Deploy custom policy as part of cluster deployment

[ulkeba]

PR contains:

• Motivation to deploy a custom policy (Ingress hosts must have a well-defined domain suffix.)
• Code to deploy the custom policy using Azure Policy.
• Validation procedure, illustrating how creation of a violating resource will be rejected.

[ulkeba]

I decided for a Base64-coded specification of the Gatekeeper policy. The advantage is that the bicep is self-containing and we do not have a dependency of an external file we'd need to download from a GitHub repository. The disadvantage is that users cannot really read it.

We could (a) leave it like that, (b) commit the policy into the repository (for reference only) and link in the explanation, (c) replace the encoding with the URL to the (readable) spec.

Any thoughts on this?

[ckittel]

I think this is great, @ulkeba. THANK YOU. Can you consider my suggestions below?

[ulkeba]

I decided for a Base64-coded specification of the Gatekeeper policy. The advantage is that the bicep is self-containing and we do not have a dependency of an external file we'd need to download from a GitHub repository. The disadvantage is that users cannot really read it.

We could (a) leave it like that, (b) commit the policy into the repository (for reference only) and link in the explanation, (c) replace the encoding with the URL to the (readable) spec.

Any thoughts on this?

Any thoughts on this? ☝️

[ckittel]

Any thoughts on this? ☝️

I have no problem with it base64 encoded like you have it, without having to maintain a shadow copy. I was going to link to a base64 decoder in a comment, but didn't see any that MSFT owned publicly so I passed on that. If you wanted to give the user a hint, you can add a comment that says the body is base64 encoded, and if they wish to view it, to open it in a decoder. But I wouldn't worry about it.

[ckittel]

Looks like there are some merge conflicts @ulkeba -- if you can address those, and if you wanted to do any suggestions for the user to check out a decoder for the contents, then we'd be good to go with this.

[ckittel]

This is great! Thank you, @ulkeba!