|
| 1 | +--- |
| 2 | +title: Enable private link with Container insights |
| 3 | +description: Learn how to enable private link on an Azure Kubernetes Service (AKS) cluster. |
| 4 | +ms.topic: conceptual |
| 5 | +ms.date: 06/05/2024 |
| 6 | +ms.custom: devx-track-azurecli |
| 7 | +ms.reviewer: aul |
| 8 | +--- |
| 9 | + |
| 10 | +# Enable private link for Kubernetes monitoring |
| 11 | +This article describes how to configure monitoring for your Kubernetes cluster for |
| 12 | + |
| 13 | +[Azure Private Link](../../private-link/private-link-overview.md) enables you to access Azure platform as a service (PaaS) resources to your virtual network by using private endpoints. An [Azure Monitor Private Link Scope (AMPLS)](../logs/private-link-security.md) connects a private endpoint to a set of Azure Monitor resources to define the boundaries of your monitoring network. |
| 14 | + |
| 15 | +> [!NOTE] |
| 16 | +> - See [Connect to a data source privately](../../../articles/managed-grafana/how-to-connect-to-data-source-privately.md) for details on how to configure private link to query data from your Azure Monitor workspace using Grafana. |
| 17 | +> - See [Use private endpoints for Managed Prometheus and Azure Monitor workspace](azure-monitor-workspace-private-endpoint.md) for details on how to configure private link to query data from your Azure Monitor workspace using workbooks. |
| 18 | +
|
| 19 | + |
| 20 | +## Prerequisites |
| 21 | +This article describes how to connect your cluster to an existing Azure Monitor Private Link Scope (AMPLS). Create an AMPLS following the guidance in [Configure your private link](../logs/private-link-configure.md). |
| 22 | + |
| 23 | +## Managed Prometheus |
| 24 | + |
| 25 | +### Configure DCEs |
| 26 | +Private links for data ingestion for Managed Prometheus are configured on the Data Collection Endpoints (DCE) of the workspace that stores the data. To identify the DCEs associated with your Azure Monitor workspace, select **Data Collection Endpoints** from your Azure Monitor workspace in the Azure portal. |
| 27 | + |
| 28 | +:::image type="content" source="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-endpoints.png" alt-text="A screenshot show the data collection endpoints page for an Azure Monitor workspace." lightbox="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-endpoints.png" ::: |
| 29 | + |
| 30 | +If your AKS cluster isn't in the same region as your Azure Monitor workspace, then you need to [create another DCE](../essentials/data-collection-endpoint-overview.md#create-a-data-collection-endpoint) in the same region as the AKS cluster. In this case, open the data collection rule (DCR ) created when you enabled Managed Prometheus. This DCR will be named **MSPrometheus-\<clusterName\>-\<clusterRegion\>**. The cluster will be listed on the **Resources** page. On the **Data collection endpoint** dropdown, select the DCE in the same region as the AKS cluster. |
| 31 | + |
| 32 | +:::image type="content" source="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-rule.png" alt-text="A screenshot show the data collection rules page for an Azure Monitor workspace." lightbox="media/private-link-data-ingestion/azure-monitor-workspace-data-collection-rule.png" ::: |
| 33 | + |
| 34 | + |
| 35 | +## Ingestion from a private AKS cluster |
| 36 | +By default, a private AKS cluster can send data to Managed Prometheus and your Azure Monitor workspace over the public network using a public Data Collection Endpoint. |
| 37 | + |
| 38 | +If you choose to use an Azure Firewall to limit the egress from your cluster, you can implement one of the following: |
| 39 | + |
| 40 | +- Open a path to the public ingestion endpoint. Update the routing table with the following two endpoints: |
| 41 | + - `*.handler.control.monitor.azure.com` |
| 42 | + - `*.ingest.monitor.azure.com` |
| 43 | +- Enable the Azure Firewall to access the Azure Monitor Private Link scope and DCE that's used for data ingestion. |
| 44 | + |
| 45 | +## Private link ingestion for remote write |
| 46 | +Use the following steps to set up remote write for a Kubernetes cluster over a private link virtual network and an Azure Monitor Private Link scope. |
| 47 | + |
| 48 | +1. Create your Azure virtual network. |
| 49 | +1. Configure the on-premises cluster to connect to an Azure VNET using a VPN gateway or ExpressRoutes with private-peering. |
| 50 | +1. Create an Azure Monitor Private Link scope. |
| 51 | +1. Connect the Azure Monitor Private Link scope to a private endpoint in the virtual network used by the on-premises cluster. This private endpoint is used to access your DCEs. |
| 52 | +1. From your Azure Monitor workspace in the portal, select **Data Collection Endpoints** from the Azure Monitor workspace menu. |
| 53 | +1. You'll have at least one DCE which will have the same name as your workspace. Click on the DCE to open its details. |
| 54 | +1. Select the **Network Isolation** page for the DCE. |
| 55 | +2. Click **Add** and select your Azure Monitor Private Link scope. It takes a few minutes for the settings to propagate. Once completed, data from your private AKS cluster is ingested into your Azure Monitor workspace over the private link. |
| 56 | + |
| 57 | + |
| 58 | +## Container insights |
| 59 | +For Container insights, the cluster needs access to the Log Analytics workspace. |
| 60 | + |
| 61 | +### Cluster using managed identity authentication |
| 62 | + |
| 63 | +### Prerequisites |
| 64 | +- Create an Azure Monitor Private Link Scope (AMPLS) following the guidance in [Configure your private link](../logs/private-link-configure.md). |
| 65 | +- The template must be deployed in the same resource group as the cluster. |
| 66 | + |
| 67 | + |
| 68 | +### [CLI](#tab/cli) |
| 69 | + |
| 70 | +#### Existing AKS Cluster |
| 71 | + |
| 72 | +**Use default Log Analytics workspace** |
| 73 | + |
| 74 | +```azurecli |
| 75 | +az aks enable-addons --addon monitoring --name <cluster-name> --resource-group <cluster-resource-group-name> --ampls-resource-id "<azure-monitor-private-link-scope-resource-id>" |
| 76 | +``` |
| 77 | + |
| 78 | +Example: |
| 79 | + |
| 80 | +```azurecli |
| 81 | +az aks enable-addons --addon monitoring --name "my-cluster" --resource-group "my-resource-group" --workspace-resource-id "/subscriptions/my-subscription/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace" --ampls-resource-id "/subscriptions/my-subscription /resourceGroups/my-resource-group/providers/microsoft.insights/privatelinkscopes/my-ampls-resource" |
| 82 | +``` |
| 83 | + |
| 84 | +**Use existing Log Analytics workspace** |
| 85 | + |
| 86 | +```azurecli |
| 87 | +az aks enable-addons --addon monitoring --name <cluster-name> --resource-group <cluster-resource-group-name> --workspace-resource-id <workspace-resource-id> --ampls-resource-id "<azure-monitor-private-link-scope-resource-id>" |
| 88 | +``` |
| 89 | + |
| 90 | +Example: |
| 91 | + |
| 92 | +```azurecli |
| 93 | +az aks enable-addons --addon monitoring --name "my-cluster" --resource-group "my-resource-group" --workspace-resource-id "/subscriptions/my-subscription/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace" --ampls-resource-id "/subscriptions/my-subscription /resourceGroups/ my-resource-group/providers/microsoft.insights/privatelinkscopes/my-ampls-resource" |
| 94 | +``` |
| 95 | + |
| 96 | +### New AKS cluster |
| 97 | + |
| 98 | +```azurecli |
| 99 | +az aks create --resource-group rgName --name clusterName --enable-addons monitoring --workspace-resource-id "workspaceResourceId" --ampls-resource-id "azure-monitor-private-link-scope-resource-id" |
| 100 | +``` |
| 101 | + |
| 102 | +Example: |
| 103 | + |
| 104 | +```azurecli |
| 105 | +az aks create --resource-group "my-resource-group" --name "my-cluster" --enable-addons monitoring --workspace-resource-id "/subscriptions/my-subscription/resourceGroups/my-resource-group/providers/Microsoft.OperationalInsights/workspaces/my-workspace" --ampls-resource-id "/subscriptions/my-subscription /resourceGroups/ my-resource-group/providers/microsoft.insights/privatelinkscopes/my-ampls-resource" |
| 106 | +``` |
| 107 | + |
| 108 | + |
| 109 | +### [ARM](#tab/arm) |
| 110 | + |
| 111 | +The following sections provide links to the template and parameter files for enabling private link with Container insights on an AKS and Arc-enabled clusters. |
| 112 | + |
| 113 | +Edit the values in the parameter file and deploy the template using any valid method for deploying ARM templates. Retrieve the **resource ID** of the resources from the **JSON** View of their **Overview** page. |
| 114 | + |
| 115 | + Based on your requirements, you can configure other parameters such `streams`, `enableContainerLogV2`, `enableSyslog`, `syslogLevels`, `syslogFacilities`, `dataCollectionInterval`, `namespaceFilteringModeForDataCollection` and `namespacesForDataCollection`. |
| 116 | + |
| 117 | +### Prerequisites |
| 118 | +- Create an Azure Monitor Private Link Scope (AMPLS) following the guidance in [Configure your private link](../logs/private-link-configure.md). |
| 119 | +- The template must be deployed in the same resource group as the cluster. |
| 120 | + |
| 121 | +### AKS cluster |
| 122 | + |
| 123 | +**Template file:** https://aka.ms/aks-enable-monitoring-msi-onboarding-template-file<br> |
| 124 | +**Parameter file:** https://aka.ms/aks-enable-monitoring-msi-onboarding-template-parameter-file |
| 125 | + |
| 126 | + |
| 127 | +| Parameter | Description | |
| 128 | +|:---|:---| |
| 129 | +| `aksResourceId`| Resource ID of the cluster. | |
| 130 | +| `aksResourceLocation` | Azure Region of the cluster. | |
| 131 | +| `workspaceResourceId`| Resource ID of the Log Analytics workspace. | |
| 132 | +| `workspaceRegion` | Region of the Log Analytics workspace. | |
| 133 | +| `resourceTagValues` | Tag values specified for the existing Container insights extension data collection rule (DCR) of the cluster and the name of the DCR. The name will be MSCI-\<clusterName\>-\<clusterRegion\>, and this resource created in an AKS clusters resource group. For first time onboarding, you can set arbitrary tag values. | |
| 134 | +| `useAzureMonitorPrivateLinkScope` | Boolean flag to indicate whether Azure Monitor link scope is used or not. | |
| 135 | +| `azureMonitorPrivateLinkScopeResourceId` | Resource ID of the Azure Monitor Private link scope. This only used if `useAzureMonitorPrivateLinkScope` is set to **true**. | |
| 136 | + |
| 137 | +### Arc-enabled Kubernetes cluster |
| 138 | + |
| 139 | +**Template file:** https://aka.ms/arc-k8s-azmon-extension-msi-arm-template<br> |
| 140 | +**Parameter file:** https://aka.ms/arc-k8s-azmon-extension-msi-arm-template-params |
| 141 | + |
| 142 | +| Parameter | Description | |
| 143 | +|:---|:---| |
| 144 | +| `clusterResourceId` | Resource ID of the cluster. | |
| 145 | +| `clusterRegion` | Azure Region of the cluster. | |
| 146 | +| `workspaceResourceId` | Resource ID of the Log Analytics workspace. | |
| 147 | +| `workspaceRegion` | Region of the Log Analytics workspace. | |
| 148 | +| `workspaceDomain` | Domain of the Log Analytics workspace:<br>`opinsights.azure.com` for Azure public cloud<br>`opinsights.azure.us` for Azure US Government<br>`opinsights.azure.cn` for Azure China Cloud | |
| 149 | +| `resourceTagValues` | Tag values specified for the existing Container insights extension data collection rule (DCR) of the cluster and the name of the DCR. The name will be MSCI-\<clusterName\>-\<clusterRegion\>, and this resource created in an AKS clusters resource group. For first time onboarding, you can set arbitrary tag values. | |
| 150 | +| `useAzureMonitorPrivateLinkScope` | Boolean flag to indicate whether Azure Monitor link scope is used or not. | |
| 151 | +| `azureMonitorPrivateLinkScopeResourceId` | Resource ID of the Azure Monitor Private link scope. This is only used if `useAzureMonitorPrivateLinkScope` is set to **true**. | |
| 152 | + |
| 153 | +--- |
| 154 | + |
| 155 | +## Cluster using legacy authentication |
| 156 | +Use the following procedures to enable network isolation by connecting your cluster to the Log Analytics workspace using [Azure Private Link](../logs/private-link-security.md) if your cluster is not using managed identity authentication. This requires a [private AKS cluster](../../aks/private-clusters.md). |
| 157 | + |
| 158 | +1. Create a private AKS cluster following the guidance in [Create a private Azure Kubernetes Service cluster](../../aks/private-clusters.md). |
| 159 | + |
| 160 | +2. Disable public Ingestion on your Log Analytics workspace. |
| 161 | + |
| 162 | + Use the following command to disable public ingestion on an existing workspace. |
| 163 | + |
| 164 | + ```cli |
| 165 | + az monitor log-analytics workspace update --resource-group <azureLogAnalyticsWorkspaceResourceGroup> --workspace-name <azureLogAnalyticsWorkspaceName> --ingestion-access Disabled |
| 166 | + ``` |
| 167 | +
|
| 168 | + Use the following command to create a new workspace with public ingestion disabled. |
| 169 | +
|
| 170 | + ```cli |
| 171 | + az monitor log-analytics workspace create --resource-group <azureLogAnalyticsWorkspaceResourceGroup> --workspace-name <azureLogAnalyticsWorkspaceName> --ingestion-access Disabled |
| 172 | + ``` |
| 173 | +
|
| 174 | +3. Configure private link by following the instructions at [Configure your private link](../logs/private-link-configure.md). Set ingestion access to public and then set to private after the private endpoint is created but before monitoring is enabled. The private link resource region must be same as AKS cluster region. |
| 175 | +
|
| 176 | +4. Enable monitoring for the AKS cluster. |
| 177 | +
|
| 178 | + ```cli |
| 179 | + az aks enable-addons -a monitoring --resource-group <AKSClusterResourceGorup> --name <AKSClusterName> --workspace-resource-id <workspace-resource-id> |
| 180 | + ``` |
| 181 | +
|
| 182 | +
|
| 183 | +
|
| 184 | +## Next steps |
| 185 | +
|
| 186 | +* If you experience issues while you attempt to onboard the solution, review the [Troubleshooting guide](container-insights-troubleshoot.md). |
| 187 | +* With monitoring enabled to collect health and resource utilization of your AKS cluster and workloads running on them, learn [how to use](container-insights-analyze.md) Container insights. |
0 commit comments