You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A [Kubernetes manifest file](kubernetes-concepts.md#deployments) defines a cluster's desired state, such as which container images to run.
102
102
@@ -215,6 +215,8 @@ deployment "azure-vote-front" created
215
215
service "azure-vote-front" created
216
216
```
217
217
218
+
Deploy a MetalLB load balancer so it can assign an external IP for the application front end. You can [follow these instructions](deploy-load-balancer-cli.md) to deploy the MetalLB extension from the Azure portal, or using CLI.
219
+
218
220
## Test the application
219
221
220
222
When the application runs, a Kubernetes service exposes the application frontend to the internet. This process can take a few minutes to complete.
After the extension installs successfully, follow the instructions in [Diagnostic settings in Azure Monitor](/azure/azure-monitor/essentials/diagnostic-settings#resource-logs) to create a diagnostic setting using the Azure portal, Azure CLI, or PowerShell. During this process, you can specify which categories of logs to collect. The categories for AKS Arc are listed in the [Azure Monitor reference](/azure/azure-monitor/logs/manage-logs-tables).
29
+
After the extension installs successfully, follow the instructions in [Diagnostic settings in Azure Monitor](/azure/azure-monitor/essentials/diagnostic-settings#resource-logs) to create a diagnostic setting using the Azure portal, Azure CLI, or PowerShell. During this process, you can specify which categories of logs to collect. The categories for AKS Arc are listed in the [Monitoring data reference](/azure/azure-monitor/logs/manage-logs-tables).
AKS supports either[Azure diagnostics mode](/azure/azure-monitor/essentials/resource-logs#azure-diagnostics-mode) or [resource-specific mode](/azure/azure-monitor/essentials/resource-logs#resource-specific)for resource logs. The mode specifies the tables in the Log Analytics workspace to which the data is sent. Azure diagnostics mode sends all data to the[AzureDiagnostics table](/azure/azure-monitor/reference/tables/azurediagnostics), while resource-specific mode sends data to[ArcK8SAudit](/azure/azure-monitor/reference/tables/arck8saudit),[ArcK8SAuditAdmin](/azure/azure-monitor/reference/tables/arck8sauditadmin), and[ArcK8SControlPlane](/azure/azure-monitor/reference/tables/arck8scontrolplane), as shown in the log category table in the next section.
39
+
AKS supports either[Azure diagnostics mode](/azure/azure-monitor/essentials/resource-logs#azure-diagnostics-mode) or [resource-specific mode](/azure/azure-monitor/essentials/resource-logs#resource-specific)for resource logs. The mode specifies the tables in the Log Analytics workspace to which the data is sent. Azure diagnostics mode sends all data to the[AzureDiagnostics table](/azure/azure-monitor/reference/tables/azurediagnostics), while resource-specific mode sends data to[ArcK8SAudit](/azure/azure-monitor/reference/tables/arck8saudit),[ArcK8SAuditAdmin](/azure/azure-monitor/reference/tables/arck8sauditadmin), and[ArcK8SControlPlane](/azure/azure-monitor/reference/tables/arck8scontrolplane), as shown in the log category table in the next section.
40
40
41
-
After you save the setting, it can take an hour to see the events in the Log Analytics workspace or other supported destination. You can write a KQL query to extract the insights based on the log category you enabled.
| kube-apiserver | Logs from the API server. | ArcK8SControlPlane. |
48
-
| kube-audit | Audit log data for every audit event including get, list, create, update, delete, patch, and post. | ArcK8SAudit |
49
-
| kube-audit-admin | Subset of the kube-audit log category. Significantly reduces the number of logs by excluding the get and list audit events from the log. | ArcK8SAuditAdmin |
50
-
| kube-controller-manager | Gain deeper visibility of issues that may arise between Kubernetes and the Azure control plane. A typical example is the AKS cluster having a lack of permissions to interact with Azure. | ArcK8SControlPlane |
51
-
| kube-scheduler | Logs from the scheduler. | ArcK8SControlPlane. |
52
-
| cluster-autoscaler | Understand why the AKS cluster is scaling up or down, which may not be expected. This information is also useful to correlate time intervals where something interesting might have happened in the cluster. | ArcK8SControlPlane |
53
-
| cloud-controller-manager | Logs from the cloud-node-manager component of the Kubernetes cloud controller manager. | ArcK8SControlPlane |
54
-
| guard | Managed Microsoft Entra ID and Azure RBAC audits. For managed Microsoft Entra ID, this category includes token in and user info out. For Azure RBAC, it includes access reviews in and out. | ArcK8SControlPlane |
55
-
| csi-aksarcdisk-controller | Logs from the AKS Arc CSI storage driver. | ArcK8SControlPlane. |
56
-
| csi-aksarcsmb-controller | Logs from the AKS Arc SMB CSI storage driver. | ArcK8SControlPlane. |
57
-
| csi-aksarcnfs-controller | Logs from the AKS Arc NFS CSI storage driver. | ArcK8SControlPlane. |
41
+
After you save the settings, it can take up to an hour to see the events in the Log Analytics workspace or other supported destination. You can write a KQL query to extract the insights based on the log categories you enabled.
58
42
59
43
## Delete and disable the diagnostics setting
60
44
61
45
You can delete the diagnostics setting using the Azure portal, PowerShell, or Azure CLI:
62
46
63
47
```azurecli
64
-
az monitor diagnostic-settings delete –name <diagnostics-setting-name> --resource <resource-name> -g <resource-group-name>
48
+
az monitor diagnostic-settings delete -name <diagnostics-setting-name> --resource <resource-name> -g <resource-group-name>
65
49
```
66
50
67
51
After you successfully delete the setting, you can then delete the extension using Azure CLI:
Copy file name to clipboardExpand all lines: AKS-Hybrid/kubernetes-monitor-metrics.md
+20-14Lines changed: 20 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,10 +3,10 @@ title: Metrics and monitoring logs in AKS Arc
3
3
description: Learn about metrics and logs used to monitor Kubernetes clusters in AKS Arc.
4
4
author: sethmanheim
5
5
ms.topic: how-to
6
-
ms.date: 05/30/2024
6
+
ms.date: 12/18/2024
7
7
ms.author: sethm
8
8
ms.lastreviewed: 03/28/2024
9
-
ms.reviewer: haojiehan
9
+
ms.reviewer: haojiehang
10
10
11
11
---
12
12
@@ -16,16 +16,27 @@ This article provides an overview of the metrics and logs used to monitor Kubern
16
16
17
17
## Metrics
18
18
19
-
The following table lists the platform metrics collected for AKS Arc. Follow each link for a detailed list of the metrics for each particular type.
19
+
### Platform Metrics
20
+
21
+
The following table lists the platform metrics supported for AKS Arc. To view these basic platform metrics, you can install the observability extension on your Kubernetes cluster and wait a few minutes to start the automatic metrics ingestion. Follow each link for a detailed list of the metrics for each particular type:
20
22
21
23
| Metric type | Resource provider/type namespace |
To view more granular metrics, it's recommended that you enable the Managed Prometheus extension in your Kubernetes, and then query Prometheus metrics in Metrics Explorer or Managed Grafana. For the extension onboarding instructions, [see this article](/azure/azure-monitor/containers/kubernetes-monitoring-enable?tabs=cli#enable-prometheus-and-grafana).
31
+
32
+
33
+
## Azure Monitor Logs
27
34
28
-
AKS Arc implements control plane logs (including audit logs) for clusters as [resource logs in Azure Monitor](/azure/azure-monitor/essentials/resource-logs). For more information about creating diagnostic settings to collect these logs, see [Monitor Kubernetes audit events](/azure/aks/hybrid/kubernetes-monitor-audit-events). The following table lists the resource log categories you can collect for AKS Arc:
35
+
AKS Arc supports two types of logs: Control Plane logs implemented as resource logs, and container insights logs. For more information about exporting control plane logs such as audit logs using diagnostic settings, see [Monitor Kubernetes audit events](/azure/aks/hybrid/kubernetes-monitor-audit-events). For more information about enabling container insights, see [Enable Container Insights](/azure/azure-monitor/containers/kubernetes-monitoring-enable?tabs=cli).
36
+
37
+
### Control Plane Logs
38
+
39
+
The following table lists the log categories available for AKS Arc. You can also see this table in the [Azure Monitor resource log reference](/azure/azure-monitor/reference/supported-logs/microsoft-kubernetes-connectedclusters-logs):
@@ -43,23 +54,18 @@ AKS Arc implements control plane logs (including audit logs) for clusters as [re
43
54
44
55
For more information, see the list of [all resource log category types supported in Azure Monitor](/azure/azure-monitor/essentials/resource-logs-schema).
45
56
46
-
## Azure Monitor log tables
47
-
48
-
The following table lists all the Azure Monitor log tables relevant to AKS Arc:
|[ConnectedCluster](/azure/azure-monitor/logs/manage-logs-tables)| Follow this link for a list of all tables used by AKS Arc, and a description of their structure. |
59
+
You can analyze both the control plane logs and the container insights in Log Analytics Workspace. See the Log Analytics tables in the [Azure Monitor Reference](/azure/azure-monitor/reference/tables-index#azure-arc-enabled-kubernetes).
53
60
54
-
## Azure Activity log
61
+
## Activity log
55
62
56
-
The following table links to a few example operations related to AKS Arc that might be created in the [Activity log](/azure/azure-monitor/essentials/activity-log-insights). Use the activity log to track information such as when a cluster is created, or had its configuration change:
63
+
The following table lists a few example operations related to AKS that might be created in the activity log. Use the activity log to track information such as when a cluster is created, or had its configuration change. You can view this information in the portal or by using other methods. You can also use it to create an activity log alert to be proactively notified when an event occurs:
|[ProvisionedClusterInstances](/rest/api/hybridcontainer/provisioned-cluster-instances)| Follow this link for a list and descriptions of operations used in AKS Arc. |
61
68
62
-
For more information about the schema of Activity log entries, see the [Activity log schema](/azure/azure-monitor/essentials/activity-log-schema).
@@ -125,7 +125,7 @@ az aksarc show --resource-group "<resource-group-name>" --name "<cluster-name>"
125
125
126
126
Similiar to step 3, download the node pool template and parameters from the [AKSArc repo](https://github.com/Azure/aksArc/tree/main/deploymentTemplates) and review the default values.
127
127
128
-
### Deploy the template and validate results using Azure CLI (optional)
128
+
##Step 8: Deploy the template and validate the deployment (optional)
129
129
130
130
Review and apply the template. This process takes a few minutes to complete. You can use the Azure CLI to validate that the node pool is created successfully:
Copy file name to clipboardExpand all lines: azure-local/assurance/azure-stack-pci-dss-guidance.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: PCI DSS guidance for Azure Local
3
3
description: Learn about PCI DSS compliance using Azure Local.
4
-
ms.date: 11/07/2024
4
+
ms.date: 12/17/2024
5
5
ms.topic: conceptual
6
6
ms.service: azure-stack-hci
7
7
ms.author: nguyenhung
@@ -95,9 +95,9 @@ By default, all host communications to local and remote endpoints are encrypted
95
95
96
96
Windows Defender Antivirus is a utility application that enables enforcement of real-time system scanning and periodic scanning to protect platform and workloads against viruses, malware, spyware, and other threats. By default, Microsoft Defender Antivirus is enabled on Azure Local. Microsoft recommends using Microsoft Defender Antivirus with Azure Local rather than third-party antivirus and malware detection software and services as they may impact the operating system's ability to receive updates. Learn more at [Microsoft Defender Antivirus on Windows Server](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server).
97
97
98
-
#### Windows Defender Application Control (WDAC)
98
+
#### Application Control
99
99
100
-
Windows Defender Application Control (WDAC) is enabled by default on Azure Local to control which drivers and applications are allowed to run directly on each server, helping prevent malware from accessing the systems. Learn more about base policies included in Azure Local and how to create supplemental policies at [Windows Defender Application Control for Azure Local](/azure-stack/hci/concepts/security-windows-defender-application-control).
100
+
Application Control is enabled by default on Azure Local to control which drivers and applications are allowed to run directly on each server, helping prevent malware from accessing the systems. Learn more about base policies included in Azure Local and how to create supplemental policies at [Application Control for Azure Local](/azure-stack/hci/concepts/security-windows-defender-application-control).
0 commit comments