fix: harden harden-runner egress policy

[tallaxes]

Description

Switch to Harden Runner egress-policy: block, add selected allowed-endpoints. Also disable-telemetry: true for now.

The endpoints come from StepSecurity insights for corresponding runs (such as this one; "Recommendations" tab as base, "Networks Events" for further drill down), with some selected wildcarding (to accommodate variations) and removals (mostly things that are no longer used, but might still be reported in the cumulative insights). Notes and outliers:

• The largest set of endpoints is (naturally) used by E2E tests, which use az CLI, create AKS clusters, and run tests. The only one using wildcards.
• Historically observed but removed: 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com - blob storage for cgr.dev, and we no longer use Chainguard for base images
• clients3.google.com:80 and firebaselogging-pa.googleapis.com:443 - confirmed Skaffold, likely telemetry, likely can be avoided/blocked with/after skaffold config set --global collect-metrics false
• There are no changes to "Build and publish to MCR" workflow, as it runs on self-hosted 1ES pool. (Use of Harden Runner in that context needs to be reviewed separately.)

How was this change tested?

• Selected checks (using the updated workflows) passed

Does this change impact docs?

• Yes, PR includes docs updates
• Yes, issue opened: #
• No

Release Note

[coveralls]

Pull Request Test Coverage Report for Build 10729088440

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 97.702%

---

Totals
Change from base Build 10709390831:	0.0%
Covered Lines:	36313
Relevant Lines:	37167

---

💛 - Coveralls

[tallaxes]

/test

[charliedmcb]

E2E Run:

• https://github.com/Azure/karpenter-provider-azure/actions/runs/10728344943

[charliedmcb]

Overall, looks pretty good. Mostly nits.

However, do have a bit larger concern for dev flow impact. If we update the workflows, and need to add new allowed-endpoints, will there be an easy way to determine what those endpoints we need to add are?

Also, need to confirm E2E tests pass.

[tallaxes]

However, do have a bit larger concern for dev flow impact. If we update the workflows, and need to add new allowed-endpoints, will there be an easy way to determine what those endpoints we need to add are?

Yes, likely using either the failure itself or Harden Runner post-action log (or report in the action run summary). If this fails - setting disable-telemetry: false temporarily, do another run, and use StepSecurity report. (We are also likely to switch telemetry back on permanently after some further internal review.)

[charliedmcb]

lgtm. 1 nit

[charliedmcb]

However, do have a bit larger concern for dev flow impact. If we update the workflows, and need to add new allowed-endpoints, will there be an easy way to determine what those endpoints we need to add are?

Yes, likely using either the failure itself or Harden Runner post-action log (or report in the action run summary). If this fails - setting disable-telemetry: false temporarily, do another run, and use StepSecurity report. (We are also likely to switch telemetry back on permanently after some further internal review.)

Ok, sounds good.

[charliedmcb]

lgtm