You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/essentials/prometheus-remote-write-managed-identity.md
+17-31Lines changed: 17 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,6 +24,7 @@ This article applies to the following cluster configurations:
24
24
## Prerequisites
25
25
26
26
- You must have self-managed Prometheus running on your AKS cluster. For example, see [Using Azure Kubernetes Service with Grafana and Prometheus](https://techcommunity.microsoft.com/t5/apps-on-azure-blog/using-azure-kubernetes-service-with-grafana-and-prometheus/ba-p/3020459).
27
+
- You used Kube-Prometheus Stack when you setup Prometheus on your AKS cluster.
27
28
28
29
29
30
## Create Azure Monitor workspace
@@ -38,28 +39,15 @@ The node resource group of the AKS contains resources that you will require for
38
39
## Get the client ID of the user assigned identity
39
40
You will require the client ID of the identity that you're going to use. Note this value for use in later steps in this process.
40
41
41
-
### [AKS identity](#tab/aks)
42
-
The identities created by AKS are listed in [Use a managed identity in Azure Kubernetes Service](../../aks/use-managed-identity.md). This procedure will use the `Kubelet` identity. The name of this identity will be `<AKS-CLUSTER-NAME>-agentpool` and located in the node resource group of the AKS cluster.
42
+
Get the **Client ID** from the **Overview** page of your [managed identity](../../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md).
43
43
44
-
1. From the **Resource groups** menu in the Azure portal, locate the resource group `MC_<AKS-RESOURCE-GROUP>_<AKS-CLUSTER-NAME>_<REGION>`.
44
+
:::image type="content" source="media/prometheus-remote-write-managed-identity/client-id.png" alt-text="Screenshot showing client ID on overview page of managed identity." lightbox="media/prometheus-remote-write-managed-identity/client-id.png":::
45
45
46
-
:::image type="content" source="media/prometheus-remote-write-managed-identity/resource-groups.png" alt-text="Screenshot showing list of resource groups." lightbox="media/prometheus-remote-write-managed-identity/resource-groups.png":::
46
+
Instead of creating your own ID, you can use one of the identities created by AKS, which are listed in [Use a managed identity in Azure Kubernetes Service](../../aks/use-managed-identity.md). This procedure will use the `Kubelet` identity. The name of this identity will be `<AKS-CLUSTER-NAME>-agentpool` and located in the node resource group of the AKS cluster.
47
47
48
-
2. From the list of resources in the resource group, locate the Managed Identity with the name `<AKS-CLUSTER-NAME>-agentpool`.
48
+
:::image type="content" source="media/prometheus-remote-write-managed-identity/resource-group-details.png" alt-text="Screenshot showing list of resources in the node resource group." lightbox="media/prometheus-remote-write-managed-identity/resource-group-details.png":::
49
49
50
-
:::image type="content" source="media/prometheus-remote-write-managed-identity/resource-group-details.png" alt-text="Screenshot showing list of resources in the node resource group." lightbox="media/prometheus-remote-write-managed-identity/resource-group-details.png":::
51
50
52
-
3. Note the **Client ID** on the **Overview** page of the managed identity.
53
-
54
-
:::image type="content" source="media/prometheus-remote-write-managed-identity/client-id.png" alt-text="Screenshot showing client ID on overview page of managed identity." lightbox="media/prometheus-remote-write-managed-identity/client-id.png":::
55
-
56
-
### [Own identity](#tab/own)
57
-
58
-
1. Note the **Client ID** on the **Overview** page of the [managed identity](../../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md).
59
-
60
-
:::image type="content" source="media/prometheus-remote-write-managed-identity/client-id.png" alt-text="Screenshot showing client ID on overview page of managed identity." lightbox="media/prometheus-remote-write-managed-identity/client-id.png":::
61
-
62
-
---
63
51
64
52
## Assign managed identity the Monitoring Metrics Publisher role on the data collection rule
65
53
The managed identity requires the *Monitoring Metrics Publisher* role on the data collection rule associated with your Azure Monitor workspace.
@@ -88,12 +76,7 @@ The managed identity requires the *Monitoring Metrics Publisher* role on the dat
88
76
89
77
90
78
## Grant AKS cluster access to the identity
91
-
92
-
### [AKS identity](#tab/aks)
93
-
94
-
This step isn't required if you're using an AKS identity. This identity already has access to the cluster.
95
-
### [Own identity](#tab/own)
96
-
79
+
This step isn't required if you're using an AKS identity since it will already has access to the cluster.
97
80
98
81
> [!IMPORTANT]
99
82
> You must have owner/user access administrator access on the cluster.
@@ -108,17 +91,20 @@ This step isn't required if you're using an AKS identity. This identity already
108
91
az vmss identity assign -g <AKS-NODE-RESOURCE-GROUP> -n <AKS-VMSS-NAME> --identities <USER-ASSIGNED-IDENTITY-RESOURCE-ID>
109
92
```
110
93
111
-
---
112
94
113
95
## Deploy Side car and configure remote write on the Prometheus server
114
96
115
-
1. Copy the YAML below and save to a file, replacing the following values. This YAML assumes you're using 8081 as your listening port. Modify that value if you use a different port.
97
+
1. Copy the YAML below and save to a file, replacing the following values.
98
+
99
+
| Value | Description |
100
+
|:---|:---|
101
+
| `<AKS-CLUSTER-NAME>` | Name of your AKS cluster |
102
+
| `<CONTAINER-IMAGE-VERSION>` | `mcr.microsoft.com/azuremonitor/prometheus/promdev/prom-remotewrite:prom-remotewrite-20221012.2`<br>This is the remote write container image version. |
103
+
| `<INGESTION-URL>` | **Metrics ingestion endpoint** from the **Overview** page for the Azure Monitor workspace. |
104
+
| `<MANAGED-IDENTITY-CLIENT-ID>` | - **Client ID** from the **Overview** page for the managed identity |
105
+
| `<CLUSTER-NAME>` | Name of the cluster Prometheus is running on |
116
106
117
-
`<AKS-CLUSTER-NAME>`: Name of your AKS cluster
118
-
`<CONTAINER-IMAGE-VERSION>`: The remote write container image version.: `mcr.microsoft.com/azuremonitor/prometheus/promdev/prom-remotewrite:prom-remotewrite-20221012.2`
119
-
`<INGESTION-URL>`: **Metrics ingestion endpoint** from the **Overview** page for the Azure Monitor workspace.
120
-
`<MANAGED-IDENTITY-CLIENT-ID>`: - **Client ID** from the **Overview** page for the managed identity
121
-
`<CLUSTER-NAME>`: Name of the cluster Prometheus is running on
107
+
This YAML assumes you're using 8081 as your listening port. Modify that value if you use a different port.
122
108
123
109
```yml
124
110
prometheus:
@@ -167,7 +153,7 @@ This step isn't required if you're using an AKS identity. This identity already
167
153
```
168
154
169
155
2. Open Azure Cloud Shell and upload the YAML file.
170
-
3. Use helm to apply the YAML file to update your Prometheus configuration with the following CLI commands. This assumes you used Kube-Prometheus Stack when you setup Prometheus on your AKS cluster.
156
+
3. Use helm to apply the YAML file to update your Prometheus configuration with the following CLI commands.
0 commit comments