Private link with Kubernetes monitoring

Author: bwren

articles/azure-monitor/containers/container-insights-private-link.md

@@ -7,21 +7,67 @@ ms.custom: devx-track-azurecli
 ms.reviewer: aul
 ---
 
-# Enable private link with Container insights
-This article describes how to configure Container insights to use Azure Private Link for your AKS cluster.
+# Enable private link for Kubernetes monitoring
+This article describes how to configure monitoring for your Kubernetes cluster for 
 
+[Azure Private Link](../../private-link/private-link-overview.md) enables you to access Azure platform as a service (PaaS) resources to your virtual network by using private endpoints. An [Azure Monitor Private Link Scope (AMPLS)](../logs/private-link-security.md) connects a private endpoint to a set of Azure Monitor resources to define the boundaries of your monitoring network. 
 
-## Cluster using managed identity authentication
+> [!NOTE]
+> - See [Connect to a data source privately](../../../articles/managed-grafana/how-to-connect-to-data-source-privately.md) for details on how to configure private link to query data from your Azure Monitor workspace using Grafana.
+> - See [Use private endpoints for Managed Prometheus and Azure Monitor workspace](azure-monitor-workspace-private-endpoint.md) for details on how to configure private link to query data from your Azure Monitor workspace using workbooks.
 
-### [CLI](#tab/cli)
 
+## Prerequisites
+This article describes how to connect your cluster to an existing Azure Monitor Private Link Scope (AMPLS). Create an AMPLS following the guidance in [Configure your private link](../logs/private-link-configure.md).
+
+## Managed Prometheus
+
+### Configure DCEs
+Private links for data ingestion for Managed Prometheus are configured on the Data Collection Endpoints (DCE) of the workspace that stores the data. To identify the DCEs associated with your Azure Monitor workspace, select **Data Collection Endpoints** from your Azure Monitor workspace in the Azure portal.
+
+:::image type="content" source="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-endpoints.png" alt-text="A screenshot show the data collection endpoints page for an Azure Monitor workspace." lightbox="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-endpoints.png" :::
+
+If your AKS cluster isn't in the same region as your Azure Monitor workspace, then you need to [create another DCE](../essentials/data-collection-endpoint-overview.md#create-a-data-collection-endpoint) in the same region as the AKS cluster. In this case, open the data collection rule (DCR ) created when you enabled Managed Prometheus. This DCR will be named **MSPrometheus-\<clusterName\>-\<clusterRegion\>**. The cluster will be listed on the **Resources** page. On the **Data collection endpoint** dropdown, select the DCE in the same region as the AKS cluster.
+
+:::image type="content" source="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-rule.png" alt-text="A screenshot show the data collection rules page for an Azure Monitor workspace." lightbox="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-rule.png" :::
+
+
+## Ingestion from a private AKS cluster
+By default, a private AKS cluster can send data to Managed Prometheus and your Azure Monitor workspace over the public network using a public Data Collection Endpoint.
+
+If you choose to use an Azure Firewall to limit the egress from your cluster, you can implement one of the following:
+
+- Open a path to the public ingestion endpoint. Update the routing table with the following two endpoints:
+  - `*.handler.control.monitor.azure.com`
+  - `*.ingest.monitor.azure.com`
+- Enable the Azure Firewall to access the Azure Monitor Private Link scope and DCE that's used for data ingestion.
+
+## Private link ingestion for remote write
+Use the following steps to set up remote write for a Kubernetes cluster over a private link virtual network and an Azure Monitor Private Link scope.
+
+1. Create your Azure virtual network.
+1. Configure the on-premises cluster to connect to an Azure VNET using a VPN gateway or ExpressRoutes with private-peering.
+1. Create an Azure Monitor Private Link scope.
+1. Connect the Azure Monitor Private Link scope to a private endpoint in the virtual network used by the on-premises cluster. This private endpoint is used to access your DCEs.
+1. From your Azure Monitor workspace in the portal, select **Data Collection Endpoints** from the Azure Monitor workspace menu. 
+1. You'll have at least one DCE which will have the same name as your workspace. Click on the DCE to open its details.
+1. Select the **Network Isolation** page for the DCE. 
+2. Click **Add** and select your Azure Monitor Private Link scope. It takes a few minutes for the settings to propagate. Once completed, data from your private AKS cluster is ingested into your Azure Monitor workspace over the private link.
+
+
+## Container insights
+For Container insights, the cluster needs access to the Log Analytics workspace. 
+
+### Cluster using managed identity authentication
 
 ### Prerequisites
- - Azure CLI version 2.61.0 or higher.
- - Create an Azure Monitor Private Link Scope (AMPLS) following the guidance in [Configure your private link](../logs/private-link-configure.md).
+- Create an Azure Monitor Private Link Scope (AMPLS) following the guidance in [Configure your private link](../logs/private-link-configure.md).
+- The template must be deployed in the same resource group as the cluster.
 
 
-### Existing AKS Cluster 
+### [CLI](#tab/cli)
+
+#### Existing AKS Cluster 
 
 **Use default Log Analytics workspace**