[Tom Kerkhove (tomkerkhove)]

Summary

Starts migrating PR and main Helm CI to Azure Pipelines, recovering the uncommitted implementation from the local tomkerkhove/azure-pipelines-migration worktree without modifying that worktree.

• Add PR and main definitions with shared documentation validation, Helm linting, tool installation, and Kind deployment templates.
• Preserve PR coverage across four Kubernetes versions × HA on/off × AMD64/ARM64, and main coverage across four versions × HA on/off × GatewayToken/AzureAdApp.
• Follow the service-connection and Key Vault task pattern in the existing APIM pipelines. Main uses AzureKeyVault@2 with a workload-identity Azure Resource Manager service connection; PR builds never receive Azure credentials.
• Use separate HelmDeploy@1 tasks for rendering and installation, with private temporary value files, hidden Secret manifests during dry runs, and always-run credential cleanup. Cluster setup and diagnostics are separate named steps.
• Synchronize Kubernetes image updates across both CI systems and preserve the v prefix required by Kubernetes download URLs.
• Document infrastructure prerequisites, permissions, fork-build isolation, and staged cutover.

Remaining setup before cutover

This migration is additive: GitHub Actions CI and required checks remain enabled. No Azure DevOps resources are provisioned and branch protection is unchanged.

• Register both YAML pipelines using the Azure Pipelines GitHub integration.
• Configure an isolated, disposable Linux ARM64 pool (apim-gateway-linux-arm64 is the configurable default).
• Select/configure the approved federated service connection (apim-gateway-ci is a placeholder), Key Vault access, variables/optional variable groups, and resource branch-control checks.
• Verify Azure DevOps template expansion and real deployments, then switch required checks before retiring GitHub CI.

PR deployments intentionally use dummy credentials and verify resource creation without gateway readiness. Main retains authenticated --wait --timeout 10m0s readiness checks. These standard Azure Pipelines definitions do not depend on internal OneBranch templates or repositories.

See docs/eng/azure-pipelines.md for setup and cutover details.

Local verification

• Helm lint for GatewayToken and AzureAdApp.
• YAML parsing and inline Bash syntax checks.
• Exercised inline credential preparation and cleanup, including missing, unresolved, and multiline input rejection.
• Actual chart rendering with the Helm tasks' value-file arguments for both authentication modes with HA on/off, confirming credentials containing commas/backslashes survive unchanged.
• Kubernetes matrix parity and a synthetic release exercise of the image updater across both CI systems.

Azure DevOps template expansion, task execution on ARM64, pool authorization, and authenticated Key Vault/Kind runs remain unverified until the infrastructure above is configured.