Support for setting msi_auth_for_monitoring_enabled in oms_agent

[admincasper]

Is there an existing issue for this?

• I have searched the existing issues

Description

See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster

I need this change to set data collection parameters in AKS following hashicorp/terraform-provider-azurerm#21406.

I appreciate the work you guys are doing!

New or Affected Resource(s)/Data Source(s)

azurerm_kubernetes_cluster

Potential Terraform Configuration

# module.aks main.tf   
  dynamic "oms_agent" {
    for_each = var.log_analytics_workspace_enabled ? ["oms_agent"] : []

    content {
      log_analytics_workspace_id      = local.log_analytics_workspace.id
      msi_auth_for_monitoring_enabled = var.msi_auth_for_monitoring_enabled
    }
  }

# variables.tf
variable "msi_auth_for_monitoring_enabled" {
  type        = bool
  default     = false
  description = "(Optional) Is managed identity authentication for monitoring enabled? Defaults to `false`"
}

References

See PR: #446

[zioproto]

@lonegunmanb this seems to be GA:

• https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-authentication?tabs=terraform
• https://aka.ms/enable-monitoring-msi-terraform

[avekrivoy]

@zioproto @lonegunmanb could you please review this PR?

[tanvp112]

Looking forward for this PR and #451 to release soonest as these settings cannot be set outside the module...

[lonegunmanb]

I'm closing this issue since #446 has been merged.

[summahto]

Hi Everyone,

Can anyone explain in brief what does this field exactly do ?

[zioproto]

It is the equivalent of the az cli option --enable-msi-auth-for-monitoring

It enables Managed Identity Auth for Monitoring addon.

Send monitoring data to Log Analytics using the cluster's assigned identity (instead of the Log Analytics Workspace's shared key).

[summahto]

@zioproto

It is the equivalent of the az cli option --enable-msi-auth-for-monitoring

It enables Managed Identity Auth for Monitoring addon.

Send monitoring data to Log Analytics using the cluster's assigned identity (instead of the Log Analytics Workspace's shared key).

All right, got it.
Then, msi_auth_for_monitoring_enabled will be required when the Log Analytics Workspace has the following field is set to true:

`local_authentication_disabled = true`

Because as MS docs state, When set to true , this property enforces that Microsoft Entra authentication must be used for all access.
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/azure-ad-authentication-logs?tabs=azure-policy