Enable CFSClean* policies for dotnet-buildtools-prereqs-docker pipelines#1609
Enable CFSClean* policies for dotnet-buildtools-prereqs-docker pipelines#1609
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Don't make changes to files under eng/docker-tools, they will get overwritten. Instead, pass the intended network isolation policies down to 1es.yml via the networkIsolationPolicy parameter (which you edited in this PR).
If 1es-official.yml or 1es-unofficial.yml are still used in this repo, migrate to 1es.yml instead. The older 1es-*.yml templates will be removed in a future update: dotnet/docker-tools#1892
@copilot Do this. |
This PR enables CFSClean and CFSClean2 network isolation policies across all 1ES pipeline templates in the repo.
Changes
etworkIsolationPolicy\ parameter default from \Permissive,CFSClean\ to \Permissive,CFSClean,CFSClean2. This template is used by the official and unofficial build pipelines.
etworkIsolationPolicy: Permissive,CFSClean,CFSClean2. This template previously had no network isolation settings.
etworkIsolationPolicy: Permissive,CFSClean,CFSClean2. This template previously had no network isolation settings.
Context
CFSClean2 is a new 1ES network isolation policy that needs to be enabled alongside CFSClean. The \Permissive\ base policy ensures builds continue to work while these security policies are applied.
Note: \�ng/pipelines/renovate.yml\ (referenced in the tracking CSV) does not exist in this repo. The renovate pipeline (AzDO ID 1594) may be configured outside the repo.