Update AKS_DisableRunCommand_Deploy.json

[denniszielke]

If dnsprefix is not set on the cluster then the policy will fail. So this check should prevent that.
However it might be more suitable to upgrade the ARM api version to a more recent level and make the upgrade only change one value and not write every value.

[robga]

Changes can not be made to built-in policies directly in this repo. If you find an issue in a built-in policy, feel free to open an issue, or open a Microsoft Azure support ticket. Changes to built-ins are made out-of-band and will be represented in this repo after the next built-in policy release.
https://github.com/Azure/azure-policy/tree/master/built-in-policies#contributing

I have notified the team owns the built-in policy. They will triage.

[fseldow]

Hi @denniszielke
thanks for feedback
may have one quick question, can you share the scenario that cluster without dnsprefix. it should be abnormal that dnsprefix does not exist for one existed cluster from my side

[fseldow]

about However it might be more suitable to upgrade the ARM api version to a more recent level and make the upgrade only change one value and not write every value.

Currently, we have design confliction between policy 'deny' policy with AKS partial put. It means if the dine policy does not provide the full template, it will be possible be rejected by 'deny' policy because the deny effect policy will only check the request body and assume all put request should be full. Though we have stopped providing more 'deny' effect control plane AKS built-in policies, customers may still have their own customer policies. That is the reason we choose to provide full arm template as possible.

About apiversion upgrade, i will try to bump it as possible. The concern is that, the newer api will contain more conflict properties. Some of them require linked permission that on included in any of built-in role. So the bump progress might be slow.

[denniszielke]

@fseldow I have a set of customers that created clusters where that policy always fails because that property is not set.
The added if clause fixed it for them, hence the ask to fix the policy.

[fseldow]

the policy is updated without dnsprefix so that it should not catch that error. Since i cannot repro empty dnsprefix from my side, please contact me if the issue still presist. @denniszielke