Support for data collection parameters in AKS

[mkemmerz]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Microsoft started with some ways to cost optimize the AKS logs: https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-cost-config?tabs=create-arm#data-collection-parameters

This also includes values like an interval: "This value determines how often the agent collects data." - which is basically my feature request.

The data collection setting is found here in the AKS:

New or Affected Resource(s)/Data Source(s)

azurerm_kubernetes_cluster

Potential Terraform Configuration

Pre-defined values:
monitor_settings {
   cost_presets = "Standard|Cost-optimized|Syslog"
}

definition with custom values:
monitor_settings {
   cost_presets = "Custom"
   interval = "x"
   namespace_excluded = "..."
   collect_syslog = true|false
}

References

No response

[0x4c6565]

@mkemmerz this is implemented with data collection rules. I've managed to enable this by adding a collection rule and association as below:

resource "azurerm_monitor_data_collection_rule" "aks" {
  name                = azurerm_kubernetes_cluster.aks.name
  resource_group_name = var.resource_group_name
  location            = var.location
  tags                = var.tags

  destinations {
    log_analytics {
      name                  = "ciworkspace"
      workspace_resource_id = var.log_analytics_workspace_id
    }
  }

  data_flow {
    streams      = ["Microsoft-ContainerInsights-Group-Default"]
    destinations = ["ciworkspace"]
  }

  data_sources {
    extension {
      name           = "ContainerInsightsExtension"
      streams        = ["Microsoft-ContainerInsights-Group-Default"]
      extension_name = "ContainerInsights"
      extension_json = jsonencode({
        dataCollectionSettings = {
          interval               = "5m"
          namespaceFilteringMode = "Exclude"
          namespaces = [
            "kube-system",
            "gatekeeper-system",
            "azure-arc"
          ]
        }
      })
    }
  }
}

resource "azurerm_monitor_data_collection_rule_association" "aks" {
  name                    = azurerm_kubernetes_cluster.aks.name
  target_resource_id      = azurerm_kubernetes_cluster.aks.id
  data_collection_rule_id = azurerm_monitor_data_collection_rule.aks.id
}

The portal then shows the matching preset:

[mkemmerz]

@0x4c6565 Wow thanks! That looks great - I will give it a try!

[mkemmerz]

Closing this issue as the solution provided by @0x4c6565 worked perfectly. Thanks again!

[SebSa]

I've managed to enable this by adding a collection rule and association as below:

Did you use this solution in conjuction with the oms_agent block?
I'm trying the same thing but it's not changing the preset in the portal to match the updated config.

[0x4c6565]

I've managed to enable this by adding a collection rule and association as below:

Did you use this solution in conjuction with the oms_agent block? I'm trying the same thing but it's not changing the preset in the portal to match the updated config.

@SebSa do you have managed identity configured for AKS? This is required. You'll need to configure this if not, and set msi_auth_for_monitoring_enabled to true inside oms_agent block

https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-enable-aks?tabs=azure-cli#migrate-to-managed-identity-authentication

[SebSa]

@0x4c6565 I'm using a user managed identity for other reasons, the docs say that's alright or am I misunderstanding them?

AKS Cluster MUST be using either System or User Assigned Managed Identity
. If the AKS Cluster is using Service Principal, you must upgrade to Managed Identity
source: https://learn.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-cost-config?tabs=create-CLI#pre-requisites

[0x4c6565]

I'd assume that was fine then - do you have msi_auth_for_monitoring_enabled set to true also?

I'm really not sure what the portal is looking for to denote which cost preset is configured - I'd assume it's based on the AKS data collection rule association and configured interval. Have you set the same LA workspace ID for both the rule and within the oms_agent block too?

[SebSa]

@0x4c6565 It seems to work with the msi_auth_for_monitoring_enabled = true. Thank you for that. Although in the portal it says that the datacollection preset is now set to "custom". Not sure what I'm missing to get it to say "cost-optimised"

One thing I noticed was a slight difference in the resource ID between the log analytics workspace defined in the DCR when generating it via the portal and terraform.

              ~ workspace_resource_id = "/subscriptions/x/resourcegroups/x/providers/microsoft.operationalinsights/workspaces/x-staging-log" -> "/subscriptions/x/resourceGroups/x/providers/Microsoft.OperationalInsights/workspaces/x-staging-log"

The former being the portal result, the later being the azurerm provider ID for the log analytics resources id. Microsoft.OperationalInsights is title case in azurerm's resource id but all lowercase when created via the portal.

[0x4c6565]

@SebSa I think it may just be matching on configuration of the collection rule matching the below:

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.