test.go
index 34513b512..c558129b5 100644
--- a/pkg/api/validate/dynamic/provider_test.go
+++ b/pkg/api/validate/dynamic/provider_test.go
@@ -19,6 +19,9 @@ import (
 func TestValidateProviders(t *testing.T) {
 	ctx := context.Background()
 
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
 	for _, tt := range []struct {
 		name    string
 		mocks   func(*mock_features.MockProvidersClient)
@@ -132,9 +135,6 @@ func TestValidateProviders(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
 			providerClient := mock_features.NewMockProvidersClient(controller)
 
 			tt.mocks(providerClient)
diff --git a/pkg/cluster/install_test.go b/pkg/cluster/install_test.go
index ab070d9b6..376c8c3a9 100644
--- a/pkg/cluster/install_test.go
+++ b/pkg/cluster/install_test.go
@@ -22,6 +22,7 @@ import (
 	"k8s.io/client-go/kubernetes/fake"
 
 	"github.com/Azure/ARO-RP/pkg/api"
+	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	"github.com/Azure/ARO-RP/pkg/util/steps"
 	"github.com/Azure/ARO-RP/pkg/util/version"
 	testdatabase "github.com/Azure/ARO-RP/test/database"
@@ -144,9 +145,13 @@ func TestStepRunnerWithInstaller(t *testing.T) {
 			controller := gomock.NewController(t)
 			defer controller.Finish()
 
+			env := mock_env.NewMockInterface(controller)
+			env.EXPECT().IsLocalDevelopmentMode().Return(false)
+
 			h, log := testlog.New()
 			m := &manager{
 				log:           log,
+				env:           env,
 				kubernetescli: tt.kubernetescli,
 				configcli:     tt.configcli,
 				operatorcli:   tt.operatorcli,
diff --git a/pkg/frontend/openshiftcluster_putorpatch_test.go b/pkg/frontend/openshiftcluster_putorpatch_test.go
index 32f382074..b88cfb3d9 100644
--- a/pkg/frontend/openshiftcluster_putorpatch_test.go
+++ b/pkg/frontend/openshiftcluster_putorpatch_test.go
@@ -888,6 +888,7 @@ func TestPutOrPatchOpenShiftCluster(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+
 			ti := newTestInfra(t).
 				WithOpenShiftClusters().
 				WithSubscriptions().
diff --git a/pkg/frontend/security_test.go b/pkg/frontend/security_test.go
index a7e268626..c1eb99a0f 100644
--- a/pkg/frontend/security_test.go
+++ b/pkg/frontend/security_test.go
@@ -12,13 +12,13 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 	"github.com/sirupsen/logrus"
 
 	"github.com/Azure/ARO-RP/pkg/api"
 	"github.com/Azure/ARO-RP/pkg/env"
 	"github.com/Azure/ARO-RP/pkg/metrics/noop"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/clientauthorizer"
 	"github.com/Azure/ARO-RP/pkg/util/log/audit"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
@@ -57,7 +57,7 @@ func TestSecurity(t *testing.T) {
 
 	_env := mock_env.NewMockInterface(controller)
 	_env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-	_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+	_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 	_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 	_env.EXPECT().Location().AnyTimes().Return("eastus")
 	_env.EXPECT().ServiceKeyvault().AnyTimes().Return(keyvault)
diff --git a/pkg/frontend/shared_test.go b/pkg/frontend/shared_test.go
index b1ea058ae..215f9d17f 100644
--- a/pkg/frontend/shared_test.go
+++ b/pkg/frontend/shared_test.go
@@ -16,6 +16,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/go-test/deep"
 	"github.com/golang/mock/gomock"
 	"github.com/sirupsen/logrus"
@@ -24,7 +25,6 @@ import (
 	"github.com/Azure/ARO-RP/pkg/database"
 	"github.com/Azure/ARO-RP/pkg/database/cosmosdb"
 	"github.com/Azure/ARO-RP/pkg/env"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/clientauthorizer"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	mock_keyvault "github.com/Azure/ARO-RP/pkg/util/mocks/keyvault"
@@ -90,7 +90,7 @@ func newTestInfra(t *testing.T) *testInfra {
 
 	_env := mock_env.NewMockInterface(controller)
 	_env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
-	_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+	_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 	_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 	_env.EXPECT().Location().AnyTimes().Return("eastus")
 	_env.EXPECT().ServiceKeyvault().AnyTimes().Return(keyvault)
diff --git a/pkg/monitor/cluster/clusterversions_test.go b/pkg/monitor/cluster/clusterversions_test.go
index ae3fa6853..a09d664f1 100644
--- a/pkg/monitor/cluster/clusterversions_test.go
+++ b/pkg/monitor/cluster/clusterversions_test.go
@@ -77,7 +77,7 @@ func TestEmitClusterVersion(t *testing.T) {
 			wantActualVersion:                        "4.5.1",
 			wantDesiredVersion:                       "4.5.3",
 			wantProvisionedByResourceProviderVersion: "",
-			wantAvailableVersion:                     "4.5.39",
+			wantAvailableVersion:                     "4.5.38",
 			wantAvailableRP:                          "unknown",
 		},
 		{
diff --git a/pkg/operator/controllers/checker/serviceprincipalchecker_test.go b/pkg/operator/controllers/checker/serviceprincipalchecker_test.go
index 07c798787..7bd137702 100644
--- a/pkg/operator/controllers/checker/serviceprincipalchecker_test.go
+++ b/pkg/operator/controllers/checker/serviceprincipalchecker_test.go
@@ -53,7 +53,7 @@ func TestServicePrincipalValid(t *testing.T) {
 					ResourceID:    "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/mycluster",
 				},
 			},
-			wantErr: `cloud environment "NEVERLAND" is unsupported by ARO`,
+			wantErr: `autorest/azure: There is no cloud environment matching the name "NEVERLAND"`,
 		},
 		{
 			name: "fail: azure-credential secret doesn't exist",
diff --git a/pkg/operator/controllers/monitoring/monitoring_controller_test.go b/pkg/operator/controllers/monitoring/monitoring_controller_test.go
index 79d837e95..f237f0e4d 100644
--- a/pkg/operator/controllers/monitoring/monitoring_controller_test.go
+++ b/pkg/operator/controllers/monitoring/monitoring_controller_test.go
@@ -5,7 +5,6 @@ package monitoring
 
 import (
 	"context"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -13,11 +12,8 @@ import (
 	"github.com/ugorji/go/codec"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/fake"
 	ctrl "sigs.k8s.io/controller-runtime"
-
-	"github.com/Azure/ARO-RP/pkg/util/cmp"
 )
 
 var cmMetadata = metav1.ObjectMeta{Name: "cluster-monitoring-config", Namespace: "openshift-monitoring"}
@@ -25,33 +21,61 @@ var cmMetadata = metav1.ObjectMeta{Name: "cluster-monitoring-config", Namespace:
 func TestReconcileMonitoringConfig(t *testing.T) {
 	log := logrus.NewEntry(logrus.StandardLogger())
 	type test struct {
-		name          string
-		kubernetescli kubernetes.Interface
-		wantConfig    string
+		name         string
+		setConfigMap func() *Reconciler
+		wantConfig   string
 	}
 
 	for _, tt := range []*test{
 		{
-			name:          "ConfigMap does not exist - enable",
-			kubernetescli: fake.NewSimpleClientset(),
-			wantConfig:    `{}`,
+			name: "ConfigMap does not exist - enable",
+			setConfigMap: func() *Reconciler {
+				return &Reconciler{
+					kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{}),
+					log:           log,
+					jsonHandle:    new(codec.JsonHandle),
+				}
+			},
+			wantConfig: `
+{}`,
+		},
+		{
+			name: "ConfigMap does not have data",
+			setConfigMap: func() *Reconciler {
+				return &Reconciler{
+					kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
+						ObjectMeta: cmMetadata,
+					}),
+					log:        log,
+					jsonHandle: new(codec.JsonHandle),
+				}
+			},
+			wantConfig: ``,
 		},
 		{
 			name: "empty config.yaml",
-			kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
-				ObjectMeta: cmMetadata,
-				Data: map[string]string{
-					"config.yaml": ``,
-				},
-			}),
+			setConfigMap: func() *Reconciler {
+				return &Reconciler{
+					kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
+						ObjectMeta: cmMetadata,
+						Data: map[string]string{
+							"config.yaml": ``,
+						},
+					}),
+					log:        log,
+					jsonHandle: new(codec.JsonHandle),
+				}
+			},
 			wantConfig: ``,
 		},
 		{
 			name: "settings restored to default and extra fields are preserved",
-			kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
-				ObjectMeta: cmMetadata,
-				Data: map[string]string{
-					"config.yaml": `
+			setConfigMap: func() *Reconciler {
+				return &Reconciler{
+					kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
+						ObjectMeta: cmMetadata,
+						Data: map[string]string{
+							"config.yaml": `
 prometheusK8s:
   extraField: prometheus
   retention: 1d
@@ -76,51 +100,39 @@ alertmanagerMain:
         storageClassName: snail-mail
         volumeMode: Filesystem
 `,
-				},
-			}),
+						},
+					}),
+					log:        log,
+					jsonHandle: new(codec.JsonHandle),
+				}
+			},
 			wantConfig: `
 alertmanagerMain:
   extraField: yeet
 prometheusK8s:
   extraField: prometheus
-`,
-		},
-		{
-			name: "empty volumeClaimTemplate struct is cleared out",
-			kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
-				ObjectMeta: cmMetadata,
-				Data: map[string]string{
-					"config.yaml": `
-alertmanagerMain:
-  volumeClaimTemplate: {}
-  extraField: alertmanager
-prometheusK8s:
-  volumeClaimTemplate: {}
-  bugs: not-here
-`,
-				},
-			}),
-			wantConfig: `
-alertmanagerMain:
-  extraField: alertmanager
-prometheusK8s:
-  bugs: not-here
 `,
 		},
 		{
 			name: "other monitoring components are configured",
-			kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
-				ObjectMeta: cmMetadata,
-				Data: map[string]string{
-					"config.yaml": `
+			setConfigMap: func() *Reconciler {
+				return &Reconciler{
+					kubernetescli: fake.NewSimpleClientset(&corev1.ConfigMap{
+						ObjectMeta: cmMetadata,
+						Data: map[string]string{
+							"config.yaml": `
 alertmanagerMain:
   nodeSelector:
     foo: bar
 somethingElse:
   configured: true
 `,
-				},
-			}),
+						},
+					}),
+					log:        log,
+					jsonHandle: new(codec.JsonHandle),
+				}
+			},
 			wantConfig: `
 alertmanagerMain:
   nodeSelector:
@@ -131,12 +143,8 @@ somethingElse:
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			r := &Reconciler{
-				kubernetescli: tt.kubernetescli,
-				log:           log,
-				jsonHandle:    new(codec.JsonHandle),
-			}
 			ctx := context.Background()
+			r := tt.setConfigMap()
 			request := ctrl.Request{}
 			request.Name = "cluster-monitoring-config"
 			request.Namespace = "openshift-monitoring"
@@ -157,98 +165,3 @@ somethingElse:
 		})
 	}
 }
-
-func TestReconcilePVC(t *testing.T) {
-	log := logrus.NewEntry(logrus.StandardLogger())
-	tests := []struct {
-		name          string
-		kubernetescli kubernetes.Interface
-		want          []corev1.PersistentVolumeClaim
-	}{
-		{
-			name: "Should delete the prometheus PVCs",
-			kubernetescli: fake.NewSimpleClientset(&corev1.PersistentVolumeClaim{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "prometheus-k8s-db-prometheus-k8s-0",
-					Namespace: "openshift-monitoring",
-					Labels: map[string]string{
-						"app":        "prometheus",
-						"prometheus": "k8s",
-					},
-				},
-			},
-				&corev1.PersistentVolumeClaim{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "prometheus-k8s-db-prometheus-k8s-1",
-						Namespace: "openshift-monitoring",
-						Labels: map[string]string{
-							"app":        "prometheus",
-							"prometheus": "k8s",
-						},
-					},
-				}),
-			want: nil,
-		},
-		{
-			name: "Should preserve 1 pvc",
-			kubernetescli: fake.NewSimpleClientset(&corev1.PersistentVolumeClaim{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "prometheus-k8s-db-prometheus-k8s-0",
-					Namespace: "openshift-monitoring",
-					Labels: map[string]string{
-						"app":        "prometheus",
-						"prometheus": "k8s",
-					},
-				},
-			},
-				&corev1.PersistentVolumeClaim{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "random-pvc",
-						Namespace: "openshift-monitoring",
-						Labels: map[string]string{
-							"app": "random",
-						},
-					},
-				}),
-			want: []corev1.PersistentVolumeClaim{
-				{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "random-pvc",
-						Namespace: "openshift-monitoring",
-						Labels: map[string]string{
-							"app": "random",
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			r := &Reconciler{
-				log:           log,
-				kubernetescli: tt.kubernetescli,
-				jsonHandle:    new(codec.JsonHandle),
-			}
-			request := ctrl.Request{}
-			request.Name = "cluster-monitoring-config"
-			request.Namespace = "openshift-monitoring"
-
-			_, err := r.Reconcile(ctx, request)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			pvcList, err := r.kubernetescli.CoreV1().PersistentVolumeClaims(monitoringName.Namespace).List(context.Background(), metav1.ListOptions{})
-			if err != nil {
-				t.Fatalf("Unexpected error during list of PVCs: %v", err)
-			}
-
-			if !reflect.DeepEqual(pvcList.Items, tt.want) {
-				t.Error(cmp.Diff(pvcList.Items, tt.want))
-			}
-		})
-	}
-}
diff --git a/pkg/operator/controllers/workaround/cleanprompvc_test.go b/pkg/operator/controllers/workaround/cleanprompvc_test.go
new file mode 100644
index 000000000..028e7dc90
--- /dev/null
+++ b/pkg/operator/controllers/workaround/cleanprompvc_test.go
@@ -0,0 +1,150 @@
+package workaround
+
+// Copyright (c) Microsoft Corporation.
+// Licensed under the Apache License 2.0.
+
+import (
+	"context"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+
+	utillog "github.com/Azure/ARO-RP/pkg/util/log"
+)
+
+func TestCleanPromPVCEnsure(t *testing.T) {
+
+	pvc0 := corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "prometheus-k8s-db-prometheus-k8s-00",
+			Namespace: "openshift-monitoring",
+			Labels: map[string]string{
+				"app":        "prometheus",
+				"prometheus": "k8s",
+			},
+		},
+	}
+
+	pvc1 := corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "prometheus-k8s-db-prometheus-k8s-0",
+			Namespace: "openshift-monitoring",
+			Labels: map[string]string{
+				"app":        "prometheus",
+				"prometheus": "k8s",
+			},
+		},
+	}
+
+	pvc2 := corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "prometheus-k8s-db-prometheus-k8s-1",
+			Namespace: "openshift-monitoring",
+			Labels: map[string]string{
+				"app":        "prometheus",
+				"prometheus": "k8s",
+			},
+		},
+	}
+
+	pvc3 := corev1.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "dummy",
+			Namespace: "openshift-monitoring",
+		},
+	}
+
+	tests := []struct {
+		name       string
+		cli        *fake.Clientset
+		wantPVCNum int
+		wantErr    error
+	}{
+		{
+			name:       "Should delete the prometheus PVCs",
+			cli:        fake.NewSimpleClientset(&pvc1, &pvc2, &pvc3),
+			wantPVCNum: 1,
+			wantErr:    nil,
+		},
+		{
+			name:       "Should not delete the prometheus PVCs, too many items",
+			cli:        fake.NewSimpleClientset(&pvc1, &pvc2, &pvc3, &pvc0),
+			wantPVCNum: 1,
+			wantErr:    nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := NewCleanFromPVCWorkaround(utillog.GetLogger(), tt.cli)
+			err := w.Ensure(context.Background())
+			if err != tt.wantErr {
+				t.Fatalf("Unexpected error\nwant: %v\ngot: %v", tt.wantErr, err)
+			}
+
+			pvcList, err := tt.cli.CoreV1().PersistentVolumeClaims(monitoringNamespace).List(context.Background(), metav1.ListOptions{})
+			if err != nil {
+				t.Fatalf("Unexpected error during list of PVCs: %v", err)
+			}
+			if len(pvcList.Items) != tt.wantPVCNum {
+				t.Fatalf("Unexpected number of PVCs\nwant: %d\ngot: %d", tt.wantPVCNum, len(pvcList.Items))
+			}
+		})
+	}
+}
+
+func TestCleanPromPVCIsRequired(t *testing.T) {
+	newKubernetesCli := func(config string) *fake.Clientset {
+		configMap := corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      monitoringName,
+				Namespace: monitoringNamespace,
+			},
+			Data: make(map[string]string),
+		}
+
+		configMap.Data["config.yaml"] = config
+
+		return fake.NewSimpleClientset(&configMap)
+	}
+
+	tests := []struct {
+		name         string
+		kcli         *fake.Clientset
+		wantRequired bool
+	}{
+		{
+			name: "Should not be required, persistent set true",
+			kcli: newKubernetesCli(`prometheusK8s:
+  retention: 15d
+  volumeClaimTemplate:
+    spec:
+      resources:
+        requests:
+          storage: 100Gi
+            `),
+			wantRequired: false,
+		},
+		{
+			name: "Should be required, persistent set to false",
+			kcli: newKubernetesCli(`prometheusK8s:
+  retention: ""
+  volumeClaimTemplate: {}
+`),
+			wantRequired: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := NewCleanFromPVCWorkaround(utillog.GetLogger(), tt.kcli)
+			required := w.IsRequired(nil)
+			if required != tt.wantRequired {
+				t.Fatalf("Unexpected workaroud required result\nwant: %t\ngot: %t", tt.wantRequired, required)
+			}
+
+		})
+	}
+}
diff --git a/pkg/portal/kubeconfig/kubeconfig_test.go b/pkg/portal/kubeconfig/kubeconfig_test.go
index 64ee04ef2..782f291b3 100644
--- a/pkg/portal/kubeconfig/kubeconfig_test.go
+++ b/pkg/portal/kubeconfig/kubeconfig_test.go
@@ -12,6 +12,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 	"github.com/gorilla/mux"
 
@@ -19,7 +20,6 @@ import (
 	"github.com/Azure/ARO-RP/pkg/database/cosmosdb"
 	"github.com/Azure/ARO-RP/pkg/portal/middleware"
 	"github.com/Azure/ARO-RP/pkg/portal/util/responsewriter"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	testdatabase "github.com/Azure/ARO-RP/test/database"
 	testlog "github.com/Azure/ARO-RP/test/util/log"
@@ -139,7 +139,7 @@ func TestNew(t *testing.T) {
 			defer ctrl.Finish()
 
 			_env := mock_env.NewMockInterface(ctrl)
-			_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+			_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 			_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 			_env.EXPECT().Location().AnyTimes().Return("eastus")
 
diff --git a/pkg/portal/kubeconfig/proxy_test.go b/pkg/portal/kubeconfig/proxy_test.go
index bdab6089f..b19f7c71e 100644
--- a/pkg/portal/kubeconfig/proxy_test.go
+++ b/pkg/portal/kubeconfig/proxy_test.go
@@ -15,6 +15,7 @@ import (
 	"net/http/httputil"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 	"github.com/gorilla/mux"
 	clientcmdv1 "k8s.io/client-go/tools/clientcmd/api/v1"
@@ -22,7 +23,6 @@ import (
 	"github.com/Azure/ARO-RP/pkg/api"
 	"github.com/Azure/ARO-RP/pkg/database/cosmosdb"
 	"github.com/Azure/ARO-RP/pkg/portal/util/responsewriter"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	mock_proxy "github.com/Azure/ARO-RP/pkg/util/mocks/proxy"
 	utiltls "github.com/Azure/ARO-RP/pkg/util/tls"
@@ -384,7 +384,7 @@ func TestProxy(t *testing.T) {
 			defer ctrl.Finish()
 
 			_env := mock_env.NewMockInterface(ctrl)
-			_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+			_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 			_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 			_env.EXPECT().Location().AnyTimes().Return("eastus")
 
diff --git a/pkg/portal/middleware/aad_test.go b/pkg/portal/middleware/aad_test.go
index 78cbec76b..a62212e20 100644
--- a/pkg/portal/middleware/aad_test.go
+++ b/pkg/portal/middleware/aad_test.go
@@ -17,6 +17,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/form3tech-oss/jwt-go"
 	"github.com/go-test/deep"
 	"github.com/gofrs/uuid"
@@ -25,7 +26,6 @@ import (
 	"github.com/gorilla/securecookie"
 	"golang.org/x/oauth2"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	"github.com/Azure/ARO-RP/pkg/util/oidc"
 	"github.com/Azure/ARO-RP/pkg/util/roundtripper"
@@ -828,7 +828,7 @@ func TestClientAssertion(t *testing.T) {
 	controller := gomock.NewController(t)
 	defer controller.Finish()
 	env := mock_env.NewMockInterface(controller)
-	env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+	env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 	env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
 	env.EXPECT().TenantID().AnyTimes().Return("")
 
diff --git a/pkg/portal/middleware/log_test.go b/pkg/portal/middleware/log_test.go
index 41f7b7600..153ace4e7 100644
--- a/pkg/portal/middleware/log_test.go
+++ b/pkg/portal/middleware/log_test.go
@@ -13,12 +13,12 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 	"github.com/onsi/gomega"
 	"github.com/onsi/gomega/types"
 	"github.com/sirupsen/logrus"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/log/audit"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	testlog "github.com/Azure/ARO-RP/test/util/log"
@@ -31,7 +31,7 @@ func TestLog(t *testing.T) {
 	controller := gomock.NewController(t)
 	defer controller.Finish()
 	_env := mock_env.NewMockInterface(controller)
-	_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+	_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 	_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 	_env.EXPECT().Location().AnyTimes().Return("eastus")
 
diff --git a/pkg/portal/security_test.go b/pkg/portal/security_test.go
index 6f5c9984a..f93fffc1b 100644
--- a/pkg/portal/security_test.go
+++ b/pkg/portal/security_test.go
@@ -15,6 +15,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 	"github.com/golangci/golangci-lint/pkg/sliceutil"
 	"github.com/gorilla/securecookie"
@@ -22,7 +23,6 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/Azure/ARO-RP/pkg/portal/middleware"
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/log/audit"
 	mock_env "github.com/Azure/ARO-RP/pkg/util/mocks/env"
 	utiltls "github.com/Azure/ARO-RP/pkg/util/tls"
@@ -51,7 +51,7 @@ func TestSecurity(t *testing.T) {
 	_env.EXPECT().IsLocalDevelopmentMode().AnyTimes().Return(false)
 	_env.EXPECT().Location().AnyTimes().Return("eastus")
 	_env.EXPECT().TenantID().AnyTimes().Return("00000000-0000-0000-0000-000000000001")
-	_env.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+	_env.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 	_env.EXPECT().Hostname().AnyTimes().Return("testhost")
 
 	l := listener.NewListener()
@@ -351,12 +351,7 @@ func TestSecurity(t *testing.T) {
 				// [2] https://go.googlesource.com/go/+/go1.16.2/src/net/http/fs.go#337
 				if tt.name == "/" || tt.name == "/main.js" {
 					err = testpoller.Poll(1*time.Second, 5*time.Millisecond, func() (bool, error) {
-						if len(auditHook.AllEntries()) == 1 {
-							if _, ok := auditHook.AllEntries()[0].Data[audit.MetadataPayload]; ok {
-								return true, nil
-							}
-						}
-						return false, nil
+						return len(auditHook.AllEntries()) == 1, nil
 					})
 					if err != nil {
 						t.Error(err)
@@ -427,10 +422,10 @@ func auditPayloadFixture() *audit.Payload {
 		EnvName:              audit.IFXAuditName,
 		EnvFlags:             257,
 		EnvAppID:             audit.SourceAdminPortal,
-		EnvCloudName:         azureclient.PublicCloud.Name,
+		EnvCloudName:         azure.PublicCloud.Name,
 		EnvCloudRole:         audit.CloudRoleRP,
 		EnvCloudRoleInstance: "testhost",
-		EnvCloudEnvironment:  azureclient.PublicCloud.Name,
+		EnvCloudEnvironment:  azure.PublicCloud.Name,
 		EnvCloudLocation:     "eastus",
 		EnvCloudVer:          1,
 		CallerIdentities: []audit.CallerIdentity{
diff --git a/pkg/util/clientauthorizer/arm_test.go b/pkg/util/clientauthorizer/arm_test.go
index 7045cd9db..bb5e8e4bc 100644
--- a/pkg/util/clientauthorizer/arm_test.go
+++ b/pkg/util/clientauthorizer/arm_test.go
@@ -14,9 +14,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	mock_instancemetadata "github.com/Azure/ARO-RP/pkg/util/mocks/instancemetadata"
 )
 
@@ -118,7 +118,7 @@ func TestARMRefreshOnce(t *testing.T) {
 			defer controller.Finish()
 
 			im := mock_instancemetadata.NewMockInstanceMetadata(controller)
-			im.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+			im.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 
 			a := &arm{
 				now: func() time.Time { return time.Date(2020, 1, 20, 0, 0, 0, 0, time.UTC) },
@@ -278,7 +278,7 @@ func TestARMIsAuthorized(t *testing.T) {
 			defer controller.Finish()
 
 			im := mock_instancemetadata.NewMockInstanceMetadata(controller)
-			im.EXPECT().Environment().AnyTimes().Return(&azureclient.PublicCloud)
+			im.EXPECT().Environment().AnyTimes().Return(&azure.PublicCloud)
 
 			a := &arm{
 				im: im,
diff --git a/pkg/util/dns/dns_test.go b/pkg/util/dns/dns_test.go
index f6caa5f31..8e63fe3a8 100644
--- a/pkg/util/dns/dns_test.go
+++ b/pkg/util/dns/dns_test.go
@@ -536,6 +536,12 @@ func TestDelete(t *testing.T) {
 }
 
 func TestManagedDomain(t *testing.T) {
+	controller := gomock.NewController(t)
+	defer controller.Finish()
+
+	env := mock_env.NewMockInterface(controller)
+	env.EXPECT().Domain().AnyTimes().Return("eastus.aroapp.io")
+
 	for _, tt := range []struct {
 		domain  string
 		want    string
@@ -575,12 +581,6 @@ func TestManagedDomain(t *testing.T) {
 		},
 	} {
 		t.Run(tt.domain, func(t *testing.T) {
-			controller := gomock.NewController(t)
-			defer controller.Finish()
-
-			env := mock_env.NewMockInterface(controller)
-			env.EXPECT().Domain().AnyTimes().Return("eastus.aroapp.io")
-
 			got, err := ManagedDomain(env, tt.domain)
 			if got != tt.want {
 				t.Error(got)
diff --git a/pkg/util/instancemetadata/prod_test.go b/pkg/util/instancemetadata/prod_test.go
index ef87b71f1..28dc0414f 100644
--- a/pkg/util/instancemetadata/prod_test.go
+++ b/pkg/util/instancemetadata/prod_test.go
@@ -14,9 +14,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/golang/mock/gomock"
 
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	mock_instancemetadata "github.com/Azure/ARO-RP/pkg/util/mocks/instancemetadata"
 )
 
@@ -27,7 +27,7 @@ func TestPopulateInstanceMetadata(t *testing.T) {
 		wantSubscriptionID string
 		wantLocation       string
 		wantResourceGroup  string
-		wantEnvironment    *azureclient.AROEnvironment
+		wantEnvironment    *azure.Environment
 		wantErr            string
 	}{
 		{
@@ -51,7 +51,7 @@ func TestPopulateInstanceMetadata(t *testing.T) {
 			wantSubscriptionID: "rpSubscriptionId",
 			wantLocation:       "eastus",
 			wantResourceGroup:  "rpResourceGroup",
-			wantEnvironment:    &azureclient.PublicCloud,
+			wantEnvironment:    &azure.PublicCloud,
 		},
 		{
 			name: "valid (US Government Cloud)",
@@ -74,7 +74,7 @@ func TestPopulateInstanceMetadata(t *testing.T) {
 			wantSubscriptionID: "rpSubscriptionId",
 			wantLocation:       "eastus",
 			wantResourceGroup:  "rpResourceGroup",
-			wantEnvironment:    &azureclient.USGovernmentCloud,
+			wantEnvironment:    &azure.USGovernmentCloud,
 		},
 		{
 			name: "invalid JSON",
@@ -222,13 +222,13 @@ func TestPopulateTenantIDFromMSI(t *testing.T) {
 					if msiEndpoint != "http://169.254.169.254/metadata/identity/oauth2/token" {
 						return nil, fmt.Errorf("unexpected endpoint %q", msiEndpoint)
 					}
-					if resource != azureclient.PublicCloud.ResourceManagerEndpoint {
+					if resource != azure.PublicCloud.ResourceManagerEndpoint {
 						return nil, fmt.Errorf("unexpected resource %q", resource)
 					}
 					return token, nil
 				},
 				instanceMetadata: instanceMetadata{
-					environment: &azureclient.PublicCloud,
+					environment: &azure.PublicCloud,
 				},
 			}
 
diff --git a/pkg/util/instancemetadata/prodfromenv_test.go b/pkg/util/instancemetadata/prodfromenv_test.go
index 14f3146f6..cb6119d41 100644
--- a/pkg/util/instancemetadata/prodfromenv_test.go
+++ b/pkg/util/instancemetadata/prodfromenv_test.go
@@ -8,9 +8,8 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/google/go-cmp/cmp"
-
-	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
 func TestProdEnvPopulateInstanceMetadata(t *testing.T) {
@@ -32,14 +31,14 @@ func TestProdEnvPopulateInstanceMetadata(t *testing.T) {
 		{
 			name: "valid environment variables",
 			environment: map[string]string{
-				"AZURE_ENVIRONMENT":     azureclient.PublicCloud.Name,
+				"AZURE_ENVIRONMENT":     azure.PublicCloud.Name,
 				"AZURE_SUBSCRIPTION_ID": "some-sub-guid",
 				"AZURE_TENANT_ID":       "some-tenant-guid",
 				"LOCATION":              "some-region",
 				"RESOURCEGROUP":         "my-resourceGroup",
 			},
 			wantInstanceMetadata: instanceMetadata{
-				environment:    &azureclient.PublicCloud,
+				environment:    &azure.PublicCloud,
 				subscriptionID: "some-sub-guid",
 				tenantID:       "some-tenant-guid",
 				location:       "some-region",
@@ -56,12 +55,12 @@ func TestProdEnvPopulateInstanceMetadata(t *testing.T) {
 				"LOCATION":              "some-region",
 				"RESOURCEGROUP":         "my-resourceGroup",
 			},
-			wantErr: "cloud environment \"ThisEnvDoesNotExist\" is unsupported by ARO",
+			wantErr: "autorest/azure: There is no cloud environment matching the name \"THISENVDOESNOTEXIST\"",
 		},
 		{
 			name: "valid environment variables with hostname override",
 			environment: map[string]string{
-				"AZURE_ENVIRONMENT":     azureclient.PublicCloud.Name,
+				"AZURE_ENVIRONMENT":     azure.PublicCloud.Name,
 				"AZURE_SUBSCRIPTION_ID": "some-sub-guid",
 				"AZURE_TENANT_ID":       "some-tenant-guid",
 				"LOCATION":              "some-region",
@@ -69,7 +68,7 @@ func TestProdEnvPopulateInstanceMetadata(t *testing.T) {
 				"HOSTNAME_OVERRIDE":     "my.over.ride",
 			},
 			wantInstanceMetadata: instanceMetadata{
-				environment:    &azureclient.PublicCloud,
+				environment:    &azure.PublicCloud,
 				subscriptionID: "some-sub-guid",
 				tenantID:       "some-tenant-guid",
 				location:       "some-region",
diff --git a/test/e2e/adminapi_cluster_get.go b/test/e2e/adminapi_cluster_get.go
index 8306173c0..49da92559 100644
--- a/test/e2e/adminapi_cluster_get.go
+++ b/test/e2e/adminapi_cluster_get.go
@@ -27,6 +27,5 @@ var _ = Describe("[Admin API] Get cluster action", func() {
 		// Note: some fields will have empty values
 		// on successfully provisioned cluster (oc.Properties.Install, for example)
 		Expect(oc.Properties.StorageSuffix).ToNot(BeEmpty())
-		Expect(oc.Properties.InfraID).ToNot(BeEmpty())
 	})
 })
diff --git a/test/e2e/get.go b/test/e2e/get.go
index c2db32314..95dfa82af 100644
--- a/test/e2e/get.go
+++ b/test/e2e/get.go
@@ -8,6 +8,8 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
+	mgmtredhatopenshift20200430 "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2020-04-30/redhatopenshift"
 )
 
 var _ = Describe("Get cluster", func() {
@@ -21,6 +23,7 @@ var _ = Describe("Get cluster", func() {
 		Expect(*oc.IngressProfiles).To(HaveLen(1))
 		ingressProfile := (*oc.IngressProfiles)[0]
 		Expect(*ingressProfile.Name).To(Equal("default"))
+		Expect(ingressProfile.Visibility).To(Equal(mgmtredhatopenshift20200430.Visibility1Private))
 		Expect(ingressProfile.IP).NotTo(BeNil())
 
 		// Check we retrieve Cluster version
diff --git a/test/e2e/operator.go b/test/e2e/operator.go
index f636bf396..5add00407 100644
--- a/test/e2e/operator.go
+++ b/test/e2e/operator.go
@@ -21,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/util/retry"
 
+	"github.com/Azure/ARO-RP/pkg/api"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/monitoring"
 	"github.com/Azure/ARO-RP/pkg/util/ready"
@@ -176,6 +177,74 @@ var _ = Describe("ARO Operator - Geneva Logging", func() {
 	})
 })
 
+var _ = Describe("ARO Operator - Routefix Daemonset", func() {
+	// remove this once the change where the operator manages the routefix
+	// daemonset is in production
+	Specify("routefix DaemonSet must be Ready", func() {
+		dsReady := func() (bool, error) {
+			done, err := ready.CheckDaemonSetIsReady(context.Background(), clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix"), "routefix")()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+	})
+	Specify("routefix Pods must all be Running before testing DaemonSet deletion", func() {
+		dsReady := func() (bool, error) {
+			clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix")
+			done, err := ready.CheckPodsAreRunning(context.Background(), clients.Kubernetes.CoreV1().Pods("openshift-azure-routefix"), map[string]string{"app": "routefix"})()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+	})
+	Specify("routefix must be repaired if DaemonSet is deleted", func() {
+		dsReady := func() (bool, error) {
+			done, err := ready.CheckDaemonSetIsReady(context.Background(), clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix"), "routefix")()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+		// delete the routefix daemonset
+		err = clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix").Delete(context.Background(), "routefix", metav1.DeleteOptions{})
+		Expect(err).NotTo(HaveOccurred())
+
+		// wait for it to be fixed
+		err = wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+		_, err = clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix").Get(context.Background(), "routefix", metav1.GetOptions{})
+		Expect(err).NotTo(HaveOccurred())
+	})
+	Specify("routefix Pods must all be Running after testing DaemonSet deletion", func() {
+		dsReady := func() (bool, error) {
+			clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix")
+			done, err := ready.CheckPodsAreRunning(context.Background(), clients.Kubernetes.CoreV1().Pods("openshift-azure-routefix"), map[string]string{"app": "routefix"})()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+	})
+})
+
 var _ = Describe("ARO Operator - Cluster Monitoring ConfigMap", func() {
 	Specify("cluster monitoring configmap should not have persistent volume config", func() {
 		var cm *corev1.ConfigMap
@@ -200,10 +269,8 @@ var _ = Describe("ARO Operator - Cluster Monitoring ConfigMap", func() {
 			log.Warn(err)
 		}
 
-		Expect(configData.PrometheusK8s.Retention).To(BeEmpty())
-		Expect(configData.PrometheusK8s.VolumeClaimTemplate).To(BeNil())
-		Expect(configData.AlertManagerMain.VolumeClaimTemplate).To(BeNil())
-
+		Expect(configData.PrometheusK8s.Retention).To(Equal(""))
+		Expect(configData.PrometheusK8s.VolumeClaimTemplate).To(Equal(struct{ api.MissingFields }{}))
 	})
 
 	Specify("cluster monitoring configmap should be restored if deleted", func() {