Shiraz got me going in the right direction.
However, the only relevant part is this part:
https://learn.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops#azure-pipelines-agents
Relevant being that my build and deployment agents are Microsoft hosted. The article Shiraz linked to primarily deals with on-premises Azure DevOps:
Azure DevOps Services | Azure DevOps Server 2020 | Azure DevOps Server 2019 | TFS 2018 - TFS 2015
At any rate, this is the relevant documentation for Microsoft hosted agents:
https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops&tabs=yaml#networking
Basically, two options:
Downloading the weekly JSON Azure IP Ranges and then adding every IP for your geographic area under the AzureDevOps.{region} sections. So if you are in the CentralUS region, it is not sufficient to just add that region. You have to add all the regions in the US because it could potentially us a different region when using the build and deployment agents.
Writing a simple program to parse the json file for you and gather all of the relevant IPs. The example the documentation uses:
using Newtonsoft.Json.Linq;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
namespace WeeklyFileIPRanges
{
class Program
{
// Path to the locally saved weekly file
const string weeklyFilePath = @"C:\MyPath\ServiceTags_Public_20200504.json";
static void Main(string[] args)
{
// United States geography has the following regions:
// Central US, East US 2, East US, North Central US,
// South Central US, West Central US, West US, West US 2
List<string> USGeographyRegions = new List<string>
{
"centralus",
"eastus",
"eastus2",
"northcentralus",
"southcentralus",
"westcentralus",
"westus",
"westus2"
};
// Load the weekly file
JObject weeklyFile = JObject.Parse(File.ReadAllText(weeklyFilePath));
JArray values = (JArray)weeklyFile["values"];
foreach (string region in USGeographyRegions)
{
string azureCloudRegion = $"AzureCloud.{region}";
Console.WriteLine(azureCloudRegion);
var ipList =
from v in values
where (string)v["name"] == azureCloudRegion
select v["properties"]["addressPrefixes"];
foreach (var ip in ipList.Children())
{
Console.WriteLine(ip);
}
}
}
}
}
Then to add the IPs you would use something like:
az aks update -g <resource_group> -n <aks_deployment_name> --api-server-authorized-ip-ranges [every,single,ip,address,for,the,geographic,area]
If anyone has a better way, I'll gladly accept that as the answer. There has to be one given that that is +1600 IPs for the US geo area and --api-server-authorized-ip-ranges will only take a maximum of 200.
At that point, it is just easier to erase the authorized IP addresses temporarily.
There is some promising stuff here though:
How to get the IP Address for Azure DevOps Hosted Agents to add to the white list
