Prevent Assignment of Reserved CIDRs to Subnets

[MrCaedes]

Overview

This PR introduces a new Azure Policy definition as part of /Network.

The policy enables for CIDRs to be configured as non-usable by subnets; this can be useful in self-governing teams where a large range is allocated - but wish to earmark portions for specific purposes, such as future expansion, shared services, etc.

Problem Statement

In enterprise environments with decentralized subscription ownership, teams often receive large IP address allocations to manage independently. Without guardrails, there's a risk that subnets could inadvertently consume IP ranges earmarked for,

• Shared Services (e.g., if the team is offering a service to others)
• Future Growth (e.g., planned expansions of AKS, etc)

What the Policy Does

This policy uses ipRangeContains to perform bi-directional overlap detection.

The intent is for this to be used in combination with "Exemptions", to provide just-in-time provisioning ability - whilst providing a hard guardrail.

If Azure Policy becomes identity-aware in the future, there is also scope for this to be used such that only X user may leverage specific ranges - useful in platform-team scenarios.

[gregslack78]

Going to test this one and put it through the policy authoring agent.

[gregslack78]

Policy authoring agent output...

Evaluation:
Correctness:
The logic for detecting overlap uses Azure's built-in ipRangeContains function to ensure checks are done against both the CIDR ranges and the subnets.
Functionality:
This policy should work as intended, evaluating virtual networks and subnets for compliance with the restricted CIDR ranges provided.
Conclusion:
The policy should effectively enforce limits on CIDR overlap, with a configurable effect to either audit or deny infractions. It should operate properly in Azure environments as long as the defined logic matches the expected compliance rules.