Azure AKS custom policy to disable/Deny addon HTTP routing. (just like the Builtin addon for AKS azure policy)

Question

I am trying to create a Custom policy to prevent users to use the addon HTTP routing in AKS managed service.

it seems there is no alias for httpApplicationRouting

it exists in the ARM Template though....

I could hijack the template before actually building the cluster.

The custom policy I thought is very similar to this one: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0a15ec92-a229-4763-bb14-0ea34a568f8d

A summary of my policy would be this:

{  
  "properties": {  
    "displayName": "Deny HTTP Routing in Azure AKS managed Clusters",  
    "policyType": "Custom",  
    "mode": "Indexed",  
    "description": "Deny HTTP Routing in Azure AKS managed Clusters",  
    "metadata": {  
      "version": "1.0.1",  
      "category": "Kubernetes"  
    },  
    "parameters": {  
      "effect": {  
        "type": "String",  
        "metadata": {  
          "displayName": "Effect",  
          "description": "Enable or disable the execution of the policy"  
        },  
        "allowedValues": [  
          "Audit",  
          "Disabled"  
           "Deny"  

 
        ],  
        "defaultValue": "Deny"  
      }  
    },  
    "policyRule": {  
      "if": {  
        "allOf": [  
          {  
            "field": "type",  
            "equals": "Microsoft.ContainerService/managedClusters"  
          },                
           {  
                "field": "Microsoft.ContainerService/managedClusters/addonProfiles.httpApplicationRouting.enabled",  
                "equals": "true"  
            }  
              
          }  
        ]  
      },  
      "then": {  
        "effect": "[parameters('effect')]"  
      }  
    }  
  },  
      

but changes azurepolicy -> httpApplicationRouting...

any tips appreciated...

right now if I create a dummy cluster it passes on all validation...so policy doesn't work out

this alias is not on the official list... Am I missing something?

so I cannot really prevent users of using HTTP routing add-on inside AKS .
Any tips?

Answer 1

Your path is missing the properties section, it should be:

field": "Microsoft.ContainerService/managedClusters/properties/addonProfiles.httpApplicationRouting.enabled"  

Answer 2

Thanks a lot, I am gonna test it =)

Answer 3

Doesnt work...