Bug Report: Policy initiative defines unused zoneId for AKS

[juanandmsft]

Describe the bug
The ESLZ policy initiative defines "azureKubernetesManagementPrivateDnsZoneId": "privatelink.{regionName}.azmk8s.io", in the "dnsZoneNames" parameter, but then is not used. AKS PE is kind of special and does not have a groupId that policy can rely on, and managed by cluster creation.

[Springstone]

@juanandmsft what is the workaround for this issue?

[juanandmsft]

@Springstone ,
As far as I know, there is no workaround other than allow workload teams access to the "privatelink.{regionName}.azmk8s.io" zone during AKS deployment, or use set private dns zone at "none" (i.e. az cli "--private-dns-zone none") and add DNS record manually.

The challenge with granting access to "privatelink.{regionName}.azmk8s.io" is that different workload teams may interfere with each other, but fortunately AKS supports subzones, so can use "team1.privatelink.{regionName}.azmk8s.io", "team2.privatelink.{regionName}.azmk8s.io", etc. and get separated RBAC for different teams/workloads.