confcom: add kube-proxy fragment support for VN2 policies

[Takuro Sato (takuro-sato)]

Add --allow-kubeproxy for policy generation to include the image attached fragment for the kube-proxy sidecar.

e.g. az confcom acipolicygen --virtual-node-yaml info.yaml --allow-kubeproxy --outraw-pretty-print prints policy includes:

fragments := [
    { <infra fragment> },
    {
        "feed": "acidevacr.azurecr.io/internal/aci/sc-proxy",
        "includes": [
            "containers"
        ],
        "issuer": "did:x509:0:sha256:wVkSM46SDpw4LuyEYoH6r5ym07whL5lWxNlGN-UPtf4::eku:1.3.6.1.4.1.311.10.3.13",
        "minimum_svn": "1"
    }
]

Bump the confcom extension version to 2.3.0.

Test

Generated a policy for the  confidential-aci-dashboard VN2  payload and replaced the image-attached fragment feed with the feed for the dev kube-proxy image.
Confirmed that the kube-proxy container started with the replacement. Without the replacement (i.e. with the MCR feed) the container was rejected by the policy.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[Yong Zhang (yonzhan)]

confcom

[Copilot]

Copilot review overview

🟡 Changes recommended

Several user-facing descriptions omit the enforced Linux-only restriction.

Review effort: Balanced
Findings: 3

Open (3)

• Document Linux-only restriction for kube-proxy option · New
• Clarify kube-proxy option applies only to Linux VN2 policies · New
• Add Linux-only constraint to argument help text · New

What changed in this PR

Adds optional kube-proxy image-attached fragment support for Linux VN2 policy generation.

Changes:

• Adds and validates --allow-kubeproxy.
• Defines the kube-proxy fragment and tests YAML/JSON generation.
• Updates documentation and bumps the extension to 2.3.0.

File	Description
src/​confcom/​setup.py	Bumps version to 2.3.0.
src/​confcom/​HISTORY.rst	Records the new option.
src/​confcom/​azext_confcom/​tests/​latest/​test_confcom_acipolicygen_vn2.py	Tests fragment inclusion and validation.
src/​confcom/​azext_confcom/​security_policy.py	Allows mutation of empty fragment lists.
src/​confcom/​azext_confcom/​README.md	Documents the option.
src/​confcom/​azext_confcom/​docs/​acipolicygen.md	Documents usage and Linux scope.
src/​confcom/​azext_confcom/​data/​internal_config.json	Defines kube-proxy fragment metadata.
src/​confcom/​azext_confcom/​custom.py	Validates and adds the fragment.
src/​confcom/​azext_confcom/​config.py	Exposes fragment configuration.
src/​confcom/​azext_confcom/​_params.py	Registers the CLI argument.
src/​confcom/​azext_confcom/​_help.py	Adds command help.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Azure CLI Bot (azclibot)]

[Release] Update index.json for extension [ confcom ] : https://dev.azure.com/msazure/One/_build/results?buildId=183817273&view=results