Change from Permissive to Preferred networkIsolationPolicy

[ericstj]

See https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-build/cloudbuild/security/1espt-network-isolation

CFSClean will apply policy that blocks public package manager endpoints.

Permissive allows everything else, but we shouldn't do this by default.

Let's try being more restrictive and only add Permissive if we don't have more granular policies to enable.

[ericstj]

Official build: https://dev.azure.com/dnceng/internal/_build/results?buildId=2811134&view=results

Do not merge this until we examine the results of hte official build.

@akoeplinger has also suggested we may not need CFSClean at all, and it will be applied for us automatically after a week of not accessing those public package manager endpoints.

[ericstj]

Don't merge, as removing Permissive appears to have broken the build.

[akoeplinger]

@akoeplinger has also suggested we may not need CFSClean at all, and it will be applied for us automatically after a week of not accessing those public package manager endpoints.

If we don't set any networkIsolationPolicy at all then that will be the case, I assume if you want to opt in to Preferred then we do need to set CFSClean as well.

[ericstj]

If we don't set any networkIsolationPolicy at all then that will be the case, I assume if you want to opt in to Preferred then we do need to set CFSClean as well.

Yep, that's what I was testing. However setting Preferred was still broken https://dev.azure.com/dnceng/internal/_build/results?buildId=2811278&view=logs&j=bb592630-4b9d-53ad-3960-d954a70a95cf&t=82cecee5-f4fc-52a3-8653-5ec2442d35c9

The arcade-injected step Install MicroBuild plugin was failing which seemed to failing to download a copy of nuget.exe from https://dist.nuget.org/win-x86-commandline/latest/nuget.exe. @mmitche

[mmitche]

The arcade-injected step Install MicroBuild plugin was failing which seemed to failing to download a copy of nuget.exe from https://dist.nuget.org/win-x86-commandline/latest/nuget.exe. @mmitche

The MIcrobuild guys were looking into whether they can just use dotnet nuget install.