fix: use upsert at index 1 instead of append for tls_pem in enable-id…

[dtasSap]

…entity-aware-routing

Please take a moment to review the questions before submitting the PR

🚫 We only accept PRs to develop branch. If this is an exception, please specify why 🚫

WHAT is this change about?

Changes tls_pem/- (append) to tls_pem/1? (upsert) in operations/enable-identity-aware-routing.yml to fix an
incompatibility with operations/use-operator-provided-router-tls-certificates.yml.

What customer problem is being addressed? Use customer persona to define the problem e.g. Alana is unable to...

The experimental pipeline can't deploy cf-deployment with both enable-identity-aware-routing.yml and
use-operator-provided-router-tls-certificates.yml applied together. BOSH interpolation fails with:
Expected to find an array at path '.../tls_pem/-' but found 'string'
https://concourse.wg-ard.ci.cloudfoundry.org/teams/main/pipelines/cf-deployment/jobs/experimental-deploy/builds/2542

Please provide any contextual information.

use-operator-provided-router-tls-certificates.yml replaces the tls_pem array with an unresolved variable reference
((router_tls_pem)). At BOSH interpolation time, /- (append) cannot operate on an unresolved variable reference and
fails.

/1? (upsert) resolves after the variable is evaluated, so it works in both cases:

• Base manifest: tls_pem is a single-entry array → upsert adds at index 1
• With operator-provided certs: ((router_tls_pem)) is resolved to an array first → upsert adds at index 1

Related PRs:

• Add enable-identity-aware-routing ops-file (RFC0055) #1353 — introduced enable-identity-aware-routing.yml
• Add identity-aware-routing to experimental pipeline #1375 — adds identity-aware routing to the hermione experimental pipeline, where this conflict was discovered

Has a cf-deployment including this change passed cf-acceptance-tests?

• YES
• NO

Does this PR introduce a breaking change?

• YES
• NO

How should this change be described in cf-deployment release notes?

Fixes enable-identity-aware-routing.yml compatibility with use-operator-provided-router-tls-certificates.yml so Cody
can use both ops-files together without BOSH interpolation errors.

Does this PR introduce a new BOSH release into the base cf-deployment.yml manifest or any ops-files?

• YES
• NO

Does this PR make a change to an experimental or GA'd feature/component?

• experimental feature/component
• GA'd feature/component

Please provide Acceptance Criteria for this change?

• Urgent - unblocks current or future work
• Slightly Less than Urgent

Tag your pair, your PM, and/or team!

It's helpful to tag a few other folks on your team or your team alias in case we need to follow up later.