Skip to content

Commit c9f5dfa

Browse files
wanlonghenrywanlonghenry
authored
Add private link support for high log scale (#1512)
* add private link support for high log scale * update use right public access * update split * update for syslog template
1 parent 38f9096 commit c9f5dfa

File tree

10 files changed

+442
-6
lines changed

10 files changed

+442
-6
lines changed

‎scripts/onboarding/aks/onboarding-msi-azure-policy/azure-policy.parameters.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,5 +94,13 @@
9494
"Microsoft-Perf",
9595
"Microsoft-RetinaNetworkFlowLogs"
9696
]
97+
},
98+
"useAzureMonitorPrivateLinkScope": {
99+
"type": "Boolean",
100+
"defaultValue": false
101+
},
102+
"azureMonitorPrivateLinkScopeResourceId": {
103+
"type": "String",
104+
"defaultValue": "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroup>/providers/microsoft.insights/privateLinkScopes/<azureMonitorPrivateLinkScopeName>"
97105
}
98106
}

‎scripts/onboarding/aks/onboarding-msi-azure-policy/azure-policy.rules.json‎

Lines changed: 160 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,13 +70,20 @@
7070
},
7171
"streams": {
7272
"type": "array"
73+
},
74+
"useAzureMonitorPrivateLinkScope": {
75+
"type": "bool"
76+
},
77+
"azureMonitorPrivateLinkScopeResourceId": {
78+
"type": "string"
7379
}
7480
},
7581
"variables": {
7682
"clusterSubscriptionId": "[split(parameters('aksResourceId'),'/')[2]]",
7783
"clusterResourceGroup": "[split(parameters('aksResourceId'),'/')[4]]",
7884
"clusterName": "[split(parameters('aksResourceId'),'/')[8]]",
7985
"clusterLocation": "[replace(parameters('aksResourceLocation'),' ', '')]",
86+
"workspaceName": "[split(parameters('workspaceResourceId'),'/')[8]]",
8087
"workspaceLocation":"[replace(parameters('workspaceRegion'),' ', '')]",
8188
"dcrNameFull": "[Concat('MSCI', '-', variables('workspaceLocation'), '-', variables('clusterName'))]",
8289
"dcrName":"[if(greater(length(variables('dcrNameFull')), 64), substring(variables('dcrNameFull'), 0, 64), variables('dcrNameFull'))]",
@@ -87,6 +94,14 @@
8794
"ingestionDCEName": "[if(greater(length(variables('ingestionDCENameFull')), 43), substring(variables('ingestionDCENameFull'), 0, 43), variables('ingestionDCENameFull'))]",
8895
"ingestionDCE": "[if(endsWith(variables('ingestionDCEName'), '-'), substring(variables('ingestionDCEName'), 0, 42), variables('ingestionDCEName'))]",
8996
"ingestionDataCollectionEndpointId": "[resourceId(variables('clusterSubscriptionId'), variables('clusterResourceGroup'), 'Microsoft.Insights/dataCollectionEndpoints', variables('ingestionDCE'))]",
97+
"configDCENameFull": "[Concat('MSCI-config', '-', variables('clusterLocation'), '-', variables('clusterName'))]",
98+
"configDCEName": "[if(greater(length(variables('configDCENameFull')), 43), substring(variables('configDCENameFull'), 0, 43), variables('configDCENameFull'))]",
99+
"configDCE": "[if(endsWith(variables('configDCEName'), '-'), substring(variables('configDCEName'), 0, 42), variables('configDCEName'))]",
100+
"configDCEAssociationName": "configurationAccessEndpoint",
101+
"configDataCollectionEndpointId": "[resourceId(variables('clusterSubscriptionId'), variables('clusterResourceGroup'), 'Microsoft.Insights/dataCollectionEndpoints', variables('configDCE'))]",
102+
"privateLinkScopeName": "[split(parameters('azureMonitorPrivateLinkScopeResourceId'),'/')[8]]",
103+
"privateLinkScopeResourceGroup": "[split(parameters('azureMonitorPrivateLinkScopeResourceId'),'/')[4]]",
104+
"privateLinkScopeSubscriptionId": "[split(parameters('azureMonitorPrivateLinkScopeResourceId'),'/')[2]]",
90105
"ciOnlyTemplate": {
91106
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
92107
"contentVersion": "1.0.0.0",
@@ -211,6 +226,20 @@
211226
}
212227
},
213228
"resources": [
229+
{
230+
"condition": "[parameters('useAzureMonitorPrivateLinkScope')]",
231+
"type": "Microsoft.Insights/dataCollectionEndpoints",
232+
"apiVersion": "2022-06-01",
233+
"name": "[variables('configDCE')]",
234+
"location": "[variables('clusterLocation')]",
235+
"tags": "[parameters('resourceTagValues')]",
236+
"kind": "Linux",
237+
"properties": {
238+
"networkAcls": {
239+
"publicNetworkAccess": "[if(parameters('useAzureMonitorPrivateLinkScope'), 'Disabled', 'Enabled')]"
240+
}
241+
}
242+
},
214243
{
215244
"condition": "[variables('enableHighLogScaleMode')]",
216245
"type": "Microsoft.Insights/dataCollectionEndpoints",
@@ -221,7 +250,7 @@
221250
"kind": "Linux",
222251
"properties": {
223252
"networkAcls": {
224-
"publicNetworkAccess": "Enabled"
253+
"publicNetworkAccess": "[if(parameters('useAzureMonitorPrivateLinkScope'), 'Disabled', 'Enabled')]"
225254
}
226255
}
227256
},
@@ -269,14 +298,137 @@
269298
"parameters": {}
270299
}
271300
},
301+
{
302+
"condition": "[parameters('useAzureMonitorPrivateLinkScope')]",
303+
"type": "Microsoft.Resources/deployments",
304+
"name": "[Concat('aks-monitoring-msi-dcea-config', '-', uniqueString(parameters('aksResourceId')))]",
305+
"apiVersion": "2017-05-10",
306+
"subscriptionId": "[variables('clusterSubscriptionId')]",
307+
"resourceGroup": "[variables('clusterResourceGroup')]",
308+
"dependsOn": [
309+
"[resourceId('Microsoft.Insights/dataCollectionEndpoints/', variables('configDCE'))]"
310+
],
311+
"properties": {
312+
"mode": "Incremental",
313+
"template": {
314+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
315+
"contentVersion": "1.0.0.0",
316+
"parameters": {},
317+
"variables": {},
318+
"resources": [
319+
{
320+
"type": "Microsoft.ContainerService/managedClusters/providers/dataCollectionRuleAssociations",
321+
"name": "[concat(variables('clusterName'),'/microsoft.insights/', variables('configDCEAssociationName'))]",
322+
"apiVersion": "2022-06-01",
323+
"properties": {
324+
"description": "Association of data collection rule endpoint. Deleting this association will break the data collection endpoint for this AKS Cluster.",
325+
"dataCollectionEndpointId": "[variables('configDataCollectionEndpointId')]"
326+
}
327+
}
328+
]
329+
},
330+
"parameters": {}
331+
}
332+
},
333+
{
334+
"condition": "[parameters('useAzureMonitorPrivateLinkScope')]",
335+
"type": "Microsoft.Resources/deployments",
336+
"name": "[Concat('aks-monitoring-msi-ampls-scope-config', '-', uniqueString(parameters('aksResourceId')))]",
337+
"apiVersion": "2017-05-10",
338+
"subscriptionId": "[variables('privateLinkScopeSubscriptionId')]",
339+
"resourceGroup": "[variables('privateLinkScopeResourceGroup')]",
340+
"dependsOn": [
341+
"[resourceId('Microsoft.Insights/dataCollectionEndpoints/', variables('configDCE'))]"
342+
],
343+
"properties": {
344+
"mode": "Incremental",
345+
"template": {
346+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
347+
"contentVersion": "1.0.0.0",
348+
"parameters": {},
349+
"variables": {},
350+
"resources": [
351+
{
352+
"type": "microsoft.insights/privatelinkscopes/scopedresources",
353+
"name": "[concat(variables('privateLinkScopeName'), '/', concat(variables('configDCE'), '-connection'))]",
354+
"apiVersion": "2021-07-01-preview",
355+
"properties": {
356+
"linkedResourceId": "[variables('configDataCollectionEndpointId')]"
357+
}
358+
}
359+
]
360+
},
361+
"parameters": {}
362+
}
363+
},
364+
{
365+
"condition": "[and(parameters('useAzureMonitorPrivateLinkScope'), variables('enableHighLogScaleMode'))]",
366+
"type": "Microsoft.Resources/deployments",
367+
"name": "[Concat('aks-monitoring-msi-ampls-scope-ingest', '-', uniqueString(parameters('aksResourceId')))]",
368+
"apiVersion": "2017-05-10",
369+
"subscriptionId": "[variables('privateLinkScopeSubscriptionId')]",
370+
"resourceGroup": "[variables('privateLinkScopeResourceGroup')]",
371+
"dependsOn": [
372+
"[resourceId('Microsoft.Insights/dataCollectionEndpoints/', variables('ingestionDCE'))]"
373+
],
374+
"properties": {
375+
"mode": "Incremental",
376+
"template": {
377+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
378+
"contentVersion": "1.0.0.0",
379+
"parameters": {},
380+
"variables": {},
381+
"resources": [
382+
{
383+
"type": "microsoft.insights/privatelinkscopes/scopedresources",
384+
"name": "[concat(variables('privateLinkScopeName'), '/', concat(variables('ingestionDCE'), '-connection'))]",
385+
"apiVersion": "2021-07-01-preview",
386+
"properties": {
387+
"linkedResourceId": "[variables('ingestionDataCollectionEndpointId')]"
388+
}
389+
}
390+
]
391+
},
392+
"parameters": {}
393+
}
394+
},
395+
{
396+
"condition": "[parameters('useAzureMonitorPrivateLinkScope')]",
397+
"type": "Microsoft.Resources/deployments",
398+
"name": "[Concat('aks-monitoring-msi-ampls-scope', '-', uniqueString(parameters('workspaceResourceId')))]",
399+
"apiVersion": "2017-05-10",
400+
"subscriptionId": "[variables('privateLinkScopeSubscriptionId')]",
401+
"resourceGroup": "[variables('privateLinkScopeResourceGroup')]",
402+
"properties": {
403+
"mode": "Incremental",
404+
"template": {
405+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
406+
"contentVersion": "1.0.0.0",
407+
"parameters": {},
408+
"variables": {},
409+
"resources": [
410+
{
411+
"type": "microsoft.insights/privatelinkscopes/scopedresources",
412+
"name": "[concat(variables('privateLinkScopeName'), '/', concat(variables('workspaceName'), '-connection'))]",
413+
"apiVersion": "2021-07-01-preview",
414+
"properties": {
415+
"linkedResourceId": "[parameters('workspaceResourceId')]"
416+
}
417+
}
418+
]
419+
},
420+
"parameters": {}
421+
}
422+
},
272423
{
273424
"type": "Microsoft.Resources/deployments",
274425
"name": "[Concat('aks-monitoring-msi-addon', '-', uniqueString(parameters('aksResourceId')))]",
275426
"apiVersion": "2017-05-10",
276427
"subscriptionId": "[variables('clusterSubscriptionId')]",
277428
"resourceGroup": "[variables('clusterResourceGroup')]",
278429
"dependsOn": [
279-
"[Concat('aks-monitoring-msi-dcra', '-', uniqueString(parameters('aksResourceId')))]"
430+
"[Concat('aks-monitoring-msi-dcra', '-', uniqueString(parameters('aksResourceId')))]",
431+
"[Concat('aks-monitoring-msi-dcea-config', '-', uniqueString(parameters('aksResourceId')))]"
280432
],
281433
"properties": {
282434
"mode": "Incremental",
@@ -356,6 +508,12 @@
356508
},
357509
"streams": {
358510
"value": "[parameters('streams')]"
511+
},
512+
"useAzureMonitorPrivateLinkScope": {
513+
"value": "[parameters('useAzureMonitorPrivateLinkScope')]"
514+
},
515+
"azureMonitorPrivateLinkScopeResourceId": {
516+
"value": "[parameters('azureMonitorPrivateLinkScopeResourceId')]"
359517
}
360518
}
361519
}

‎scripts/onboarding/aks/onboarding-msi-bicep-syslog/existingClusterOnboarding.bicep‎

Lines changed: 70 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,12 @@ param enableContainerLogV2 bool
4242
@description('Enable Retina Network Flow Logs in omsagent addon profile')
4343
param enableRetinaNetworkFlowLogs bool = false
4444

45+
@description('Flag to indicate if Azure Monitor Private Link Scope should be used or not')
46+
param useAzureMonitorPrivateLinkScope bool
47+
48+
@description('Specify the Resource Id of the Azure Monitor Private Link Scope.')
49+
param azureMonitorPrivateLinkScopeResourceId string
50+
4551
var clusterSubscriptionId = split(aksResourceId, '/')[2]
4652
var clusterResourceGroup = split(aksResourceId, '/')[4]
4753
var clusterName = split(aksResourceId, '/')[8]
@@ -54,14 +60,38 @@ var enableHighLogScaleMode = contains(streams, 'Microsoft-ContainerLogV2-HighSca
5460
var ingestionDceNameFull = 'MSCI-ingest-${workspaceLocation}-${clusterName}'
5561
var ingestionDceName = (length(ingestionDceNameFull) > 43) ? substring(ingestionDceNameFull, 0, 43) : ingestionDceNameFull
5662
var ingestionDce = endsWith(ingestionDceName, '-') ? substring(ingestionDceName, 0, 42) : ingestionDceName
63+
var clusterLocation = replace(aksResourceLocation, ' ', '')
64+
var configDceNameFull = 'MSCI-config-${clusterLocation}-${clusterName}'
65+
var configDceName = (length(configDceNameFull) > 43) ? substring(configDceNameFull, 0, 43) : configDceNameFull
66+
var configDce = endsWith(configDceName, '-') ? substring(configDceName, 0, 42) : configDceName
67+
var configDceAssociationName = 'configurationAccessEndpoint'
68+
var configDataCollectionEndpointId = resourceId(clusterSubscriptionId, clusterResourceGroup, 'Microsoft.Insights/dataCollectionEndpoints', configDce)
69+
var privateLinkScopeName = split(azureMonitorPrivateLinkScopeResourceId, '/')[8]
70+
5771
var ingestionDataCollectionEndpointId = resourceId(clusterSubscriptionId, clusterResourceGroup, 'Microsoft.Insights/dataCollectionEndpoints', ingestionDce)
5872

73+
resource configDataCollectionEndpoint 'Microsoft.Insights/dataCollectionEndpoints@2022-06-01' = if (useAzureMonitorPrivateLinkScope) {
74+
name: configDce
75+
location: clusterLocation
76+
tags: resourceTagValues
77+
kind: 'Linux'
78+
properties: {
79+
networkAcls: {
80+
publicNetworkAccess: useAzureMonitorPrivateLinkScope ? 'Disabled' : 'Enabled'
81+
}
82+
}
83+
}
84+
5985
resource ingestionDataCollectionEndpoint 'Microsoft.Insights/dataCollectionEndpoints@2022-06-01' = if (enableHighLogScaleMode) {
6086
name: ingestionDce
6187
location: workspaceRegion
6288
tags: resourceTagValues
6389
kind: 'Linux'
64-
properties: {}
90+
properties: {
91+
networkAcls: {
92+
publicNetworkAccess: useAzureMonitorPrivateLinkScope ? 'Disabled' : 'Enabled'
93+
}
94+
}
6595
}
6696

6797
resource aks_monitoring_msi_dcr 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
@@ -125,6 +155,45 @@ resource aks_monitoring_msi_dcr 'Microsoft.Insights/dataCollectionRules@2022-06-
125155
}
126156
}
127157

158+
#disable-next-line BCP174
159+
resource aks_monitoring_msi_dcra_config 'Microsoft.ContainerService/managedClusters/providers/dataCollectionRuleAssociations@2022-06-01' = if (useAzureMonitorPrivateLinkScope) {
160+
name: '${clusterName}/microsoft.insights/${configDceAssociationName}'
161+
properties: {
162+
description: 'Association of data collection rule endpoint. Deleting this association will break the data collection endpoint for this AKS Cluster.'
163+
dataCollectionEndpointId: configDataCollectionEndpointId
164+
}
165+
dependsOn: [
166+
configDataCollectionEndpoint
167+
]
168+
}
169+
170+
resource privateLinkScope_config 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = if (useAzureMonitorPrivateLinkScope) {
171+
name: '${privateLinkScopeName}/${configDce}-connection'
172+
properties: {
173+
linkedResourceId: configDataCollectionEndpointId
174+
}
175+
dependsOn: [
176+
configDataCollectionEndpoint
177+
]
178+
}
179+
180+
resource privateLinkScope_ingestion 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = if (useAzureMonitorPrivateLinkScope && enableHighLogScaleMode) {
181+
name: '${privateLinkScopeName}/${ingestionDce}-connection'
182+
properties: {
183+
linkedResourceId: ingestionDataCollectionEndpointId
184+
}
185+
dependsOn: [
186+
ingestionDataCollectionEndpoint
187+
]
188+
}
189+
190+
resource privateLinkScope_workspace 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = if (useAzureMonitorPrivateLinkScope) {
191+
name: '${privateLinkScopeName}/${split(workspaceResourceId, '/')[8]}-connection'
192+
properties: {
193+
linkedResourceId: workspaceResourceId
194+
}
195+
}
196+
128197
resource aks_monitoring_msi_addon 'Microsoft.ContainerService/managedClusters@2023-04-01' = {
129198
name: clusterName
130199
location: aksResourceLocation

‎scripts/onboarding/aks/onboarding-msi-bicep-syslog/existingClusterParam.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,12 @@
9292
"Microsoft-Perf",
9393
"Microsoft-RetinaNetworkFlowLogs"
9494
]
95+
},
96+
"useAzureMonitorPrivateLinkScope": {
97+
"value": false
98+
},
99+
"azureMonitorPrivateLinkScopeResourceId": {
100+
"value": "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroup>/providers/microsoft.insights/privateLinkScopes/<azureMonitorPrivateLinkScopeName>"
95101
}
96102
}
97103
}

0 commit comments

Comments
 (0)