Azure Policy for Kubernetes releases support for custom policy

Published Sep 01 2021 12:08 PM 2,853 Views
Microsoft

Azure Policy and AKS teams are excited to announce the public preview of custom policy support for Azure Kubernetes Service (AKS) clusters!

 

With this feature is enabled, you can create and assign custom policy definitions and constraint templates to your AKS clusters. We are also rolling out some exciting enhancements to the AKS policy such as enhanced error state information for troubleshooting, definition schema changes to auto-generate constraints instead of requiring customer input, VS Code extension for Azure Policy update for easier authoring, and an embedded constraint template inside the policy definition to not have dependency on an external endpoint.

 

Let’s walk through the cool new features step-by-step! 

 

Embed Your Constraint Template Using TemplateInfo  

 

 

 

 

 

 

"then": { 
        "effect": "[parameters('effect')]", 
        "details": { 
          "templateInfo": { 
            "sourceType": "PublicURL", 
            "url": https://store.policy.core.windows.net/kubernetes/container-allowed-images/v1/template.yaml 
          } 
} 

 

 

 

 

 

 

Azure Policy is introducing a new property known as templateInfo that allows users to define the source type for the constraint template. By defining templateInfo in policy definitions, users  don’t have to define constraintTemplate or constraint properties. Users still need to define apiGroups and kinds — more on that below. TemplateInfo initially supports two ways to define the constraint template source type: Base64Encoded and PublicUrlBase64Encoded format allows users to privately embed the constraint template within a policy definition.   

 

Learn more about templateInfo in our documentation 

 

Generate Custom Policy Definitions Using Azure Policy’s Visual Studio Code Extension 

 

Users are encouraged to use the Azure Policy Visual Studio (VS) Code Extension to use this new capability and create their custom Microsoft.Kubernetes.Data definitions seamlessly. With the VS Code Extension, once a user provides any Open Policy Agent  (OPA) GateKeeper v3  constraint template, they can auto-generate their policy definition JSON file!   

 

Here’s how it works: 

  1. Confirm you’ve installed the Azure Policy VS Code Extension 
  1. Open up the valid constraint template YAML file as you would to reference it in your policy definition. You need to have the YAML file open for the Command Palette to display the auto-generation  option. 
  1. From the menu bar, go to  View > Command Palette, and enter  Azure Policy for Kubernetes: Create Policy Definition from Constraint Template. 

```````````````````````````` ````````NehaKulkarni_0-1630523155184.png

 

  1. Select the appropriate  sourceType  value. This is where you can choose how you want your constraint template to be referenced in your policy definition — as a public URL or privately encoded within the policy definition using Embedded format. 

                                    NehaKulkarni_1-1630523212075.png

 

  1. Let’s select the Base64Encoded (Embedded) option to check it out Once you select it, voilà! A new file opens up with your auto-generated policy definition. Make sure to fill in the  /* EDIT HERE */ portions of the policy definition JSON with actual values: 
 

NehaKulkarni_12-1630342241003.png

 

Remember to take this completed policy definition JSON to the Azure portal or another supported SDK to create the policy definition within your Azure environment. 

 

Learn more about the Azure Policy VS Code Extension in our documentation. 

 

Defining API Groups & Kinds In Your Custom Definitions 

 

It’s important to note that with the new templateInfo property, users are expected to define apiGroups and kinds directly in their policy definitions since constraint and constraintTemplate properties are not used. 

 

Here’s a quick refresher of apiGroups and kinds: 

 

Users have seen these fields in a constraint file previously, like this:

 

NehaKulkarni_13-1630342470218.png

 

Let’s go through a quick example!

 

We would like to create a custom policy definition that specifies that AKS clusters that follow a specific naming convention and only uses allowed images. We will use a constraint template from the Azure Policy library. 

 

We defined apiGroups as [“”]  because we chose to include the core apiGroup. 

 

We decided to specify “Pod” in the kinds property to limit constraint application to the pod level. 

 

Therefore, using the VS Code Extension to generate our Azure Policy custom policy definition and inputting the right values, the ‘then’ clause of our policy definition would look like this: 

 

 

"then": {
        "effect": "[parameters('effect')]",
        "details": {
          "templateInfo": {
            "sourceType": "PublicURL",
            "url": https://store.policy.core.windows.net/kubernetes/container-allowed-images/v1/template.yaml
          },
          "excludedNamespaces": "[parameters('excludedNamespaces')]",
          "namespaces": "[parameters('namespaces')]",
          "values": {
            imageRegex: "^.+azurecr.io\/.+$",
            "excludedNamespaces": "[parameters('excludedNamespaces')]"
          },
          "apiGroups": [
            ""
          ],
          "kinds": [
            "Pod"
          ]
        }
      }

 

 

 

 

 

Let us know what you think of these additions to the Azure Policy experience in the comments below! 

%3CLINGO-SUB%20id%3D%22lingo-sub-2699466%22%20slang%3D%22en-US%22%3EAzure%20Policy%20for%20Kubernetes%20releases%20support%20for%20custom%20policy%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2699466%22%20slang%3D%22en-US%22%3E%3CP%3EAzure%20Policy%20and%20AKS%20teams%20are%20excited%20to%20announce%20the%20public%20preview%20of%20custom%20policy%20support%20for%20Azure%20Kubernetes%20Service%20(AKS)%20clusters!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20this%20feature%20is%20enabled%2C%20you%20can%20create%20and%20assign%20custom%20policy%20definitions%20and%20constraint%20templates%20to%20your%20AKS%20clusters.%20We%20are%20also%20rolling%20out%20some%20exciting%20enhancements%20to%20the%20AKS%20policy%20such%20as%20enhanced%20error%20state%20information%20for%20troubleshooting%2C%20definition%20schema%20changes%20to%20auto-generate%20constraints%20instead%20of%20requiring%20customer%20input%2C%20VS%20Code%20extension%20for%20Azure%20Policy%20update%20for%20easier%20authoring%2C%20and%20an%20embedded%20constraint%20template%20inside%20the%20policy%20definition%20to%20not%20have%20dependency%20on%20an%20external%20endpoint.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3ELet%E2%80%99s%20walk%20through%20the%20cool%20new%20features%20step-by-step!%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22TextRun%20SCXW58287204%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW58287204%20BCX0%22%3E%E2%80%AF%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW58287204%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20CommentStart%20CommentHighlightPipeRest%20CommentHighlightRest%20SCXW58287204%20BCX0%22%3EEmbed%20Your%20Constraint%20Template%20Using%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SpellingErrorV2%20CommentHighlightRest%20SCXW58287204%20BCX0%22%3ET%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SpellingErrorV2%20CommentHighlightRest%20SCXW58287204%20BCX0%22%3EemplateInfo%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20CommentHighlightRest%20SCXW58287204%20BCX0%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20CommentHighlightPipeRest%20SCXW58287204%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3E%22then%22%3A%E2%80%AF%7B%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%22effect%22%3A%E2%80%AF%22%5Bparameters('effect')%5D%22%2C%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%22details%22%3A%E2%80%AF%7B%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%22templateInfo%22%3A%E2%80%AF%7B%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%22sourceType%22%3A%E2%80%AF%22PublicURL%22%2C%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%22url%22%3A%E2%80%AFhttps%3A%2F%2Fstore.policy.core.windows.net%2Fkubernetes%2Fcontainer-allowed-images%2Fv1%2Ftemplate.yaml%20%0A%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%E2%80%AF%7D%20%0A%7D%20%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EAzure%20Policy%26nbsp%3Bis%26nbsp%3Bintroducing%26nbsp%3Ba%20new%20property%20known%20as%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EtemplateInfo%3C%2FSPAN%3E%3C%2FI%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bthat%20allows%20users%20to%20define%20the%20source%20type%20for%20the%20constraint%20template.%26nbsp%3BBy%20defining%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EtemplateInfo%26nbsp%3B%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3Ein%20policy%20definitions%2C%20users%26nbsp%3B%26nbsp%3Bdon%E2%80%99t%26nbsp%3Bhave%20to%20define%20constraintTemplate%20or%20constraint%20properties.%20Users%26nbsp%3Bstill%26nbsp%3Bneed%20to%20define%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EapiGroups%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3Ekinds%26nbsp%3B%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%94%26nbsp%3Bmore%20on%20that%20below.%26nbsp%3B%3C%2FSPAN%3E%3CEM%3ETemplateInfo%26nbsp%3B%3C%2FEM%3Einitially%20supports%26nbsp%3Btwo%20ways%20to%20define%20the%20constraint%20template%20source%20type%3A%26nbsp%3B%3CEM%3EBase64Encoded%26nbsp%3B%3C%2FEM%3Eand%26nbsp%3B%3CEM%3EPublicUrl%3C%2FEM%3E.%26nbsp%3B%3CEM%3EBase64Encoded%26nbsp%3B%3C%2FEM%3Eformat%20allows%26nbsp%3Busers%20to%26nbsp%3Bprivately%26nbsp%3Bembed%20the%20constraint%20template%20within%20a%20policy%20definition.%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3ELearn%20more%20about%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fpolicy%2Fconcepts%2Feffects%23audit-properties%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%3E%3CI%3EtemplateInfo%26nbsp%3B%3C%2FI%3Ein%20our%20documentation%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EGenerate%20Custom%20Policy%20Definitions%20Using%20Azure%20Policy%E2%80%99s%26nbsp%3BVisual%26nbsp%3BStudio%26nbsp%3BCode%20Extension%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EUsers%20are%20encouraged%20to%20use%20the%20Azure%20Policy%26nbsp%3BVisual%20Studio%20(VS)%26nbsp%3BCode%20Extension%20to%20use%20this%20new%26nbsp%3Bcapability%26nbsp%3Band%20create%20their%20custom%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft.Kubernetes.Data%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bdefinitions%20seamlessly.%20With%20the%20VS%20Code%20Extension%2C%20once%20a%20user%20provides%20any%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fwww.openpolicyagent.org%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EOpen%20Policy%20Agent%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%E2%80%AF(OPA)%26nbsp%3BGateKeeper%26nbsp%3Bv3%26nbsp%3B%E2%80%AF%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fopen-policy-agent.github.io%2Fgatekeeper%2Fwebsite%2Fdocs%2Fhowto%2F%23constraint-templates%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Econstraint%20template%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%2C%20they%20can%20auto-generate%26nbsp%3Btheir%26nbsp%3Bpolicy%20definition%26nbsp%3BJSON%20file!%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EHere%E2%80%99s%20how%26nbsp%3Bit%26nbsp%3Bworks%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3COL%3E%0A%3CLI%20data-leveltext%3D%22%251.%22%20data-font%3D%22Segoe%20UI%2CTimes%20New%20Roman%22%20data-listid%3D%225%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EConfirm%26nbsp%3Byou%E2%80%99ve%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fpolicy%2Fhow-to%2Fextension-for-vscode%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Einstalled%20the%20Azure%20Policy%20VS%20Code%20Extension%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3COL%3E%0A%3CLI%20data-leveltext%3D%22%251.%22%20data-font%3D%22Segoe%20UI%2CTimes%20New%20Roman%22%20data-listid%3D%225%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EOpen%20up%20the%20valid%26nbsp%3Bconstraint%20template%26nbsp%3BYAML%20file%26nbsp%3Bas%26nbsp%3Byou%26nbsp%3Bwould%20to%20reference%26nbsp%3Bit%26nbsp%3Bin%20your%20policy%20definition.%20You%20need%26nbsp%3Bto%26nbsp%3Bhave%20the%20YAML%20file%20open%20for%20the%26nbsp%3BCommand%20Palette%20to%26nbsp%3Bdisplay%20the%20auto-generation%26nbsp%3B%26nbsp%3Boption.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3COL%3E%0A%3CLI%20data-leveltext%3D%22%251.%22%20data-font%3D%22Segoe%20UI%2CTimes%20New%20Roman%22%20data-listid%3D%225%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%223%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EFrom%20the%20menu%20bar%2C%20go%20to%E2%80%AF%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EView%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AF%26gt%3B%E2%80%AF%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3ECommand%20Palette%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%2C%20and%20enter%26nbsp%3B%E2%80%AF%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EAzure%20Policy%20for%20Kubernetes%3A%20Create%20Policy%20Definition%20from%20Constraint%20Template%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%60%20%60%60%60%60%60%60%60%60%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22NehaKulkarni_0-1630523155184.png%22%20style%3D%22width%3A%20622px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F307371i42B11514EA5DCBC3%2Fimage-dimensions%2F622x283%3Fv%3Dv2%22%20width%3D%22622%22%20height%3D%22283%22%20role%3D%22button%22%20title%3D%22NehaKulkarni_0-1630523155184.png%22%20alt%3D%22NehaKulkarni_0-1630523155184.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%224%22%3E%0A%3CLI%3E%3CSPAN%20class%3D%22TextRun%20SCXW5548393%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3ESelect%20the%20%3CSPAN%20class%3D%22TextRun%20%20BCX0%20SCXW57121610%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%3Eappropriate%E2%80%AF%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20class%3D%22TextRun%20%20BCX0%20SCXW57121610%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%20data-ccp-charstyle%3D%22Emphasis%22%3EsourceTyp%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%20data-ccp-charstyle%3D%22Emphasis%22%3Ee%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%20data-ccp-charstyle%3D%22Emphasis%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20class%3D%22TextRun%20%20BCX0%20SCXW57121610%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20%20BCX0%20SCXW57121610%22%3E%E2%80%AFvalue%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW5548393%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E.%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EThis%20is%20where%20you%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3Ecan%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Echoose%20how%20you%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ewant%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eyour%20constraint%20template%20to%20be%20referenced%20in%20your%20policy%20definition%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW5548393%20BCX0%22%3E%E2%80%94%20as%20a%20public%20URL%20or%20privately%20encoded%20within%20the%20policy%20definition%20using%20Embedded%20format.%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW5548393%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335551550%26quot%3B%3A6%2C%26quot%3B335551620%26quot%3B%3A6%2C%26quot%3B335559737%26quot%3B%3A130%2C%26quot%3B335559738%26quot%3B%3A240%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A252%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22NehaKulkarni_1-1630523212075.png%22%20style%3D%22width%3A%20607px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F307372iEB478EE87715CB72%2Fimage-dimensions%2F607x286%3Fv%3Dv2%22%20width%3D%22607%22%20height%3D%22286%22%20role%3D%22button%22%20title%3D%22NehaKulkarni_1-1630523212075.png%22%20alt%3D%22NehaKulkarni_1-1630523212075.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%20start%3D%225%22%3E%0A%3CLI%3E%3CSPAN%20class%3D%22TextRun%20SCXW245578491%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3ELet%E2%80%99s%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Eselect%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ethe%20Base64Encoded%20(Embedded)%20option%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eto%20check%20it%20out%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EOnce%20you%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Es%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Eelect%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Eit%2C%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20CommentStart%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Evoil%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%C3%A0%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E!%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EA%20new%20file%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20AdvancedProofingIssueV2%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Eopen%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20AdvancedProofingIssueV2%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Es%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20AdvancedProofingIssueV2%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eup%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ewith%20your%20auto-generated%20policy%20definition.%20Make%20sure%20to%20fill%20in%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ethe%E2%80%AF%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20class%3D%22TextRun%20SCXW245578491%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-charstyle%3D%22HTML%20Code%22%3E%2F*%20EDIT%20HERE%20*%2F%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20class%3D%22TextRun%20SCXW245578491%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSTRONG%3E%E2%80%AF%3C%2FSTRONG%3Eportions%20of%20the%20policy%20definition%20JSON%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW245578491%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ewith%20actual%20values%3A%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW245578491%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CDIV%20id%3D%22tinyMceEditorNehaKulkarni_4%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%20class%3D%22lia-indent-padding-left-150px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22NehaKulkarni_12-1630342241003.png%22%20style%3D%22width%3A%20638px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F306717i4A6E5842351C41E7%2Fimage-dimensions%2F638x259%3Fv%3Dv2%22%20width%3D%22638%22%20height%3D%22259%22%20role%3D%22button%22%20title%3D%22NehaKulkarni_12-1630342241003.png%22%20alt%3D%22NehaKulkarni_12-1630342241003.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorNehaKulkarni_5%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3ERemember%20to%20take%20this%26nbsp%3Bcompleted%20policy%20definition%20JSON%26nbsp%3Bto%26nbsp%3Bthe%20Azure%20portal%20or%26nbsp%3Banother%26nbsp%3Bsupported%20SDK%20to%20create%20the%20policy%20definition%20within%20your%20Azure%20environment.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3ELearn%20more%26nbsp%3Babout%26nbsp%3Bthe%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fgovernance%2Fpolicy%2Fhow-to%2Fextension-for-vscode%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EAzure%20Policy%20VS%20Code%20Extension%26nbsp%3Bin%20our%20documentation%3C%2FA%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22TextRun%20SCXW89316755%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EDefining%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EAPI%20G%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Eroups%20%26amp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EKi%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Ends%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EIn%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3BYour%20Custom%20Definition%3C%2FSPAN%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW89316755%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Es%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW89316755%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EIt%E2%80%99s%20important%20to%20note%20that%20with%20the%20new%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EtemplateInfo%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bproperty%2C%20users%26nbsp%3Bare%26nbsp%3Bexpected%20to%20define%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EapiGroups%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3Ekinds%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bdirectly%26nbsp%3Bin%20their%20policy%20definitions%26nbsp%3Bsince%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3Econstraint%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EconstraintTemplate%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bproperties%26nbsp%3Bare%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3Enot%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bused.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EHere%E2%80%99s%20a%20quick%20refresher%20of%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EapiGroups%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3Ekinds%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22-%22%20data-font%3D%22Calibri%22%20data-listid%3D%227%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%220%22%20data-aria-level%3D%221%22%3E%3CSTRONG%3E%3CI%3E%3CSPAN%20data-contrast%3D%22auto%22%3EapiGroups%3C%2FSPAN%3E%3C%2FI%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Brefers%20to%20the%26nbsp%3Btype%26nbsp%3Bof%20Kubernetes%20object%26nbsp%3Bthat%26nbsp%3Bthe%20constraint%26nbsp%3Bis%26nbsp%3Bapplied%20to.%20You%20can%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fkubernetes.io%252Fdocs%252Freference%252Fusing-api%252F%2523api-groups%26amp%3Bdata%3D04%257C01%257Cnehakulkarni%2540microsoft.com%257Cff54d5a4008146a79bf508d9698b5759%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637656869461463113%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3Bsdata%3DOjEVjRH4jB25Tcr9d1Dy%252BGy39rUiC6V4FlDbvO5SzN4%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%3Elearn%20more%20about%20apiGroups%20in%20the%20Kubernetes%20documentation%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22-%22%20data-font%3D%22Calibri%22%20data-listid%3D%227%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%220%22%20data-aria-level%3D%221%22%3E%3CSTRONG%3E%3CI%3E%3CSPAN%20data-contrast%3D%22auto%22%3Ekinds%3C%2FSPAN%3E%3C%2FI%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Brefers%20to%20the%20kind%20of%20Kubernetes%20objects%20the%20constraint%26nbsp%3Bis%26nbsp%3Bapplied%20to%2C%20such%20as%20a%20%E2%80%9CPod%E2%80%9D.%20You%20can%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fkubernetes.io%252Fdocs%252Fconcepts%252Foverview%252Fworking-with-objects%252Fkubernetes-objects%252F%2523required-fields%26amp%3Bdata%3D04%257C01%257Cnehakulkarni%2540microsoft.com%257Cff54d5a4008146a79bf508d9698b5759%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637656869461583031%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3Bsdata%3DTGhw%252FbgtcuywfLhdHaHp4JhM5ugzJetGvmD%252BdhmQcag%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%3Elearn%20more%20about%20kinds%20in%20the%20Kubernetes%20documentation%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EUsers%20have%20seen%20these%20fields%20in%20a%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fopen-policy-agent.github.io%252Fgatekeeper%252Fwebsite%252Fdocs%252Fhowto%2523constraints%26amp%3Bdata%3D04%257C01%257Cnehakulkarni%2540microsoft.com%257Cff54d5a4008146a79bf508d9698b5759%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637656869461593027%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3Bsdata%3D1biVX1xcj8raCXqaVM3zrApoCmXxJRQ2fHPxbd5HREI%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Econstraint%20file%3C%2FSPAN%3E%3C%2FA%3E%26nbsp%3Bpreviously%3CSPAN%20data-contrast%3D%22auto%22%3E%2C%20like%20this%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorNehaKulkarni_7%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%20class%3D%22lia-indent-padding-left-180px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22NehaKulkarni_13-1630342470218.png%22%20style%3D%22width%3A%20581px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F306718i39477CE6C94BA675%2Fimage-dimensions%2F581x255%3Fv%3Dv2%22%20width%3D%22581%22%20height%3D%22255%22%20role%3D%22button%22%20title%3D%22NehaKulkarni_13-1630342470218.png%22%20alt%3D%22NehaKulkarni_13-1630342470218.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ELet%E2%80%99s%20go%20through%20a%20quick%20example!%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EWe%20would%20like%20to%20create%20a%20custom%20policy%20definition%20that%20specifies%20that%20AKS%20clusters%20that%20follow%20a%20specific%20naming%20convention%20and%20only%20uses%20allowed%20images.%20We%20will%20use%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fstore.policy.core.windows.net%2Fkubernetes%2Fcontainer-allowed-images%2Fv1%2Ftemplate.yaml%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ea%20constraint%20template%20from%20the%20Azure%20Policy%20library%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EWe%20defined%26nbsp%3BapiGroups%26nbsp%3Bas%20%5B%E2%80%9C%E2%80%9D%5D%26nbsp%3B%26nbsp%3Bbecause%26nbsp%3Bwe%20chose%20to%20include%26nbsp%3Bthe%20core%26nbsp%3BapiGroup.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EWe%26nbsp%3Bdecided%26nbsp%3Bto%20specify%20%E2%80%9CPod%E2%80%9D%20in%20the%26nbsp%3B%3C%2FSPAN%3E%3CI%3E%3CSPAN%20data-contrast%3D%22auto%22%3Ekinds%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Bproperty%26nbsp%3Bto%20limit%20constraint%20application%20to%20the%20pod%20level.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3ETherefore%2C%20using%20the%20VS%20Code%20Extension%20to%20generate%20our%26nbsp%3BAzure%20Policy%20custom%20policy%26nbsp%3Bdefinition%20and%20inputting%20the%20right%20values%2C%26nbsp%3Bthe%26nbsp%3B%E2%80%98then%E2%80%99%20clause%20of%26nbsp%3Bour%26nbsp%3Bpolicy%20definition%20would%20look%20like%20this%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3E%22then%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22effect%22%3A%20%22%5Bparameters('effect')%5D%22%2C%0A%20%20%20%20%20%20%20%20%22details%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22templateInfo%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%22sourceType%22%3A%20%22PublicURL%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22url%22%3A%20https%3A%2F%2Fstore.policy.core.windows.net%2Fkubernetes%2Fcontainer-allowed-images%2Fv1%2Ftemplate.yaml%0A%20%20%20%20%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%22excludedNamespaces%22%3A%20%22%5Bparameters('excludedNamespaces')%5D%22%2C%0A%20%20%20%20%20%20%20%20%20%20%22namespaces%22%3A%20%22%5Bparameters('namespaces')%5D%22%2C%0A%20%20%20%20%20%20%20%20%20%20%22values%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20imageRegex%3A%20%22%5E.%2Bazurecr.io%5C%2F.%2B%24%22%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%22excludedNamespaces%22%3A%20%22%5Bparameters('excludedNamespaces')%5D%22%0A%20%20%20%20%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%22apiGroups%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%22%22%0A%20%20%20%20%20%20%20%20%20%20%5D%2C%0A%20%20%20%20%20%20%20%20%20%20%22kinds%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%22Pod%22%0A%20%20%20%20%20%20%20%20%20%20%5D%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%7D%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%20us%20know%20what%20you%20think%20of%20these%20additions%20to%20the%20Azure%20Policy%20experience%20in%20the%20comments%20below!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2699466%22%20slang%3D%22en-US%22%3E%3CP%3EAzure%20Policy%20and%20AKS%20teams%20are%20excited%20to%20announce%20the%20public%20preview%20of%20custom%20policy%20support%20for%20Azure%20Kubernetes%20Service%20(AKS)%20clusters!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20this%20feature%20is%20enabled%2C%20you%20can%20create%20and%20assign%20custom%20policy%20definitions%20and%20constraint%20templates%20to%20your%20AKS%20clusters.%20We%20are%20also%20rolling%20out%20some%20exciting%20enhancements%20to%20the%20AKS%20policy%20such%20as%20enhanced%20error%20state%20information%20for%20troubleshooting%2C%20definition%20schema%20changes%20to%20auto-generate%20constraints%20instead%20of%20requiring%20customer%20input%2C%20VS%20Code%20extension%20for%20Azure%20Policy%20update%20for%20easier%20authoring%2C%20and%20an%20embedded%20constraint%20template%20inside%20the%20policy%20definition%20to%20not%20have%20dependency%20on%20an%20external%20endpoint.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2699466%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EGovernance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPolicy%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Co-Authors
Version history
Last update:
‎Sep 01 2021 12:08 PM
Updated by: