Container insights not working when using existing Log Analytics Workspace

[dboden-nitro]

Is there an existing issue for this?

• I have searched the existing issues

Greenfield/Brownfield provisioning

greenfield

Terraform Version

1.9.8

Module Version

9.2.0

AzureRM Provider Version

3.117.0

Affected Resource(s)/Data Source(s)

N/A

Terraform Configuration Files

module "aks" {
  source  = "Azure/aks/azurerm"
  version = "9.2.0"
...
  log_analytics_workspace = {
    id = "/subscriptions/../../providers/Microsoft.OperationalInsights/workspaces/<workspacename>"
    name = "<workspacename>"
  }
  msi_auth_for_monitoring_enabled = true
}

tfvars variables values

N/A

Debug Output/Panic Output

N/A

Expected Behaviour

Container insight logs are available in the existing log analytics workspace provided as an input variable.
I believe this is due to a missing data collection rule.

Actual Behaviour

No logs are available in the existing log analytics workspace.

The following warning is shown when looking at the monitor settings:
You do not have access to the associated data collection rule to view the log analytics workspace name or the data collection rule has been deleted.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[zioproto]

Please could you clarify if the log_analytics_workspace.id is pointing to a workspace in the same subscription ?

Related issue: #588

[dboden-nitro]

@zioproto I confirm that log_analytics_workspace.id is pointing to a workspace in the same subscription.

[zioproto]

You are right the diagnostic settings are not created in this module. There is no azurerm_monitor_diagnostic_setting resource.

I think the expectation was that if you bring your work Log Analytics Workspace you also provide the necessary azurerm_monitor_diagnostic_setting.

You can add a resource like this:

resource "azurerm_monitor_diagnostic_setting" "aks" {
  name                           = "my-diagnostic-setting-name"
  target_resource_id             = module.aks.aks_id
  log_analytics_destination_type = "Dedicated"

# This is "/subscriptions/../../providers/Microsoft.OperationalInsights/workspaces/<workspacename>"
  log_analytics_workspace_id     = azurerm_log_analytics_workspace.this.id 

  # Kubernetes API Server
  enabled_log {
    category = "kube-apiserver"
  }
  # Kubernetes Audit
  enabled_log {
    category = "kube-audit"
  }
  # Kubernetes Audit Admin Logs
  enabled_log {
    category = "kube-audit-admin"
  }
  # Kubernetes Controller Manager
  enabled_log {
    category = "kube-controller-manager"
  }
  # Kubernetes Scheduler
  enabled_log {
    category = "kube-scheduler"
  }
  #Kubernetes Cluster Autoscaler
  enabled_log {
    category = "cluster-autoscaler"
  }
  #Kubernetes Cloud Controller Manager
  enabled_log {
    category = "cloud-controller-manager"
  }
  #guard
  enabled_log {
    category = "guard"
  }
  #csi-azuredisk-controller
  enabled_log {
    category = "csi-azuredisk-controller"
  }
  #csi-azurefile-controller
  enabled_log {
    category = "csi-azurefile-controller"
  }
  #csi-snapshot-controller
  enabled_log {
    category = "csi-snapshot-controller"
  }
  metric {
    category = "AllMetrics"
  }
}

Please let me know if this fixes the problem.

[oscarwest]

container insights != diagnostic settings

[zioproto]

@oscarwest thanks for the clarification.

I understand now this Terraform module is missing the Data Collection Rules

Microsoft Documentation has a specific page on how to enable Containers Insights with Terraform.

What happened is that I missed this when I did the review of #446 from @admincasper .

@admincasper are you creating the resource azurerm_monitor_data_collection_rule outside of the module ?

PR #446 only implemented the block:

  oms_agent {
    log_analytics_workspace_id = var.workspace_resource_id
    msi_auth_for_monitoring_enabled = true
  }

We missed the implementation of the azurerm_monitor_data_collection_rule and azurerm_monitor_data_collection_rule_association resources.

The product team published a reference implementation here:
https://github.com/microsoft/Docker-Provider/tree/ci_prod/scripts/onboarding/aks/onboarding-msi-terraform

[zioproto]

@admincasper friendly nudge. Could you confirm it is working for you creating azurerm_monitor_data_collection_rule outside of the module ?

[lonegunmanb]

I'm closing this issue because I believe it has been solved by #623, please feel free to reopen it if you have any different idea @dboden-nitro .