Repository: Azure/ARO-RP
Pull request #1585 (2021-07-07 12:13:07)

Unit test improvements
### What this PR does / why we need it:

* Moves gomock.NewController(t) call into subtests, where possible
* Adds missing t.Run(tt.name, ...) calls


### Test plan for issue:

Run unit tests in CI



Patch:
diff --git a/.sha256sum b/.sha256sum
index ff47d50c6..0a5334c47 100644
--- a/.sha256sum
+++ b/.sha256sum
@@ -1,2 +1,2 @@
 d2e11a7924d0cbb70672fb0dd6b1a387ccaec8b97a6968adf5a1516d325374eb  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2020-04-30/redhatopenshift.json
-bbdf867021e306b60677d1d6840e5059fe92f058f09e861a10e7c000d36868f9  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
+2f8edbcdc4b273f0102d3b0d0a02971a82e08457c0e37e50c1ac570542e1861d  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
diff --git a/Makefile b/Makefile
index 2a3300712..6db8e1ddc 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ build-portal:
 	cd portal && npm install && npm run build
 
 pyenv:
-	python3 -m venv pyenv
+	virtualenv --python=/usr/bin/python3 pyenv
 	. pyenv/bin/activate && \
 		pip install -U pip && \
 		pip install autopep8 azdev azure-mgmt-loganalytics==0.2.0 ruamel.yaml wheel && \
diff --git a/cmd/aro/operator.go b/cmd/aro/operator.go
index 04bad913a..8c118c112 100644
--- a/cmd/aro/operator.go
+++ b/cmd/aro/operator.go
@@ -124,7 +124,7 @@ func operator(ctx context.Context, log *logrus.Entry) error {
 		}
 		if err = (routefix.NewReconciler(
 			log.WithField("controller", controllers.RouteFixControllerName),
-			kubernetescli, securitycli, configcli, arocli, restConfig)).SetupWithManager(mgr); err != nil {
+			kubernetescli, securitycli, arocli, restConfig)).SetupWithManager(mgr); err != nil {
 			return fmt.Errorf("unable to create controller RouteFix: %v", err)
 		}
 		if err = (monitoring.NewReconciler(
diff --git a/go.mod b/go.mod
index f5384a994..a961c45bf 100644
--- a/go.mod
+++ b/go.mod
@@ -243,7 +243,7 @@ replace (
 	github.com/openshift/cluster-api-provider-libvirt => github.com/openshift/cluster-api-provider-libvirt v0.2.1-0.20210324200850-033be25ca038
 	github.com/openshift/cluster-api-provider-ovirt => github.com/openshift/cluster-api-provider-ovirt v0.1.1-0.20210409185359-01b9bf8368a3
 	github.com/openshift/console-operator => github.com/openshift/console-operator v0.0.0-20210323072657-4f933d59784b
-	github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+	github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 	github.com/openshift/library-go => github.com/openshift/library-go v0.0.0-20210205203934-9eb0d970f2f4
 	github.com/openshift/machine-api-operator => github.com/openshift/machine-api-operator v0.2.1-0.20210521181620-e179bb5ce397
 	github.com/openshift/machine-config-operator => github.com/openshift/machine-config-operator v0.0.1-0.20210522053223-c4b7e3f5118d
diff --git a/go.sum b/go.sum
index 82644594a..200238e8b 100644
--- a/go.sum
+++ b/go.sum
@@ -831,7 +831,6 @@ github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgO
 github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-ldap/ldap/v3 v3.1.3/go.mod h1:3rbOH3jRS2u6jg2rJnKAMLE/xQyCKIveG2Sa/Cohzb8=
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
-github.com/go-log/log v0.0.0-20181211034820-a514cf01a3eb/go.mod h1:4mBwpdRMFLiuXZDCwU2lKQFsoSCo72j3HqBK9d81N2M=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0 h1:TrB8swr/68K7m9CcGut2g3UOihhbcbiMAYiuTXdEih4=
@@ -1197,7 +1196,6 @@ github.com/gophercloud/gophercloud v0.6.0/go.mod h1:GICNByuaEBibcjmjvI7QvYJSZEbG
 github.com/gophercloud/gophercloud v0.6.1-0.20191122030953-d8ac278c1c9d/go.mod h1:ozGNgr9KYOVATV5jsgHl/ceCDXGuguqOZAzoQ/2vcNM=
 github.com/gophercloud/gophercloud v0.10.1-0.20200424014253-c3bfe50899e5/go.mod h1:gmC5oQqMDOMO1t1gq5DquX/yAU808e/4mzjjDA76+Ss=
 github.com/gophercloud/gophercloud v0.12.0/go.mod h1:gmC5oQqMDOMO1t1gq5DquX/yAU808e/4mzjjDA76+Ss=
-github.com/gophercloud/gophercloud v0.12.1-0.20200827191144-bb4781e9de45/go.mod h1:w2NJEd88d4igNL1KUHzBsKMvS/ByJTzgltTGWKT7AC8=
 github.com/gophercloud/gophercloud v0.14.0/go.mod h1:VX0Ibx85B60B5XOrZr6kaNwrmPUzcmMpwxvQ1WQIIWM=
 github.com/gophercloud/gophercloud v0.15.1-0.20210202035223-633d73521055 h1:/wFA5WAzWcHNjpUs/Vuf4g2Sbv0wj3MUkZdeYgU4RkI=
 github.com/gophercloud/gophercloud v0.15.1-0.20210202035223-633d73521055/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075O6i+LY+pXsKCBsb4=
@@ -1208,8 +1206,6 @@ github.com/gophercloud/gophercloud v0.17.0/go.mod h1:wRtmUelyIIv3CSSDI47aUwbs075
 github.com/gophercloud/utils v0.0.0-20190128072930-fbb6ab446f01/go.mod h1:wjDF8z83zTeg5eMLml5EBSlAhbF7G8DobyI1YsMuyzw=
 github.com/gophercloud/utils v0.0.0-20190313033024-0bcc8e728cb5/go.mod h1:SZ9FTKibIotDtCrxAU/evccoyu1yhKST6hgBvwTB5Eg=
 github.com/gophercloud/utils v0.0.0-20200423144003-7c72efc7435d/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
-github.com/gophercloud/utils v0.0.0-20201101202656-8677e053dcf1/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
-github.com/gophercloud/utils v0.0.0-20201212031956-9dc30e126fea/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
 github.com/gophercloud/utils v0.0.0-20201221031838-d93cf4b3fa50/go.mod h1:ehWUbLQJPqS0Ep+CxeD559hsm9pthPXadJNKwZkp43w=
 github.com/gophercloud/utils v0.0.0-20210202040619-eca783186fc4/go.mod h1:wx8HMD8oQD0Ryhz6+6ykq75PJ79iPyEqYHfwZ4l7OsA=
 github.com/gophercloud/utils v0.0.0-20210323225332-7b186010c04f h1:+SO5iEqu9QjNWL9TfAmOE5u0Uizv1T3jpBuMJfMOVJ0=
@@ -1677,8 +1673,6 @@ github.com/lucas-clemente/quic-go-certificates v0.0.0-20160823095156-d2f86524cce
 github.com/lunixbochs/vtclean v0.0.0-20180621232353-2d01aacdc34a/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/lusis/go-artifactory v0.0.0-20160115162124-7e4ce345df82/go.mod h1:y54tfGmO3NKssKveTEFFzH8C/akrSOy/iW9qEAUDV84=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
-github.com/m1kola/installer v0.9.0-master.0.20210630161242-27df43e9d740 h1:8zCYpBox/rp3xPl5VPJd8F3GBbIv0azl3UpbjzDdD7Q=
-github.com/m1kola/installer v0.9.0-master.0.20210630161242-27df43e9d740/go.mod h1:zpOMUCsYL2u6M2QWWfEXeP15GAgxA7zREDQidMVlb6g=
 github.com/magiconair/properties v1.7.6/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
@@ -1826,11 +1820,8 @@ github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mjudeikis/go-cosmosdb v0.0.0-20210518104404-b205b3cefd36 h1:K0yb4fqa1rYPEbdlv3rYz0vh1aHK0Jkd+EscS1Yi5wI=
 github.com/mjudeikis/go-cosmosdb v0.0.0-20210518104404-b205b3cefd36/go.mod h1:l/LMyUQzbW3Pe62a6huel6S/5ED0KrkkqSQdwiGueUI=
-github.com/mjudeikis/installer v0.9.0-master.0.20210429223823-8452b42b403f/go.mod h1:XopVolWA5M92yeZlj7+QLXyKMXKdU0mCUz3B/QiaMqk=
 github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a h1:CUatJN+U9y8AGqzfbvjQcnPKiJaK5gCZEIYpMqZr3/8=
 github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a/go.mod h1:wRAY/doOkyi+sihbkl88EAMg11+3ZvPPBpGqI7iPVq0=
-github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f h1:YFwFCTJ00yKhwCvBXcLEPMMSnrYCxGn2AIQFUORFVtQ=
-github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f/go.mod h1:2NZuOXMJqLgSEHtluChgLLWrZ3QcAVLKPfNYAClFEQk=
 github.com/moby/ipvs v1.0.1/go.mod h1:2pngiyseZbIKXNv7hsKj3O9UEz30c53MT9005gt2hxQ=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/sys/mountinfo v0.1.3/go.mod h1:w2t2Avltqx8vE7gX5l+QiBKxODu2TX0+Syr3h52Tw4o=
@@ -1992,7 +1983,6 @@ github.com/openshift/client-go v0.0.0-20210112165513-ebc401615f47 h1:+TEY29DK0Xh
 github.com/openshift/client-go v0.0.0-20210112165513-ebc401615f47/go.mod h1:u7NRAjtYVAKokiI9LouzTv4mhds8P4S1TwdVAfbjKSk=
 github.com/openshift/cloud-credential-operator v0.0.0-20200316201045-d10080b52c9e h1:2gyl9UVyjHSWzdS56KUXxQwIhENbq2x2olqoMQSA/C8=
 github.com/openshift/cloud-credential-operator v0.0.0-20200316201045-d10080b52c9e/go.mod h1:iPn+uhIe7nkP5BMHe2QnbLtg5m/AIQ1xvz9s3cig5ss=
-github.com/openshift/cluster-api v0.0.0-20191030113141-9a3a7bbe9258/go.mod h1:T18COkr6nLh9RyZKPMP7YjnwBME7RX8P2ar1SQbBltM=
 github.com/openshift/cluster-api-provider-aws v0.2.1-0.20210521181620-82202163e220 h1:1IlB0rbC2/+p7NThPKZLZflRdjgFXKI6RO4/8MkSXjE=
 github.com/openshift/cluster-api-provider-aws v0.2.1-0.20210521181620-82202163e220/go.mod h1:Cgv+fW4yIs1jmMu1c/tMB+OqUYufTEHtMxNW1bqIY+Q=
 github.com/openshift/cluster-api-provider-azure v0.1.0-alpha.3.0.20210318155632-e744815d9f05 h1:CAeRddO33GB66NNlS5jhlogu8BQOpKRkmJn6KDjufA0=
@@ -2156,7 +2146,6 @@ github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7q
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20190104105734-b1c43a6df3ae/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.1.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -2389,7 +2378,6 @@ github.com/tdakkota/asciicheck v0.0.0-20200416200610-e657995f937b h1:HxLVTlqcHhF
 github.com/tdakkota/asciicheck v0.0.0-20200416200610-e657995f937b/go.mod h1:yHp0ai0Z9gUljN3o0xMhYJnH/IcvkdTBOX2fmJ93JEM=
 github.com/tencentcloud/tencentcloud-sdk-go v3.0.82+incompatible/go.mod h1:0PfYow01SHPMhKY31xa+EFz2RStxIqj6JFAJS+IkCi4=
 github.com/tencentyun/cos-go-sdk-v5 v0.0.0-20190808065407-f07404cefc8c/go.mod h1:wk2XFUg6egk4tSDNZtXeKfe2G6690UVyt163PuUxBZk=
-github.com/terraform-provider-openstack/terraform-provider-openstack v1.33.0/go.mod h1:NA2Iaq+p8yIzeHAY9DHEedL/SqrT0AInYP9GTqVLe1k=
 github.com/terraform-provider-openstack/terraform-provider-openstack v1.37.0/go.mod h1:tPCEc/DdR9fVX9rmcJiqa85oTG7BUb5Xc0bSY/aOTf8=
 github.com/terraform-providers/terraform-provider-azuread v0.9.0/go.mod h1:sSDzB/8CD639+yWo5lZf+NJvGSYQBSS6z+GoET9IrzE=
 github.com/terraform-providers/terraform-provider-google v1.20.1-0.20200623174414-27107f2ee160/go.mod h1:QxehqxV8Swl+O2JXJUdS6orHYJXWUEr4HFfYH5JV9ew=
@@ -2731,7 +2719,6 @@ golang.org/x/net v0.0.0-20190619014844-b5b0513f8c1b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -3112,7 +3099,6 @@ google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20200911024640-645f7a48b24f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -3327,7 +3313,6 @@ k8s.io/system-validators v1.1.2/go.mod h1:bPldcLgkIUK22ALflnsXk8pvkTEndYdNuaHH6g
 k8s.io/utils v0.0.0-20190308190857-21c4ce38f2a7/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
 k8s.io/utils v0.0.0-20190712204705-3dccf664f023/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20190801114015-581e00157fb1/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
-k8s.io/utils v0.0.0-20190923111123-69764acb6e8e/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20191114200735-6ca3b61696b6/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20200411171748-3d5a2fe318e4/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20200414100711-2df71ebbae66/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
diff --git a/pkg/api/admin/openshiftcluster.go b/pkg/api/admin/openshiftcluster.go
index b72bf14d4..94138aabc 100644
--- a/pkg/api/admin/openshiftcluster.go
+++ b/pkg/api/admin/openshiftcluster.go
@@ -92,10 +92,8 @@ type NetworkProfile struct {
 
 // MasterProfile represents a master profile.
 type MasterProfile struct {
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	VMSize   VMSize `json:"vmSize,omitempty"`
+	SubnetID string `json:"subnetId,omitempty"`
 }
 
 // VMSize represents a VM size.
@@ -135,13 +133,11 @@ const (
 
 // WorkerProfile represents a worker profile.
 type WorkerProfile struct {
-	Name                string `json:"name,omitempty"`
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	DiskSizeGB          int    `json:"diskSizeGB,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	Count               int    `json:"count,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	Name       string `json:"name,omitempty"`
+	VMSize     VMSize `json:"vmSize,omitempty"`
+	DiskSizeGB int    `json:"diskSizeGB,omitempty"`
+	SubnetID   string `json:"subnetId,omitempty"`
+	Count      int    `json:"count,omitempty"`
 }
 
 // APIServerProfile represents an API server profile.
diff --git a/pkg/api/admin/openshiftcluster_convert.go b/pkg/api/admin/openshiftcluster_convert.go
index 30d109029..26f24b924 100644
--- a/pkg/api/admin/openshiftcluster_convert.go
+++ b/pkg/api/admin/openshiftcluster_convert.go
@@ -46,10 +46,8 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 				APIServerPrivateEndpointIP: oc.Properties.NetworkProfile.APIServerPrivateEndpointIP,
 			},
 			MasterProfile: MasterProfile{
-				VMSize:              VMSize(oc.Properties.MasterProfile.VMSize),
-				SubnetID:            oc.Properties.MasterProfile.SubnetID,
-				EncryptionAtHost:    oc.Properties.MasterProfile.EncryptionAtHost,
-				DiskEncryptionSetID: oc.Properties.MasterProfile.DiskEncryptionSetID,
+				VMSize:   VMSize(oc.Properties.MasterProfile.VMSize),
+				SubnetID: oc.Properties.MasterProfile.SubnetID,
 			},
 			APIServerProfile: APIServerProfile{
 				Visibility: Visibility(oc.Properties.APIServerProfile.Visibility),
@@ -66,13 +64,11 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 		out.Properties.WorkerProfiles = make([]WorkerProfile, 0, len(oc.Properties.WorkerProfiles))
 		for _, p := range oc.Properties.WorkerProfiles {
 			out.Properties.WorkerProfiles = append(out.Properties.WorkerProfiles, WorkerProfile{
-				Name:                p.Name,
-				VMSize:              VMSize(p.VMSize),
-				DiskSizeGB:          p.DiskSizeGB,
-				SubnetID:            p.SubnetID,
-				Count:               p.Count,
-				EncryptionAtHost:    p.EncryptionAtHost,
-				DiskEncryptionSetID: p.DiskEncryptionSetID,
+				Name:       p.Name,
+				VMSize:     VMSize(p.VMSize),
+				DiskSizeGB: p.DiskSizeGB,
+				SubnetID:   p.SubnetID,
+				Count:      p.Count,
 			})
 		}
 	}
@@ -174,8 +170,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 	out.Properties.NetworkProfile.APIServerPrivateEndpointIP = oc.Properties.NetworkProfile.APIServerPrivateEndpointIP
 	out.Properties.MasterProfile.VMSize = api.VMSize(oc.Properties.MasterProfile.VMSize)
 	out.Properties.MasterProfile.SubnetID = oc.Properties.MasterProfile.SubnetID
-	out.Properties.MasterProfile.EncryptionAtHost = oc.Properties.MasterProfile.EncryptionAtHost
-	out.Properties.MasterProfile.DiskEncryptionSetID = oc.Properties.MasterProfile.DiskEncryptionSetID
 	out.Properties.StorageSuffix = oc.Properties.StorageSuffix
 	out.Properties.WorkerProfiles = nil
 	if oc.Properties.WorkerProfiles != nil {
@@ -186,8 +180,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 			out.Properties.WorkerProfiles[i].DiskSizeGB = oc.Properties.WorkerProfiles[i].DiskSizeGB
 			out.Properties.WorkerProfiles[i].SubnetID = oc.Properties.WorkerProfiles[i].SubnetID
 			out.Properties.WorkerProfiles[i].Count = oc.Properties.WorkerProfiles[i].Count
-			out.Properties.WorkerProfiles[i].EncryptionAtHost = oc.Properties.WorkerProfiles[i].EncryptionAtHost
-			out.Properties.WorkerProfiles[i].DiskEncryptionSetID = oc.Properties.WorkerProfiles[i].DiskEncryptionSetID
 		}
 	}
 	out.Properties.APIServerProfile.Visibility = api.Visibility(oc.Properties.APIServerProfile.Visibility)
diff --git a/pkg/api/openshiftcluster.go b/pkg/api/openshiftcluster.go
index bea941228..50b1ecdb8 100644
--- a/pkg/api/openshiftcluster.go
+++ b/pkg/api/openshiftcluster.go
@@ -206,10 +206,8 @@ type NetworkProfile struct {
 type MasterProfile struct {
 	MissingFields
 
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	VMSize   VMSize `json:"vmSize,omitempty"`
+	SubnetID string `json:"subnetId,omitempty"`
 }
 
 // VMSize represents a VM size
@@ -252,13 +250,11 @@ const (
 type WorkerProfile struct {
 	MissingFields
 
-	Name                string `json:"name,omitempty"`
-	VMSize              VMSize `json:"vmSize,omitempty"`
-	DiskSizeGB          int    `json:"diskSizeGB,omitempty"`
-	SubnetID            string `json:"subnetId,omitempty"`
-	Count               int    `json:"count,omitempty"`
-	EncryptionAtHost    bool   `json:"encryptionAtHost,omitempty"`
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
+	Name       string `json:"name,omitempty"`
+	VMSize     VMSize `json:"vmSize,omitempty"`
+	DiskSizeGB int    `json:"diskSizeGB,omitempty"`
+	SubnetID   string `json:"subnetId,omitempty"`
+	Count      int    `json:"count,omitempty"`
 }
 
 // APIServerProfile represents an API server profile
diff --git a/pkg/api/v20210131preview/openshiftcluster.go b/pkg/api/v20210131preview/openshiftcluster.go
index d471c4550..b74e4d61c 100644
--- a/pkg/api/v20210131preview/openshiftcluster.go
+++ b/pkg/api/v20210131preview/openshiftcluster.go
@@ -130,12 +130,6 @@ type MasterProfile struct {
 
 	// The Azure resource ID of the master subnet.
 	SubnetID string `json:"subnetId,omitempty"`
-
-	// Whether master virtual machines are encrypted at host.
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
-	// The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // VMSize represents a VM size.
@@ -189,12 +183,6 @@ type WorkerProfile struct {
 
 	// The number of worker VMs.
 	Count int `json:"count,omitempty"`
-
-	// Whether master virtual machines are encrypted at host.
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
-	// The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // APIServerProfile represents an API server profile.
diff --git a/pkg/api/v20210131preview/openshiftcluster_convert.go b/pkg/api/v20210131preview/openshiftcluster_convert.go
index c2fdbdc82..2ada8178a 100644
--- a/pkg/api/v20210131preview/openshiftcluster_convert.go
+++ b/pkg/api/v20210131preview/openshiftcluster_convert.go
@@ -39,10 +39,8 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 				ServiceCIDR: oc.Properties.NetworkProfile.ServiceCIDR,
 			},
 			MasterProfile: MasterProfile{
-				VMSize:              VMSize(oc.Properties.MasterProfile.VMSize),
-				SubnetID:            oc.Properties.MasterProfile.SubnetID,
-				EncryptionAtHost:    oc.Properties.MasterProfile.EncryptionAtHost,
-				DiskEncryptionSetID: oc.Properties.MasterProfile.DiskEncryptionSetID,
+				VMSize:   VMSize(oc.Properties.MasterProfile.VMSize),
+				SubnetID: oc.Properties.MasterProfile.SubnetID,
 			},
 			APIServerProfile: APIServerProfile{
 				Visibility: Visibility(oc.Properties.APIServerProfile.Visibility),
@@ -56,13 +54,11 @@ func (c *openShiftClusterConverter) ToExternal(oc *api.OpenShiftCluster) interfa
 		out.Properties.WorkerProfiles = make([]WorkerProfile, 0, len(oc.Properties.WorkerProfiles))
 		for _, p := range oc.Properties.WorkerProfiles {
 			out.Properties.WorkerProfiles = append(out.Properties.WorkerProfiles, WorkerProfile{
-				Name:                p.Name,
-				VMSize:              VMSize(p.VMSize),
-				DiskSizeGB:          p.DiskSizeGB,
-				SubnetID:            p.SubnetID,
-				Count:               p.Count,
-				EncryptionAtHost:    p.EncryptionAtHost,
-				DiskEncryptionSetID: p.DiskEncryptionSetID,
+				Name:       p.Name,
+				VMSize:     VMSize(p.VMSize),
+				DiskSizeGB: p.DiskSizeGB,
+				SubnetID:   p.SubnetID,
+				Count:      p.Count,
 			})
 		}
 	}
@@ -142,8 +138,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 	out.Properties.NetworkProfile.ServiceCIDR = oc.Properties.NetworkProfile.ServiceCIDR
 	out.Properties.MasterProfile.VMSize = api.VMSize(oc.Properties.MasterProfile.VMSize)
 	out.Properties.MasterProfile.SubnetID = oc.Properties.MasterProfile.SubnetID
-	out.Properties.MasterProfile.EncryptionAtHost = oc.Properties.MasterProfile.EncryptionAtHost
-	out.Properties.MasterProfile.DiskEncryptionSetID = oc.Properties.MasterProfile.DiskEncryptionSetID
 	out.Properties.WorkerProfiles = nil
 	if oc.Properties.WorkerProfiles != nil {
 		out.Properties.WorkerProfiles = make([]api.WorkerProfile, len(oc.Properties.WorkerProfiles))
@@ -153,8 +147,6 @@ func (c *openShiftClusterConverter) ToInternal(_oc interface{}, out *api.OpenShi
 			out.Properties.WorkerProfiles[i].DiskSizeGB = oc.Properties.WorkerProfiles[i].DiskSizeGB
 			out.Properties.WorkerProfiles[i].SubnetID = oc.Properties.WorkerProfiles[i].SubnetID
 			out.Properties.WorkerProfiles[i].Count = oc.Properties.WorkerProfiles[i].Count
-			out.Properties.WorkerProfiles[i].EncryptionAtHost = oc.Properties.WorkerProfiles[i].EncryptionAtHost
-			out.Properties.WorkerProfiles[i].DiskEncryptionSetID = oc.Properties.WorkerProfiles[i].DiskEncryptionSetID
 		}
 	}
 	out.Properties.APIServerProfile.Visibility = api.Visibility(oc.Properties.APIServerProfile.Visibility)
diff --git a/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go b/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
index b1a2b85d9..5e16e6c1c 100644
--- a/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
+++ b/pkg/client/services/redhatopenshift/mgmt/2021-01-31-preview/redhatopenshift/models.go
@@ -124,10 +124,6 @@ type MasterProfile struct {
 	VMSize VMSize `json:"vmSize,omitempty"`
 	// SubnetID - The Azure resource ID of the master subnet.
 	SubnetID *string `json:"subnetId,omitempty"`
-	// EncryptionAtHost - Whether master virtual machines are encrypted at host.
-	EncryptionAtHost *bool `json:"encryptionAtHost,omitempty"`
-	// DiskEncryptionSetID - The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID *string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // NetworkProfile networkProfile represents a network profile.
@@ -899,8 +895,4 @@ type WorkerProfile struct {
 	SubnetID *string `json:"subnetId,omitempty"`
 	// Count - The number of worker VMs.
 	Count *int32 `json:"count,omitempty"`
-	// EncryptionAtHost - Whether master virtual machines are encrypted at host.
-	EncryptionAtHost *bool `json:"encryptionAtHost,omitempty"`
-	// DiskEncryptionSetID - The resource ID of an associated DiskEncryptionSet, if applicable.
-	DiskEncryptionSetID *string `json:"diskEncryptionSetId,omitempty"`
 }
diff --git a/pkg/cluster/delete.go b/pkg/cluster/delete.go
index c390e635d..d727e6c91 100644
--- a/pkg/cluster/delete.go
+++ b/pkg/cluster/delete.go
@@ -14,7 +14,6 @@ import (
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
 	"github.com/Azure/go-autorest/autorest/azure"
-	"github.com/davecgh/go-spew/spew"
 
 	"github.com/Azure/ARO-RP/pkg/api"
 	"github.com/Azure/ARO-RP/pkg/env"
@@ -266,7 +265,7 @@ func (m *manager) Delete(ctx context.Context) error {
 	rg, err := m.resourceGroups.Get(ctx, resourceGroup)
 	if err != nil {
 		m.log.Warnf("failed to get resourceGroup %s", err)
-	} else if !m.env.IsLocalDevelopmentMode() {
+	} else {
 		if rg.ManagedBy == nil || *rg.ManagedBy == "" || !strings.EqualFold(*rg.ManagedBy, m.doc.OpenShiftCluster.ID) {
 			rgManagedByARO = false
 			m.log.Infof("cluster resource group not managed by aro %s", *rg.Name)
@@ -307,11 +306,6 @@ func (m *manager) Delete(ctx context.Context) error {
 
 		m.log.Printf("deleting resource group %s", resourceGroup)
 		err = m.resourceGroups.DeleteAndWait(ctx, resourceGroup)
-		// TODO(mjudeikis): Remove this once we know all the error flavors this is
-		// returning so we can unify checks bellow
-		if err != nil {
-			m.log.Printf("delete resource group failed: %s", spew.Sdump(err))
-		}
 		if detailedErr, ok := err.(autorest.DetailedError); ok &&
 			(detailedErr.StatusCode == http.StatusForbidden || detailedErr.StatusCode == http.StatusNotFound) {
 			err = nil
@@ -319,9 +313,6 @@ func (m *manager) Delete(ctx context.Context) error {
 		if azureerrors.HasAuthorizationFailedError(err) {
 			err = nil
 		}
-		if azureerrors.ResourceGroupNotFound(err) {
-			err = nil
-		}
 		if err != nil {
 			return err
 		}
diff --git a/pkg/cluster/deployresources_resources.go b/pkg/cluster/deployresources_resources.go
index 36e7cb6f5..09b7c6fdb 100644
--- a/pkg/cluster/deployresources_resources.go
+++ b/pkg/cluster/deployresources_resources.go
@@ -87,69 +87,56 @@ func (m *manager) networkMasterNICs(installConfig *installconfig.InstallConfig)
 }
 
 func (m *manager) computeBootstrapVM(installConfig *installconfig.InstallConfig) *arm.Resource {
-	vm := &mgmtcompute.VirtualMachine{
-		VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
-			HardwareProfile: &mgmtcompute.HardwareProfile{
-				VMSize: mgmtcompute.VirtualMachineSizeTypesStandardD4sV3,
-			},
-			StorageProfile: &mgmtcompute.StorageProfile{
-				ImageReference: &mgmtcompute.ImageReference{
-					Publisher: &installConfig.Config.Azure.Image.Publisher,
-					Offer:     &installConfig.Config.Azure.Image.Offer,
-					Sku:       &installConfig.Config.Azure.Image.SKU,
-					Version:   &installConfig.Config.Azure.Image.Version,
+	return &arm.Resource{
+		Resource: &mgmtcompute.VirtualMachine{
+			VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
+				HardwareProfile: &mgmtcompute.HardwareProfile{
+					VMSize: mgmtcompute.VirtualMachineSizeTypesStandardD4sV3,
 				},
-				OsDisk: &mgmtcompute.OSDisk{
-					Name:         to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap_OSDisk"),
-					Caching:      mgmtcompute.CachingTypesReadWrite,
-					CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
-					DiskSizeGB:   to.Int32Ptr(100),
-					ManagedDisk: &mgmtcompute.ManagedDiskParameters{
-						StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+				StorageProfile: &mgmtcompute.StorageProfile{
+					ImageReference: &mgmtcompute.ImageReference{
+						Publisher: &installConfig.Config.Azure.Image.Publisher,
+						Offer:     &installConfig.Config.Azure.Image.Offer,
+						Sku:       &installConfig.Config.Azure.Image.SKU,
+						Version:   &installConfig.Config.Azure.Image.Version,
+					},
+					OsDisk: &mgmtcompute.OSDisk{
+						Name:         to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap_OSDisk"),
+						Caching:      mgmtcompute.CachingTypesReadWrite,
+						CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
+						DiskSizeGB:   to.Int32Ptr(100),
+						ManagedDisk: &mgmtcompute.ManagedDiskParameters{
+							StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+						},
 					},
 				},
-			},
-			OsProfile: &mgmtcompute.OSProfile{
-				ComputerName:  to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-vm"),
-				AdminUsername: to.StringPtr("core"),
-				AdminPassword: to.StringPtr("NotActuallyApplied!"),
-				CustomData:    to.StringPtr(`[base64(concat('{"ignition":{"version":"3.2.0","config":{"replace":{"source":"https://cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `.blob.` + m.env.Environment().StorageEndpointSuffix + `/ignition/bootstrap.ign?', listAccountSas(resourceId('Microsoft.Storage/storageAccounts', 'cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `'), '2019-04-01', parameters('sas')).accountSasToken, '"}}}}'))]`),
-				LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
-					DisablePasswordAuthentication: to.BoolPtr(false),
+				OsProfile: &mgmtcompute.OSProfile{
+					ComputerName:  to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-vm"),
+					AdminUsername: to.StringPtr("core"),
+					AdminPassword: to.StringPtr("NotActuallyApplied!"),
+					CustomData:    to.StringPtr(`[base64(concat('{"ignition":{"version":"3.2.0","config":{"replace":{"source":"https://cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `.blob.` + m.env.Environment().StorageEndpointSuffix + `/ignition/bootstrap.ign?', listAccountSas(resourceId('Microsoft.Storage/storageAccounts', 'cluster` + m.doc.OpenShiftCluster.Properties.StorageSuffix + `'), '2019-04-01', parameters('sas')).accountSasToken, '"}}}}'))]`),
+					LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
+						DisablePasswordAuthentication: to.BoolPtr(false),
+					},
 				},
-			},
-			NetworkProfile: &mgmtcompute.NetworkProfile{
-				NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
-					{
-						ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', '" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic')]"),
+				NetworkProfile: &mgmtcompute.NetworkProfile{
+					NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
+						{
+							ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', '" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic')]"),
+						},
 					},
 				},
-			},
-			DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
-				BootDiagnostics: &mgmtcompute.BootDiagnostics{
-					Enabled:    to.BoolPtr(true),
-					StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+				DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
+					BootDiagnostics: &mgmtcompute.BootDiagnostics{
+						Enabled:    to.BoolPtr(true),
+						StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+					},
 				},
 			},
+			Name:     to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap"),
+			Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
+			Location: &installConfig.Config.Azure.Region,
 		},
-		Name:     to.StringPtr(m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap"),
-		Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
-		Location: &installConfig.Config.Azure.Region,
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID != "" {
-		vm.StorageProfile.OsDisk.ManagedDisk.DiskEncryptionSet = &mgmtcompute.DiskEncryptionSetParameters{
-			ID: &installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID,
-		}
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost {
-		vm.SecurityProfile = &mgmtcompute.SecurityProfile{
-			EncryptionAtHost: &installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost,
-		}
-	}
-	return &arm.Resource{
-		Resource:   vm,
 		APIVersion: azureclient.APIVersion("Microsoft.Compute"),
 		DependsOn: []string{
 			"Microsoft.Network/networkInterfaces/" + m.doc.OpenShiftCluster.Properties.InfraID + "-bootstrap-nic",
@@ -158,71 +145,57 @@ func (m *manager) computeBootstrapVM(installConfig *installconfig.InstallConfig)
 }
 
 func (m *manager) computeMasterVMs(installConfig *installconfig.InstallConfig, zones *[]string, machineMaster *machine.Master) *arm.Resource {
-	vm := &mgmtcompute.VirtualMachine{
-		VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
-			HardwareProfile: &mgmtcompute.HardwareProfile{
-				VMSize: mgmtcompute.VirtualMachineSizeTypes(installConfig.Config.ControlPlane.Platform.Azure.InstanceType),
-			},
-			StorageProfile: &mgmtcompute.StorageProfile{
-				ImageReference: &mgmtcompute.ImageReference{
-					Publisher: &installConfig.Config.Azure.Image.Publisher,
-					Offer:     &installConfig.Config.Azure.Image.Offer,
-					Sku:       &installConfig.Config.Azure.Image.SKU,
-					Version:   &installConfig.Config.Azure.Image.Version,
+	return &arm.Resource{
+		Resource: &mgmtcompute.VirtualMachine{
+			VirtualMachineProperties: &mgmtcompute.VirtualMachineProperties{
+				HardwareProfile: &mgmtcompute.HardwareProfile{
+					VMSize: mgmtcompute.VirtualMachineSizeTypes(installConfig.Config.ControlPlane.Platform.Azure.InstanceType),
 				},
-				OsDisk: &mgmtcompute.OSDisk{
-					Name:         to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex(), '_OSDisk')]"),
-					Caching:      mgmtcompute.CachingTypesReadOnly,
-					CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
-					DiskSizeGB:   &installConfig.Config.ControlPlane.Platform.Azure.OSDisk.DiskSizeGB,
-					ManagedDisk: &mgmtcompute.ManagedDiskParameters{
-						StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+				StorageProfile: &mgmtcompute.StorageProfile{
+					ImageReference: &mgmtcompute.ImageReference{
+						Publisher: &installConfig.Config.Azure.Image.Publisher,
+						Offer:     &installConfig.Config.Azure.Image.Offer,
+						Sku:       &installConfig.Config.Azure.Image.SKU,
+						Version:   &installConfig.Config.Azure.Image.Version,
+					},
+					OsDisk: &mgmtcompute.OSDisk{
+						Name:         to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex(), '_OSDisk')]"),
+						Caching:      mgmtcompute.CachingTypesReadOnly,
+						CreateOption: mgmtcompute.DiskCreateOptionTypesFromImage,
+						DiskSizeGB:   &installConfig.Config.ControlPlane.Platform.Azure.OSDisk.DiskSizeGB,
+						ManagedDisk: &mgmtcompute.ManagedDiskParameters{
+							StorageAccountType: mgmtcompute.StorageAccountTypesPremiumLRS,
+						},
 					},
 				},
-			},
-			OsProfile: &mgmtcompute.OSProfile{
-				ComputerName:  to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
-				AdminUsername: to.StringPtr("core"),
-				AdminPassword: to.StringPtr("NotActuallyApplied!"),
-				CustomData:    to.StringPtr(base64.StdEncoding.EncodeToString(machineMaster.File.Data)),
-				LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
-					DisablePasswordAuthentication: to.BoolPtr(false),
+				OsProfile: &mgmtcompute.OSProfile{
+					ComputerName:  to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
+					AdminUsername: to.StringPtr("core"),
+					AdminPassword: to.StringPtr("NotActuallyApplied!"),
+					CustomData:    to.StringPtr(base64.StdEncoding.EncodeToString(machineMaster.File.Data)),
+					LinuxConfiguration: &mgmtcompute.LinuxConfiguration{
+						DisablePasswordAuthentication: to.BoolPtr(false),
+					},
 				},
-			},
-			NetworkProfile: &mgmtcompute.NetworkProfile{
-				NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
-					{
-						ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master', copyIndex(), '-nic'))]"),
+				NetworkProfile: &mgmtcompute.NetworkProfile{
+					NetworkInterfaces: &[]mgmtcompute.NetworkInterfaceReference{
+						{
+							ID: to.StringPtr("[resourceId('Microsoft.Network/networkInterfaces', concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master', copyIndex(), '-nic'))]"),
+						},
 					},
 				},
-			},
-			DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
-				BootDiagnostics: &mgmtcompute.BootDiagnostics{
-					Enabled:    to.BoolPtr(true),
-					StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+				DiagnosticsProfile: &mgmtcompute.DiagnosticsProfile{
+					BootDiagnostics: &mgmtcompute.BootDiagnostics{
+						Enabled:    to.BoolPtr(true),
+						StorageURI: to.StringPtr("https://cluster" + m.doc.OpenShiftCluster.Properties.StorageSuffix + ".blob." + m.env.Environment().StorageEndpointSuffix + "/"),
+					},
 				},
 			},
+			Zones:    zones,
+			Name:     to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
+			Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
+			Location: &installConfig.Config.Azure.Region,
 		},
-		Zones:    zones,
-		Name:     to.StringPtr("[concat('" + m.doc.OpenShiftCluster.Properties.InfraID + "-master-', copyIndex())]"),
-		Type:     to.StringPtr("Microsoft.Compute/virtualMachines"),
-		Location: &installConfig.Config.Azure.Region,
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID != "" {
-		vm.StorageProfile.OsDisk.ManagedDisk.DiskEncryptionSet = &mgmtcompute.DiskEncryptionSetParameters{
-			ID: &installConfig.Config.ControlPlane.Platform.Azure.DiskEncryptionSetID,
-		}
-	}
-
-	if installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost {
-		vm.SecurityProfile = &mgmtcompute.SecurityProfile{
-			EncryptionAtHost: &installConfig.Config.ControlPlane.Platform.Azure.EncryptionAtHost,
-		}
-	}
-
-	return &arm.Resource{
-		Resource:   vm,
 		APIVersion: azureclient.APIVersion("Microsoft.Compute"),
 		Copy: &arm.Copy{
 			Name:  "computecopy",
diff --git a/pkg/cluster/generateconfig.go b/pkg/cluster/generateconfig.go
index 089972e40..86454e114 100644
--- a/pkg/cluster/generateconfig.go
+++ b/pkg/cluster/generateconfig.go
@@ -129,12 +129,8 @@ func (m *manager) generateInstallConfig(ctx context.Context) (*installconfig.Ins
 				Replicas: to.Int64Ptr(3),
 				Platform: types.MachinePoolPlatform{
 					Azure: &azuretypes.MachinePool{
-						Zones:            masterZones,
-						InstanceType:     string(m.doc.OpenShiftCluster.Properties.MasterProfile.VMSize),
-						EncryptionAtHost: m.doc.OpenShiftCluster.Properties.MasterProfile.EncryptionAtHost,
-						OSDisk: azuretypes.OSDisk{
-							DiskEncryptionSetID: m.doc.OpenShiftCluster.Properties.MasterProfile.DiskEncryptionSetID,
-						},
+						Zones:        masterZones,
+						InstanceType: string(m.doc.OpenShiftCluster.Properties.MasterProfile.VMSize),
 					},
 				},
 				Hyperthreading: "Enabled",
@@ -146,12 +142,10 @@ func (m *manager) generateInstallConfig(ctx context.Context) (*installconfig.Ins
 					Replicas: to.Int64Ptr(int64(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].Count)),
 					Platform: types.MachinePoolPlatform{
 						Azure: &azuretypes.MachinePool{
-							Zones:            workerZones,
-							InstanceType:     string(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].VMSize),
-							EncryptionAtHost: m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].EncryptionAtHost,
+							Zones:        workerZones,
+							InstanceType: string(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].VMSize),
 							OSDisk: azuretypes.OSDisk{
-								DiskEncryptionSetID: m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskEncryptionSetID,
-								DiskSizeGB:          int32(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskSizeGB),
+								DiskSizeGB: int32(m.doc.OpenShiftCluster.Properties.WorkerProfiles[0].DiskSizeGB),
 							},
 						},
 					},
diff --git a/pkg/operator/controllers/routefix/routefix_controller.go b/pkg/operator/controllers/routefix/routefix_controller.go
index 2221b6561..1a28ff11f 100644
--- a/pkg/operator/controllers/routefix/routefix_controller.go
+++ b/pkg/operator/controllers/routefix/routefix_controller.go
@@ -7,12 +7,10 @@ import (
 	"context"
 
 	securityv1 "github.com/openshift/api/security/v1"
-	configclient "github.com/openshift/client-go/config/clientset/versioned"
 	securityclient "github.com/openshift/client-go/security/clientset/versioned"
 	"github.com/sirupsen/logrus"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
@@ -26,32 +24,25 @@ import (
 	aroclient "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
-	"github.com/Azure/ARO-RP/pkg/util/version"
 )
 
 //RouteFixReconciler is the controller struct
 type RouteFixReconciler struct {
 	kubernetescli kubernetes.Interface
 	securitycli   securityclient.Interface
-	configcli     configclient.Interface
 	arocli        aroclient.Interface
 	restConfig    *rest.Config
 	log           *logrus.Entry
-	verFixed      *version.Version
 }
 
 //NewReconciler creates a new Reconciler
-func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, securitycli securityclient.Interface, configcli configclient.Interface, arocli aroclient.Interface, restConfig *rest.Config) *RouteFixReconciler {
-	verFixed, _ := version.ParseVersion("4.7.15")
-
+func NewReconciler(log *logrus.Entry, kubernetescli kubernetes.Interface, securitycli securityclient.Interface, arocli aroclient.Interface, restConfig *rest.Config) *RouteFixReconciler {
 	return &RouteFixReconciler{
 		securitycli:   securitycli,
 		kubernetescli: kubernetescli,
-		configcli:     configcli,
 		arocli:        arocli,
 		restConfig:    restConfig,
 		log:           log,
-		verFixed:      verFixed,
 	}
 }
 
@@ -63,22 +54,6 @@ func (r *RouteFixReconciler) Reconcile(ctx context.Context, request ctrl.Request
 		return reconcile.Result{}, err
 	}
 
-	// cluster version is not set to final until upgrade is completed. We need to
-	// detect if desired version is with the fix, so we can prevent stuck upgrade
-	// by deleting fix resources
-	clusterVersion, err := version.GetClusterDesiredVersion(ctx, r.configcli)
-	if err != nil {
-		r.log.Errorf("error getting the OpenShift desired version: %v", err)
-		return reconcile.Result{}, err
-	}
-
-	if r.isRequired(clusterVersion) {
-		return r.deploy(ctx, instance)
-	}
-	return r.remove(ctx, instance)
-}
-
-func (r *RouteFixReconciler) deploy(ctx context.Context, instance *arov1alpha1.Cluster) (ctrl.Result, error) {
 	// TODO: dh should be a field in r, but the fact that it is initialised here
 	// each time currently saves us in the case that the controller runs before
 	// the SCC API is registered.
@@ -115,19 +90,6 @@ func (r *RouteFixReconciler) deploy(ctx context.Context, instance *arov1alpha1.C
 	return reconcile.Result{}, nil
 }
 
-func (r *RouteFixReconciler) remove(ctx context.Context, instance *arov1alpha1.Cluster) (ctrl.Result, error) {
-	err := r.kubernetescli.CoreV1().Namespaces().Delete(ctx, kubeNamespace, metav1.DeleteOptions{})
-	if !kerrors.IsNotFound(err) {
-		return reconcile.Result{}, err
-	}
-	err = r.kubernetescli.RbacV1().ClusterRoleBindings().Delete(ctx, kubeName, metav1.DeleteOptions{})
-	if kerrors.IsNotFound(err) {
-		return reconcile.Result{}, nil
-	}
-
-	return reconcile.Result{}, err
-}
-
 //SetupWithManager creates the controller
 func (r *RouteFixReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	aroClusterPredicate := predicate.NewPredicateFuncs(func(o client.Object) bool {
@@ -142,7 +104,3 @@ func (r *RouteFixReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Named(controllers.RouteFixControllerName).
 		Complete(r)
 }
-
-func (r *RouteFixReconciler) isRequired(clusterVersion *version.Version) bool {
-	return clusterVersion.Lt(r.verFixed)
-}
diff --git a/pkg/util/azureerrors/error.go b/pkg/util/azureerrors/error.go
index 6184e9a19..7b8a2673c 100644
--- a/pkg/util/azureerrors/error.go
+++ b/pkg/util/azureerrors/error.go
@@ -89,20 +89,3 @@ func IsInvalidSecretError(err error) bool {
 func IsUnauthorizedClientError(err error) bool {
 	return strings.Contains(err.Error(), "AADSTS700016")
 }
-
-// ResourceGroupNotFound returns true if the error is an ResourceGroupNotFound error
-func ResourceGroupNotFound(err error) bool {
-	if detailedErr, ok := err.(autorest.DetailedError); ok {
-		if serviceErr, ok := detailedErr.Original.(*azure.ServiceError); ok {
-			if serviceErr.Code == "ResourceGroupNotFound" {
-				return true
-			}
-		}
-		if requestErr, ok := detailedErr.Original.(*azure.RequestError); ok &&
-			requestErr.ServiceError != nil &&
-			requestErr.ServiceError.Code == "ResourceGroupNotFound" {
-			return true
-		}
-	}
-	return false
-}
diff --git a/pkg/util/cluster/cluster.go b/pkg/util/cluster/cluster.go
index eb0a5b610..ac1ecd12f 100644
--- a/pkg/util/cluster/cluster.go
+++ b/pkg/util/cluster/cluster.go
@@ -19,6 +19,7 @@ import (
 	mgmtauthorization "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-09-01-preview/authorization"
 	mgmtfeatures "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-07-01/features"
 	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/Azure/go-autorest/autorest/to"
 	"github.com/gofrs/uuid"
@@ -34,6 +35,7 @@ import (
 	"github.com/Azure/ARO-RP/pkg/deploy/generator"
 	"github.com/Azure/ARO-RP/pkg/env"
 	"github.com/Azure/ARO-RP/pkg/util/arm"
+	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/graphrbac"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/authorization"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/features"
@@ -44,9 +46,10 @@ import (
 )
 
 type Cluster struct {
-	log *logrus.Entry
-	env env.Core
-	ci  bool
+	log          *logrus.Entry
+	env          env.Core
+	ci           bool
+	ciParentVnet string
 
 	deployments                       features.DeploymentsClient
 	groups                            features.ResourceGroupsClient
@@ -59,6 +62,7 @@ type Cluster struct {
 	routetables                       network.RouteTablesClient
 	roleassignments                   authorization.RoleAssignmentsClient
 	peerings                          network.VirtualNetworkPeeringsClient
+	ciParentVnetPeerings              network.VirtualNetworkPeeringsClient
 }
 
 type errors []error
@@ -113,6 +117,28 @@ func New(log *logrus.Entry, env env.Core, ci bool) (*Cluster, error) {
 		peerings:                          network.NewVirtualNetworkPeeringsClient(env.Environment(), env.SubscriptionID(), authorizer),
 	}
 
+	if ci {
+		if env.IsLocalDevelopmentMode() {
+			c.ciParentVnet = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/dev-vnet", c.env.SubscriptionID(), c.env.ResourceGroup())
+		} else {
+			// This is dirty, but it used to be hard coded only for pub cloud.
+			// TODO pick right config value to get sub and resource group
+			if env.Environment().Name == azureclient.USGovernmentCloud.Name {
+				c.ciParentVnet = "/subscriptions/28015960-ee66-4844-8037-fc28b0560bf1/resourceGroups/e2einfra-usgovvirginia/providers/Microsoft.Network/virtualNetworks/dev-vnet"
+			} else {
+				// default to prior behavior, public cloud int
+				c.ciParentVnet = "/subscriptions/46626fc5-476d-41ad-8c76-2ec49c6994eb/resourceGroups/e2einfra-eastus/providers/Microsoft.Network/virtualNetworks/dev-vnet"
+			}
+		}
+
+		r, err := azure.ParseResourceID(c.ciParentVnet)
+		if err != nil {
+			return nil, err
+		}
+
+		c.ciParentVnetPeerings = network.NewVirtualNetworkPeeringsClient(env.Environment(), r.SubscriptionID, authorizer)
+	}
+
 	return c, nil
 }
 
@@ -150,6 +176,8 @@ func (c *Cluster) Create(ctx context.Context, vnetResourceGroup, clusterName str
 		if err != nil {
 			return err
 		}
+
+		visibility = api.VisibilityPrivate
 	}
 
 	b, err := deploy.Asset(generator.FileClusterPredeploy)
@@ -248,6 +276,12 @@ func (c *Cluster) Create(ctx context.Context, vnetResourceGroup, clusterName str
 		if err != nil {
 			return err
 		}
+
+		c.log.Info("peering subnets to CI infra")
+		err = c.peerSubnetsToCI(ctx, vnetResourceGroup, clusterName)
+		if err != nil {
+			return err
+		}
 	}
 
 	c.log.Info("done")
@@ -300,6 +334,14 @@ func (c *Cluster) Delete(ctx context.Context, vnetResourceGroup, clusterName str
 			}
 		}
 
+		r, err := azure.ParseResourceID(c.ciParentVnet)
+		if err == nil {
+			err = c.ciParentVnetPeerings.DeleteAndWait(ctx, r.ResourceGroup, r.ResourceName, vnetResourceGroup+"-peer")
+		}
+		if err != nil {
+			errs = append(errs, err)
+		}
+
 	} else {
 		// Deleting the deployment does not clean up the associated resources
 		c.log.Info("deleting deployment")
@@ -493,6 +535,42 @@ func (c *Cluster) fixupNSGs(ctx context.Context, vnetResourceGroup, clusterName
 	return nil
 }
 
+func (c *Cluster) peerSubnetsToCI(ctx context.Context, vnetResourceGroup, clusterName string) error {
+	cluster := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/dev-vnet", c.env.SubscriptionID(), vnetResourceGroup)
+
+	r, err := azure.ParseResourceID(c.ciParentVnet)
+	if err != nil {
+		return err
+	}
+
+	clusterProp := &mgmtnetwork.VirtualNetworkPeeringPropertiesFormat{
+		RemoteVirtualNetwork: &mgmtnetwork.SubResource{
+			ID: &c.ciParentVnet,
+		},
+		AllowVirtualNetworkAccess: to.BoolPtr(true),
+		AllowForwardedTraffic:     to.BoolPtr(true),
+	}
+	rpProp := &mgmtnetwork.VirtualNetworkPeeringPropertiesFormat{
+		RemoteVirtualNetwork: &mgmtnetwork.SubResource{
+			ID: &cluster,
+		},
+		AllowVirtualNetworkAccess: to.BoolPtr(true),
+		AllowForwardedTraffic:     to.BoolPtr(true),
+	}
+
+	err = c.peerings.CreateOrUpdateAndWait(ctx, vnetResourceGroup, "dev-vnet", r.ResourceGroup+"-peer", mgmtnetwork.VirtualNetworkPeering{VirtualNetworkPeeringPropertiesFormat: clusterProp})
+	if err != nil {
+		return err
+	}
+
+	err = c.ciParentVnetPeerings.CreateOrUpdateAndWait(ctx, r.ResourceGroup, r.ResourceName, vnetResourceGroup+"-peer", mgmtnetwork.VirtualNetworkPeering{VirtualNetworkPeeringPropertiesFormat: rpProp})
+	if err != nil {
+		return err
+	}
+
+	return err
+}
+
 func (c *Cluster) deleteRoleAssignments(ctx context.Context, vnetResourceGroup, appID string) error {
 	spObjID, err := c.getServicePrincipal(ctx, appID)
 	if err != nil {
diff --git a/pkg/util/clusterdata/worker_profiles_task.go b/pkg/util/clusterdata/worker_profiles_task.go
index 6f50759b1..411f7532c 100644
--- a/pkg/util/clusterdata/worker_profiles_task.go
+++ b/pkg/util/clusterdata/worker_profiles_task.go
@@ -95,14 +95,6 @@ func (ef *workerProfilesEnricherTask) FetchData(ctx context.Context, callbacks c
 			"/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/%s/subnets/%s",
 			r.SubscriptionID, machineProviderSpec.NetworkResourceGroup, machineProviderSpec.Vnet, machineProviderSpec.Subnet,
 		)
-
-		workerProfiles[i].EncryptionAtHost = machineProviderSpec.SecurityProfile != nil &&
-			machineProviderSpec.SecurityProfile.EncryptionAtHost != nil &&
-			*machineProviderSpec.SecurityProfile.EncryptionAtHost
-
-		if machineProviderSpec.OSDisk.ManagedDisk.DiskEncryptionSet != nil {
-			workerProfiles[i].DiskEncryptionSetID = machineProviderSpec.OSDisk.ManagedDisk.DiskEncryptionSet.ID
-		}
 	}
 
 	sort.Slice(workerProfiles, func(i, j int) bool { return workerProfiles[i].Name < workerProfiles[j].Name })
diff --git a/pkg/util/dynamichelper/discovery/bindata.go b/pkg/util/dynamichelper/discovery/bindata.go
index 6f09482f2..33d293d14 100644
--- a/pkg/util/dynamichelper/discovery/bindata.go
+++ b/pkg/util/dynamichelper/discovery/bindata.go
@@ -340,7 +340,7 @@ func aroOpenshiftIoV1alpha1ServerresourcesJson() (*asset, error) {
 	return a, nil
 }
 
-var _assets_version = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x32\xd1\x33\xd7\x33\xb4\xe0\x02\x04\x00\x00\xff\xff\xa0\x5c\xe9\x7d\x07\x00\x00\x00")
+var _assets_version = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x32\xd1\x33\xd7\x33\x34\xe2\x02\x04\x00\x00\xff\xff\x2a\xb4\x06\x87\x07\x00\x00\x00")
 
 func assets_versionBytes() ([]byte, error) {
 	return bindataRead(
diff --git a/pkg/util/dynamichelper/discovery/cache/assets_version b/pkg/util/dynamichelper/discovery/cache/assets_version
index bdc778938..aca932939 100644
--- a/pkg/util/dynamichelper/discovery/cache/assets_version
+++ b/pkg/util/dynamichelper/discovery/cache/assets_version
@@ -1,1 +1,1 @@
-4.7.18
+4.7.12
diff --git a/pkg/util/version/clusterversion.go b/pkg/util/version/clusterversion.go
index 15519278a..2cd3d6ffe 100644
--- a/pkg/util/version/clusterversion.go
+++ b/pkg/util/version/clusterversion.go
@@ -26,12 +26,3 @@ func GetClusterVersion(ctx context.Context, configcli configclient.Interface) (*
 
 	return nil, errors.New("unknown cluster version")
 }
-
-func GetClusterDesiredVersion(ctx context.Context, configcli configclient.Interface) (*Version, error) {
-	cv, err := configcli.ConfigV1().ClusterVersions().Get(ctx, "version", metav1.GetOptions{})
-	if err != nil {
-		return nil, err
-	}
-
-	return ParseVersion(cv.Status.Desired.Version)
-}
diff --git a/pkg/util/version/const.go b/pkg/util/version/const.go
index 3b52873c9..51399af58 100644
--- a/pkg/util/version/const.go
+++ b/pkg/util/version/const.go
@@ -20,8 +20,8 @@ var GitCommit = "unknown"
 
 // InstallStream describes stream we are defaulting to for all new clusters
 var InstallStream = &Stream{
-	Version:  NewVersion(4, 7, 18),
-	PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:afcb309425d45a240de2df8e376f9632e6144052177fd62a0347934657b3573f",
+	Version:  NewVersion(4, 7, 12),
+	PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:2029c5779202293f23418d47a1a823c4e4c8539c1ab25e8bda30d48335b4892e",
 }
 
 // Streams describes list of streams we support for upgrades
@@ -29,12 +29,12 @@ var (
 	Streams = []*Stream{
 		InstallStream,
 		{
-			Version:  NewVersion(4, 6, 36),
-			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:4205c6709ec4b8523eb18144f7c5bed17a32ba71348fd4c2b6ab43a636cf028e",
+			Version:  NewVersion(4, 6, 26),
+			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:e867135cd5a09192635b46ccab6ca7543e642378dc72fa22ea54961b05e322f2",
 		},
 		{
-			Version:  NewVersion(4, 5, 39),
-			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:c4b9eb565c64df97afe7841bbcc0469daec7973e46ae588739cc30ea9062172b",
+			Version:  NewVersion(4, 5, 38),
+			PullSpec: "quay.io/openshift-release-dev/ocp-release@sha256:688ca8e365fbd4ee4cc8524e2732395560446d2ff90c3d9b8407b159c571ca1c",
 		},
 		{
 			Version:  NewVersion(4, 4, 33),
diff --git a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
index d1a9940f6..d792c652c 100644
--- a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
+++ b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models.py
@@ -299,27 +299,17 @@ class MasterProfile(Model):
      ~azure.mgmt.redhatopenshift.v2021_01_31_preview.models.VMSize
     :param subnet_id: The Azure resource ID of the master subnet.
     :type subnet_id: str
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
         'vm_size': {'key': 'vmSize', 'type': 'str'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
     def __init__(self, **kwargs):
         super(MasterProfile, self).__init__(**kwargs)
         self.vm_size = kwargs.get('vm_size', None)
         self.subnet_id = kwargs.get('subnet_id', None)
-        self.encryption_at_host = kwargs.get('encryption_at_host', None)
-        self.disk_encryption_set_id = kwargs.get('disk_encryption_set_id', None)
 
 
 class NetworkProfile(Model):
@@ -735,12 +725,6 @@ class WorkerProfile(Model):
     :type subnet_id: str
     :param count: The number of worker VMs.
     :type count: int
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
@@ -749,8 +733,6 @@ class WorkerProfile(Model):
         'disk_size_gb': {'key': 'diskSizeGB', 'type': 'int'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
         'count': {'key': 'count', 'type': 'int'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
     def __init__(self, **kwargs):
@@ -760,5 +742,3 @@ class WorkerProfile(Model):
         self.disk_size_gb = kwargs.get('disk_size_gb', None)
         self.subnet_id = kwargs.get('subnet_id', None)
         self.count = kwargs.get('count', None)
-        self.encryption_at_host = kwargs.get('encryption_at_host', None)
-        self.disk_encryption_set_id = kwargs.get('disk_encryption_set_id', None)
diff --git a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
index 1d68c5993..2b203a81f 100644
--- a/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
+++ b/python/client/azure/mgmt/redhatopenshift/v2021_01_31_preview/models/_models_py3.py
@@ -299,27 +299,17 @@ class MasterProfile(Model):
      ~azure.mgmt.redhatopenshift.v2021_01_31_preview.models.VMSize
     :param subnet_id: The Azure resource ID of the master subnet.
     :type subnet_id: str
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
         'vm_size': {'key': 'vmSize', 'type': 'str'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
-    def __init__(self, *, vm_size=None, subnet_id: str=None, encryption_at_host: bool=None, disk_encryption_set_id: str=None, **kwargs) -> None:
+    def __init__(self, *, vm_size=None, subnet_id: str=None, **kwargs) -> None:
         super(MasterProfile, self).__init__(**kwargs)
         self.vm_size = vm_size
         self.subnet_id = subnet_id
-        self.encryption_at_host = encryption_at_host
-        self.disk_encryption_set_id = disk_encryption_set_id
 
 
 class NetworkProfile(Model):
@@ -735,12 +725,6 @@ class WorkerProfile(Model):
     :type subnet_id: str
     :param count: The number of worker VMs.
     :type count: int
-    :param encryption_at_host: Whether master virtual machines are encrypted
-     at host.
-    :type encryption_at_host: bool
-    :param disk_encryption_set_id: The resource ID of an associated
-     DiskEncryptionSet, if applicable.
-    :type disk_encryption_set_id: str
     """
 
     _attribute_map = {
@@ -749,16 +733,12 @@ class WorkerProfile(Model):
         'disk_size_gb': {'key': 'diskSizeGB', 'type': 'int'},
         'subnet_id': {'key': 'subnetId', 'type': 'str'},
         'count': {'key': 'count', 'type': 'int'},
-        'encryption_at_host': {'key': 'encryptionAtHost', 'type': 'bool'},
-        'disk_encryption_set_id': {'key': 'diskEncryptionSetId', 'type': 'str'},
     }
 
-    def __init__(self, *, name: str=None, vm_size=None, disk_size_gb: int=None, subnet_id: str=None, count: int=None, encryption_at_host: bool=None, disk_encryption_set_id: str=None, **kwargs) -> None:
+    def __init__(self, *, name: str=None, vm_size=None, disk_size_gb: int=None, subnet_id: str=None, count: int=None, **kwargs) -> None:
         super(WorkerProfile, self).__init__(**kwargs)
         self.name = name
         self.vm_size = vm_size
         self.disk_size_gb = disk_size_gb
         self.subnet_id = subnet_id
         self.count = count
-        self.encryption_at_host = encryption_at_host
-        self.disk_encryption_set_id = disk_encryption_set_id
diff --git a/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json b/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
index 471ef7aed..03eeffb74 100644
--- a/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
+++ b/swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2021-01-31-preview/redhatopenshift.json
@@ -575,14 +575,6 @@
         "subnetId": {
           "description": "The Azure resource ID of the master subnet.",
           "type": "string"
-        },
-        "encryptionAtHost": {
-          "description": "Whether master virtual machines are encrypted at host.",
-          "type": "boolean"
-        },
-        "diskEncryptionSetId": {
-          "description": "The resource ID of an associated DiskEncryptionSet, if applicable.",
-          "type": "string"
         }
       }
     },
@@ -851,14 +843,6 @@
         "count": {
           "description": "The number of worker VMs.",
           "type": "integer"
-        },
-        "encryptionAtHost": {
-          "description": "Whether master virtual machines are encrypted at host.",
-          "type": "boolean"
-        },
-        "diskEncryptionSetId": {
-          "description": "The resource ID of an associated DiskEncryptionSet, if applicable.",
-          "type": "string"
         }
       }
     }
diff --git a/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go b/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
index 69b4e1e6d..dc759b4b0 100644
--- a/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
+++ b/vendor/github.com/openshift/installer/pkg/aro/dnsmasq/dnsmasq.go
@@ -40,7 +40,7 @@ Before=bootkube.service
 # This file is a product of user DNS settings on the VNET. We will replace this file to point to
 # dnsmasq instance on the node. dnsmasq will inject certain dns records we need and forward rest of the queries to
 # resolv.conf.dnsmasq upstream customer dns.
-ExecStartPre=/bin/bash /usr/local/bin/aro-dnsmasq-pre.sh
+ExecStartPre=/bin/bash -c 'if /usr/bin/test -f "/etc/resolv.conf.dnsmasq"; then echo "already replaced resolv.conf.dnsmasq"; else /bin/cp /etc/resolv.conf /etc/resolv.conf.dnsmasq; fi; /bin/sed -ni -e "/^nameserver /!p; \\$$a nameserver $$(ip -f inet -o addr show eth0|cut -d\  -f 7 | cut -d/ -f 1)" /etc/resolv.conf; /usr/sbin/restorecon /etc/resolv.conf'
 ExecStart=/usr/sbin/dnsmasq -k
 ExecStopPost=/bin/bash -c '/bin/mv /etc/resolv.conf.dnsmasq /etc/resolv.conf; /usr/sbin/restorecon /etc/resolv.conf'
 Restart=always
@@ -49,62 +49,6 @@ Restart=always
 WantedBy=multi-user.target
 {{ end }}
 
-{{ define "aro-dnsmasq-pre.sh" }}
-#!/bin/bash
-set -euo pipefail
-
-# This bash script is a part of the ARO DnsMasq configuration
-# It's deployed as part of the 99-aro-dns-* machine config
-# See https://github.com/Azure/ARO-RP
-
-# This file can be rerun and the effect is idempotent, output might change if the DHCP configuration changes
-
-TMPSELFRESOLV=$(mktemp)
-TMPNETRESOLV=$(mktemp)
-
-echo "# Generated for dnsmasq.service - should point to self" > $TMPSELFRESOLV
-echo "# Generated for dnsmasq.service - should contain DHCP configured DNS" > $TMPNETRESOLV
-
-if nmcli device show br-ex; then
-    echo "OVN mode - br-ex device exists"
-    #getting DNS search strings
-    SEARCH_RAW=$(nmcli --get IP4.DOMAIN device show br-ex)
-    #getting DNS servers
-    NAMESERVER_RAW=$(nmcli --get IP4.DNS device show br-ex)
-    LOCAL_IPS_RAW=$(nmcli --get IP4.ADDRESS device show br-ex)
-else
-    NETDEV=$(nmcli --get device connection show --active | head -n 1) #there should be only one active device
-    echo "OVS SDN mode - br-ex not found, using device $NETDEV"
-    SEARCH_RAW=$(nmcli --get IP4.DOMAIN device show $NETDEV)
-    NAMESERVER_RAW=$(nmcli --get IP4.DNS device show $NETDEV)
-    LOCAL_IPS_RAW=$(nmcli --get IP4.ADDRESS device show $NETDEV)
-fi
-
-#search line
-echo "search $SEARCH_RAW" | tr '\n' ' ' >> $TMPNETRESOLV
-echo "" >> $TMPNETRESOLV
-echo "search $SEARCH_RAW" | tr '\n' ' ' >> $TMPSELFRESOLV
-echo "" >> $TMPSELFRESOLV
-
-#nameservers as separate lines
-echo "$NAMESERVER_RAW" | while read -r line
-do
-    echo "nameserver $line" >> $TMPNETRESOLV
-done
-# device IPs are returned in address/mask format
-echo "$LOCAL_IPS_RAW" | while read -r line
-do
-    echo "nameserver $line" | cut -d'/' -f 1 >> $TMPSELFRESOLV
-done
-
-# done, copying files to destination locations and cleaning up
-/bin/cp $TMPNETRESOLV /etc/resolv.conf.dnsmasq
-chmod 0744 /etc/resolv.conf.dnsmasq
-/bin/cp $TMPSELFRESOLV /etc/resolv.conf
-/usr/sbin/restorecon /etc/resolv.conf
-/bin/rm $TMPNETRESOLV
-/bin/rm $TMPSELFRESOLV
-{{ end }}
 `))
 
 func config(clusterDomain, apiIntIP, ingressIP string) ([]byte, error) {
@@ -137,17 +81,6 @@ func service() (string, error) {
 	return buf.String(), nil
 }
 
-func startpre() ([]byte, error) {
-	buf := &bytes.Buffer{}
-
-	err := t.ExecuteTemplate(buf, "aro-dnsmasq-pre.sh", nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return buf.Bytes(), nil
-}
-
 func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Config, error) {
 	service, err := service()
 	if err != nil {
@@ -159,11 +92,6 @@ func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Conf
 		return nil, err
 	}
 
-	startpre, err := startpre()
-	if err != nil {
-		return nil, err
-	}
-
 	return &ign2types.Config{
 		Ignition: ign2types.Ignition{
 			Version: ign2types.MaxVersion.String(),
@@ -186,22 +114,6 @@ func Ignition2Config(clusterDomain, apiIntIP, ingressIP string) (*ign2types.Conf
 						Mode: ignutil.IntToPtr(0644),
 					},
 				},
-				{
-					Node: ign2types.Node{
-						Filesystem: "root",
-						Overwrite:  ignutil.BoolToPtr(true),
-						Path:       "/usr/local/bin/aro-dnsmasq-pre.sh",
-						User: &ign2types.NodeUser{
-							Name: "root",
-						},
-					},
-					FileEmbedded1: ign2types.FileEmbedded1{
-						Contents: ign2types.FileContents{
-							Source: dataurl.EncodeBytes(startpre),
-						},
-						Mode: ignutil.IntToPtr(0744),
-					},
-				},
 			},
 		},
 		Systemd: ign2types.Systemd{
@@ -227,11 +139,6 @@ func Ignition3Config(clusterDomain, apiIntIP, ingressIP string) (*ign3types.Conf
 		return nil, err
 	}
 
-	startpre, err := startpre()
-	if err != nil {
-		return nil, err
-	}
-
 	return &ign3types.Config{
 		Ignition: ign3types.Ignition{
 			Version: ign3types.MaxVersion.String(),
@@ -253,21 +160,6 @@ func Ignition3Config(clusterDomain, apiIntIP, ingressIP string) (*ign3types.Conf
 						Mode: ignutil.IntToPtr(0644),
 					},
 				},
-				{
-					Node: ign3types.Node{
-						Overwrite: ignutil.BoolToPtr(true),
-						Path:      "/usr/local/bin/aro-dnsmasq-pre.sh",
-						User: ign3types.NodeUser{
-							Name: ignutil.StrToPtr("root"),
-						},
-					},
-					FileEmbedded1: ign3types.FileEmbedded1{
-						Contents: ign3types.Resource{
-							Source: ignutil.StrToPtr(dataurl.EncodeBytes(startpre)),
-						},
-						Mode: ignutil.IntToPtr(0744),
-					},
-				},
 			},
 		},
 		Systemd: ign3types.Systemd{
diff --git a/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go b/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
index f03a2367d..af762f28e 100644
--- a/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
+++ b/vendor/github.com/openshift/installer/pkg/asset/machines/azure/machines.go
@@ -144,18 +144,6 @@ func provider(platform *azure.Platform, mpool *azure.MachinePool, osImage string
 		}
 	}
 
-	if mpool.OSDisk.DiskEncryptionSetID != "" {
-		spec.OSDisk.ManagedDisk.DiskEncryptionSet = &azureprovider.DiskEncryptionSetParameters{
-			ID: mpool.OSDisk.DiskEncryptionSetID,
-		}
-	}
-
-	if mpool.EncryptionAtHost {
-		spec.SecurityProfile = &azureprovider.SecurityProfile{
-			EncryptionAtHost: &mpool.EncryptionAtHost,
-		}
-	}
-
 	if platform.ARO {
 		spec.ManagedIdentity = ""
 	}
diff --git a/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go b/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
index 87f768206..e97753eb0 100644
--- a/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
+++ b/vendor/github.com/openshift/installer/pkg/types/azure/machinepool.go
@@ -15,11 +15,6 @@ type MachinePool struct {
 	// +optional
 	InstanceType string `json:"type"`
 
-	// EncryptionAtHost
-	//
-	// +optional
-	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`
-
 	// OSDisk defines the storage for instance.
 	//
 	// +optional
@@ -39,10 +34,6 @@ type OSDisk struct {
 	// +optional
 	// +kubebuilder:validation:Enum=Standard_LRS;Premium_LRS;StandardSSD_LRS
 	DiskType string `json:"diskType"`
-
-	// DiskEncryptionSetID is a resource ID of disk encryption set
-	// +optional
-	DiskEncryptionSetID string `json:"diskEncryptionSetId,omitempty"`
 }
 
 // Set sets the values from `required` to `a`.
@@ -59,10 +50,6 @@ func (a *MachinePool) Set(required *MachinePool) {
 		a.InstanceType = required.InstanceType
 	}
 
-	if required.EncryptionAtHost {
-		a.EncryptionAtHost = required.EncryptionAtHost
-	}
-
 	if required.OSDisk.DiskSizeGB != 0 {
 		a.OSDisk.DiskSizeGB = required.OSDisk.DiskSizeGB
 	}
@@ -70,8 +57,4 @@ func (a *MachinePool) Set(required *MachinePool) {
 	if required.OSDisk.DiskType != "" {
 		a.OSDisk.DiskType = required.OSDisk.DiskType
 	}
-
-	if required.OSDisk.DiskEncryptionSetID != "" {
-		a.OSDisk.DiskEncryptionSetID = required.OSDisk.DiskEncryptionSetID
-	}
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e109197dc..f0d2703fd 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -793,7 +793,7 @@ github.com/openshift/console-operator/pkg/api
 # github.com/openshift/custom-resource-status v1.1.0
 ## explicit
 github.com/openshift/custom-resource-status/conditions/v1
-# github.com/openshift/installer v0.16.1 => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+# github.com/openshift/installer v0.16.1 => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 ## explicit
 github.com/openshift/installer/data
 github.com/openshift/installer/pkg/aro/dnsmasq
@@ -1917,7 +1917,7 @@ sigs.k8s.io/yaml
 # github.com/openshift/cluster-api-provider-libvirt => github.com/openshift/cluster-api-provider-libvirt v0.2.1-0.20210324200850-033be25ca038
 # github.com/openshift/cluster-api-provider-ovirt => github.com/openshift/cluster-api-provider-ovirt v0.1.1-0.20210409185359-01b9bf8368a3
 # github.com/openshift/console-operator => github.com/openshift/console-operator v0.0.0-20210323072657-4f933d59784b
-# github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210705104729-749222c33d4f
+# github.com/openshift/installer => github.com/mjudeikis/installer v0.9.0-master.0.20210603071751-c3c375c5034a
 # github.com/openshift/library-go => github.com/openshift/library-go v0.0.0-20210205203934-9eb0d970f2f4
 # github.com/openshift/machine-api-operator => github.com/openshift/machine-api-operator v0.2.1-0.20210521181620-e179bb5ce397
 # github.com/openshift/machine-config-operator => github.com/openshift/machine-config-operator v0.0.1-0.20210522053223-c4b7e3f5118d


Test patch:
diff --git a/.pipelines/templates/template-prod-e2e-steps.yml b/.pipelines/templates/template-prod-e2e-steps.yml
index 64b31668c..1272aee2e 100644
--- a/.pipelines/templates/template-prod-e2e-steps.yml
+++ b/.pipelines/templates/template-prod-e2e-steps.yml
@@ -33,7 +33,7 @@ steps:
       export AZURE_FP_SERVICE_PRINCIPAL_ID=fe9d206f-a6af-46db-8bda-303aae45e469
     else
       export AZURE_FP_CLIENT_ID=f1dd0a37-89c6-4e07-bcd1-ffd3d43d8875
-      export AZURE_FP_SERVICE_PRINCIPAL_ID=50c17c64-bc11-4fdd-a339-0ecd396bf911
+      export AZURE_FP_SERVICE_PRINCIPAL_ID=de2829de-2392-40ee-b3a8-79b70a18c2a1
     fi
     # TODO: remove --env RESOURCEGROUP after next RP deployment.
 
diff --git a/pkg/api/validate/dynamic/dynamic_test.go b/pkg/api/validate/dynamic/dynamic_test.go
index e56c331c6..45368e59b 100644
--- a/pkg/api/validate/dynamic/dynamic_test.go
+++ b/pkg/api/validate/dynamic/dynamic_test.go
@@ -44,9 +44,6 @@ func TestValidateVnetPermissions(t *testing.T) {
 	resourceType := "virtualNetworks"
 	resourceProvider := "Microsoft.Network"
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name    string
 		mocks   func(*mock_authorization.MockPermissionsClient, func())
@@ -111,6 +108,9 @@ func TestValidateVnetPermissions(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
 
@@ -161,6 +161,9 @@ func TestGetRouteTableID(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
 			vnet := &mgmtnetwork.VirtualNetwork{
 				ID: &vnetID,
 				VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
@@ -194,9 +197,6 @@ func TestGetRouteTableID(t *testing.T) {
 func TestValidateRouteTablesPermissions(t *testing.T) {
 	ctx := context.Background()
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name            string
 		subnet          Subnet
@@ -299,6 +299,9 @@ func TestValidateRouteTablesPermissions(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
 			ctx, cancel := context.WithCancel(ctx)
 			defer cancel()
 
@@ -356,9 +359,6 @@ func TestValidateRouteTablesPermissions(t *testing.T) {
 func TestValidateCIDRRanges(t *testing.T) {
 	ctx := context.Background()
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name      string
 		modifyOC  func(*api.OpenShiftCluster)
@@ -392,100 +392,102 @@ func TestValidateCIDRRanges(t *testing.T) {
 			wantErr: "400: InvalidLinkedVNet: : The provided CIDRs must not overlap: '10.0.0.0/24 overlaps with 10.0.0.0/24'.",
 		},
 	} {
-		oc := &api.OpenShiftCluster{
-			Properties: api.OpenShiftClusterProperties{
-				ClusterProfile: api.ClusterProfile{
-					ResourceGroupID: resourceGroupID,
-				},
-				NetworkProfile: api.NetworkProfile{
-					PodCIDR:     "10.0.2.0/24",
-					ServiceCIDR: "10.0.3.0/24",
-				},
-				MasterProfile: api.MasterProfile{
-					SubnetID: masterSubnet,
-				},
-				WorkerProfiles: []api.WorkerProfile{
-					{
-						SubnetID: workerSubnet,
+		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
+			oc := &api.OpenShiftCluster{
+				Properties: api.OpenShiftClusterProperties{
+					ClusterProfile: api.ClusterProfile{
+						ResourceGroupID: resourceGroupID,
+					},
+					NetworkProfile: api.NetworkProfile{
+						PodCIDR:     "10.0.2.0/24",
+						ServiceCIDR: "10.0.3.0/24",
+					},
+					MasterProfile: api.MasterProfile{
+						SubnetID: masterSubnet,
 					},
-					{
-						SubnetID: workerSubnet,
+					WorkerProfiles: []api.WorkerProfile{
+						{
+							SubnetID: workerSubnet,
+						},
+						{
+							SubnetID: workerSubnet,
+						},
 					},
 				},
-			},
-		}
-
-		vnet := mgmtnetwork.VirtualNetwork{
-			ID:       &vnetID,
-			Location: to.StringPtr("eastus"),
-			VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
-				Subnets: &[]mgmtnetwork.Subnet{
-					{
-						ID: &masterSubnet,
-						SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
-							AddressPrefix: to.StringPtr("10.0.0.0/24"),
-							NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
-								ID: &masterNSGv1,
-							},
-							ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
-								{
-									Service:           to.StringPtr("Microsoft.ContainerRegistry"),
-									ProvisioningState: mgmtnetwork.Succeeded,
+			}
+
+			vnet := mgmtnetwork.VirtualNetwork{
+				ID:       &vnetID,
+				Location: to.StringPtr("eastus"),
+				VirtualNetworkPropertiesFormat: &mgmtnetwork.VirtualNetworkPropertiesFormat{
+					Subnets: &[]mgmtnetwork.Subnet{
+						{
+							ID: &masterSubnet,
+							SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
+								AddressPrefix: to.StringPtr("10.0.0.0/24"),
+								NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
+									ID: &masterNSGv1,
 								},
+								ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
+									{
+										Service:           to.StringPtr("Microsoft.ContainerRegistry"),
+										ProvisioningState: mgmtnetwork.Succeeded,
+									},
+								},
+								PrivateLinkServiceNetworkPolicies: to.StringPtr("Disabled"),
 							},
-							PrivateLinkServiceNetworkPolicies: to.StringPtr("Disabled"),
 						},
-					},
-					{
-						ID: &workerSubnet,
-						SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
-							AddressPrefix: to.StringPtr("10.0.1.0/24"),
-							NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
-								ID: &workerNSGv1,
-							},
-							ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
-								{
-									Service:           to.StringPtr("Microsoft.ContainerRegistry"),
-									ProvisioningState: mgmtnetwork.Succeeded,
+						{
+							ID: &workerSubnet,
+							SubnetPropertiesFormat: &mgmtnetwork.SubnetPropertiesFormat{
+								AddressPrefix: to.StringPtr("10.0.1.0/24"),
+								NetworkSecurityGroup: &mgmtnetwork.SecurityGroup{
+									ID: &workerNSGv1,
+								},
+								ServiceEndpoints: &[]mgmtnetwork.ServiceEndpointPropertiesFormat{
+									{
+										Service:           to.StringPtr("Microsoft.ContainerRegistry"),
+										ProvisioningState: mgmtnetwork.Succeeded,
+									},
 								},
 							},
 						},
 					},
 				},
-			},
-		}
-
-		if tt.modifyOC != nil {
-			tt.modifyOC(oc)
-		}
-
-		vnetClient := mock_network.NewMockVirtualNetworksClient(controller)
-		if tt.vnetMocks != nil {
-			tt.vnetMocks(vnetClient, vnet)
-		}
-
-		dv := &dynamic{
-			log:             logrus.NewEntry(logrus.StandardLogger()),
-			virtualNetworks: vnetClient,
-		}
-
-		err := dv.validateCIDRRanges(ctx, []Subnet{
-			{ID: masterSubnet},
-			{ID: workerSubnet}},
-			oc.Properties.NetworkProfile.PodCIDR, oc.Properties.NetworkProfile.ServiceCIDR)
-		if err != nil && err.Error() != tt.wantErr ||
-			err == nil && tt.wantErr != "" {
-			t.Error(err)
-		}
+			}
+
+			if tt.modifyOC != nil {
+				tt.modifyOC(oc)
+			}
+
+			vnetClient := mock_network.NewMockVirtualNetworksClient(controller)
+			if tt.vnetMocks != nil {
+				tt.vnetMocks(vnetClient, vnet)
+			}
+
+			dv := &dynamic{
+				log:             logrus.NewEntry(logrus.StandardLogger()),
+				virtualNetworks: vnetClient,
+			}
+
+			err := dv.validateCIDRRanges(ctx, []Subnet{
+				{ID: masterSubnet},
+				{ID: workerSubnet}},
+				oc.Properties.NetworkProfile.PodCIDR, oc.Properties.NetworkProfile.ServiceCIDR)
+			if err != nil && err.Error() != tt.wantErr ||
+				err == nil && tt.wantErr != "" {
+				t.Error(err)
+			}
+		})
 	}
 }
 
 func TestValidateVnetLocation(t *testing.T) {
 	ctx := context.Background()
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name     string
 		location string
@@ -502,6 +504,8 @@ func TestValidateVnetLocation(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
 
 			vnet := mgmtnetwork.VirtualNetwork{
 				ID:       to.StringPtr(vnetID),
@@ -535,9 +539,6 @@ func TestValidateVnetLocation(t *testing.T) {
 func TestValidateSubnets(t *testing.T) {
 	ctx := context.Background()
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name      string
 		modifyOC  func(*api.OpenShiftCluster)
@@ -678,6 +679,9 @@ func TestValidateSubnets(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
 			oc := &api.OpenShiftCluster{
 				Properties: api.OpenShiftClusterProperties{
 					ClusterProfile: api.ClusterProfile{
diff --git a/pkg/api/validate/dynamic/provider_test.go b/pkg/api/validate/dynamic/provider_test.go
index c558129b5..34513b512 100644
--- a/pkg/api/validate/dynamic/provider_test.go
+++ b/pkg/api/validate/dynamic/provider_test.go
@@ -19,9 +19,6 @@ import (
 func TestValidateProviders(t *testing.T) {
 	ctx := context.Background()
 
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
 	for _, tt := range []struct {
 		name    string
 		mocks   func(*mock_features.MockProvidersClient)
@@ -135,6 +132,9 @@ func TestValidateProviders(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
 			providerClient := mock_features.NewMockProvidersClient(controller)
 
 			tt.mocks(providerClient)
diff --git a/pkg/frontend/openshiftcluster_putorpatch_test.go b/pkg/frontend/openshiftcluster_putorpatch_test.go
index b88cfb3d9..32f382074 100644
--- a/pkg/frontend/openshiftcluster_putorpatch_test.go
+++ b/pkg/frontend/openshiftcluster_putorpatch_test.go
@@ -888,7 +888,6 @@ func TestPutOrPatchOpenShiftCluster(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-
 			ti := newTestInfra(t).
 				WithOpenShiftClusters().
 				WithSubscriptions().
diff --git a/pkg/monitor/cluster/clusterversions_test.go b/pkg/monitor/cluster/clusterversions_test.go
index ae3fa6853..a09d664f1 100644
--- a/pkg/monitor/cluster/clusterversions_test.go
+++ b/pkg/monitor/cluster/clusterversions_test.go
@@ -77,7 +77,7 @@ func TestEmitClusterVersion(t *testing.T) {
 			wantActualVersion:                        "4.5.1",
 			wantDesiredVersion:                       "4.5.3",
 			wantProvisionedByResourceProviderVersion: "",
-			wantAvailableVersion:                     "4.5.39",
+			wantAvailableVersion:                     "4.5.38",
 			wantAvailableRP:                          "unknown",
 		},
 		{
diff --git a/pkg/portal/security_test.go b/pkg/portal/security_test.go
index 6f5c9984a..e08b235a2 100644
--- a/pkg/portal/security_test.go
+++ b/pkg/portal/security_test.go
@@ -351,12 +351,7 @@ func TestSecurity(t *testing.T) {
 				// [2] https://go.googlesource.com/go/+/go1.16.2/src/net/http/fs.go#337
 				if tt.name == "/" || tt.name == "/main.js" {
 					err = testpoller.Poll(1*time.Second, 5*time.Millisecond, func() (bool, error) {
-						if len(auditHook.AllEntries()) == 1 {
-							if _, ok := auditHook.AllEntries()[0].Data[audit.MetadataPayload]; ok {
-								return true, nil
-							}
-						}
-						return false, nil
+						return len(auditHook.AllEntries()) == 1, nil
 					})
 					if err != nil {
 						t.Error(err)
diff --git a/pkg/util/dns/dns_test.go b/pkg/util/dns/dns_test.go
index 8e63fe3a8..f6caa5f31 100644
--- a/pkg/util/dns/dns_test.go
+++ b/pkg/util/dns/dns_test.go
@@ -536,12 +536,6 @@ func TestDelete(t *testing.T) {
 }
 
 func TestManagedDomain(t *testing.T) {
-	controller := gomock.NewController(t)
-	defer controller.Finish()
-
-	env := mock_env.NewMockInterface(controller)
-	env.EXPECT().Domain().AnyTimes().Return("eastus.aroapp.io")
-
 	for _, tt := range []struct {
 		domain  string
 		want    string
@@ -581,6 +575,12 @@ func TestManagedDomain(t *testing.T) {
 		},
 	} {
 		t.Run(tt.domain, func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
+			env := mock_env.NewMockInterface(controller)
+			env.EXPECT().Domain().AnyTimes().Return("eastus.aroapp.io")
+
 			got, err := ManagedDomain(env, tt.domain)
 			if got != tt.want {
 				t.Error(got)
diff --git a/test/e2e/get.go b/test/e2e/get.go
index c2db32314..95dfa82af 100644
--- a/test/e2e/get.go
+++ b/test/e2e/get.go
@@ -8,6 +8,8 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
+	mgmtredhatopenshift20200430 "github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2020-04-30/redhatopenshift"
 )
 
 var _ = Describe("Get cluster", func() {
@@ -21,6 +23,7 @@ var _ = Describe("Get cluster", func() {
 		Expect(*oc.IngressProfiles).To(HaveLen(1))
 		ingressProfile := (*oc.IngressProfiles)[0]
 		Expect(*ingressProfile.Name).To(Equal("default"))
+		Expect(ingressProfile.Visibility).To(Equal(mgmtredhatopenshift20200430.Visibility1Private))
 		Expect(ingressProfile.IP).NotTo(BeNil())
 
 		// Check we retrieve Cluster version
diff --git a/test/e2e/operator.go b/test/e2e/operator.go
index f636bf396..c443110ee 100644
--- a/test/e2e/operator.go
+++ b/test/e2e/operator.go
@@ -176,6 +176,74 @@ var _ = Describe("ARO Operator - Geneva Logging", func() {
 	})
 })
 
+var _ = Describe("ARO Operator - Routefix Daemonset", func() {
+	// remove this once the change where the operator manages the routefix
+	// daemonset is in production
+	Specify("routefix DaemonSet must be Ready", func() {
+		dsReady := func() (bool, error) {
+			done, err := ready.CheckDaemonSetIsReady(context.Background(), clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix"), "routefix")()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+	})
+	Specify("routefix Pods must all be Running before testing DaemonSet deletion", func() {
+		dsReady := func() (bool, error) {
+			clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix")
+			done, err := ready.CheckPodsAreRunning(context.Background(), clients.Kubernetes.CoreV1().Pods("openshift-azure-routefix"), map[string]string{"app": "routefix"})()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+	})
+	Specify("routefix must be repaired if DaemonSet is deleted", func() {
+		dsReady := func() (bool, error) {
+			done, err := ready.CheckDaemonSetIsReady(context.Background(), clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix"), "routefix")()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+		// delete the routefix daemonset
+		err = clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix").Delete(context.Background(), "routefix", metav1.DeleteOptions{})
+		Expect(err).NotTo(HaveOccurred())
+
+		// wait for it to be fixed
+		err = wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+
+		_, err = clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix").Get(context.Background(), "routefix", metav1.GetOptions{})
+		Expect(err).NotTo(HaveOccurred())
+	})
+	Specify("routefix Pods must all be Running after testing DaemonSet deletion", func() {
+		dsReady := func() (bool, error) {
+			clients.Kubernetes.AppsV1().DaemonSets("openshift-azure-routefix")
+			done, err := ready.CheckPodsAreRunning(context.Background(), clients.Kubernetes.CoreV1().Pods("openshift-azure-routefix"), map[string]string{"app": "routefix"})()
+			if err != nil {
+				log.Warn(err)
+			}
+			return done, nil // swallow error
+		}
+
+		err := wait.PollImmediate(30*time.Second, 15*time.Minute, dsReady)
+		Expect(err).NotTo(HaveOccurred())
+	})
+})
+
 var _ = Describe("ARO Operator - Cluster Monitoring ConfigMap", func() {
 	Specify("cluster monitoring configmap should not have persistent volume config", func() {
 		var cm *corev1.ConfigMap