Skip to content

Azure Data Explorer Integration#2854

Closed
roy2392 wants to merge 37 commits intoopen-telemetry:mainfrom
roy2392:feature/adx-integration
Closed

Azure Data Explorer Integration#2854
roy2392 wants to merge 37 commits intoopen-telemetry:mainfrom
roy2392:feature/adx-integration

Conversation

@roy2392
Copy link

@roy2392 roy2392 commented Jan 5, 2026

Summary

This PR integrates Azure Data Explorer (ADX) as the telemetry backend for the OpenTelemetry Demo, providing a cost-effective alternative to SaaS observability tools like Datadog and Coralogix for organizations using Azure.

Motivation

  • Demonstrate OpenTelemetry with Azure-native services
  • Provide a cheaper alternative to commercial APM tools (~$150-450/month vs $1000+/month)
  • Keep telemetry data within customer's Azure tenant for compliance
  • Leverage ADX's powerful KQL for advanced analytics

Changes

Infrastructure (Terraform)

  • ADX cluster with database and OTLP-compatible tables
  • AKS cluster for running the demo
  • Service Principal with least-privilege ADX permissions
  • 1-year data retention with 30-day hot cache

OpenTelemetry Collector

  • New otelcol-config-azure.yml with ADX exporter
  • Configured for traces, metrics, and logs pipelines
  • Batch processing for efficient ingestion

Kubernetes

  • Azure-specific secrets and ConfigMaps
  • Deployment script for AKS (deploy-to-aks.sh)

Grafana

  • ADX datasource configuration
  • APM dashboard with KQL queries (latency, errors, throughput)

Documentation

  • Complete Azure deployment guide
  • KQL schema and example queries
  • Updated README with architecture diagrams

Architecture

Microservices (17) --> OTel Collector --> Azure Data Explorer --> Grafana
(ADX Exporter) (Traces/Metrics/Logs) (KQL Dashboards)

Files Changed

Directory Purpose
terraform/ Infrastructure as Code (ADX, AKS, Identity)
kubernetes/azure/ K8s manifests for Azure deployment
src/otel-collector/otelcol-config-azure.yml Collector config with ADX exporter
src/grafana/provisioning/ ADX datasource and dashboards
adx/ KQL schema and example queries
scripts/deploy-to-aks.sh Deployment automation
docs/AZURE_DEPLOYMENT.md Setup guide

How to Test

  1. Deploy infrastructure:
    cd terraform
    cp terraform.tfvars.example terraform.tfvars
    # Edit with your Azure subscription details
    terraform init && terraform apply
    
  2. Deploy to AKS:
    ./scripts/deploy-to-aks.sh
  3. Verify data in ADX:
    OTelTraces | count
    OTelMetrics | count
    OTelLogs | count
  4. Access Grafana dashboards:
    kubectl port-forward -n otel-demo svc/grafana 3000:3000

Checklist

  • Terraform modules for ADX, AKS, and Service Principal
  • OTel Collector configuration with ADX exporter
  • Kubernetes manifests for Azure deployment
  • Grafana ADX datasource and dashboards
  • KQL schema with retention policies
  • Deployment script and documentation
  • End-to-end testing on Azure (requires Azure subscription)

Related Links

Roy Zalta and others added 25 commits January 5, 2026 10:17
- Add Terraform version constraints (>= 1.5.0)
- Configure Azure providers (azurerm, azuread, random, local)
- Add .gitignore for Terraform sensitive files
- Create Azure Data Explorer cluster with streaming ingestion
- Define tables for traces, metrics, and logs
- Configure retention policies (365 days) and hot cache (30 days)
- Add JSON ingestion mappings for OTLP format
- Create Azure Kubernetes Service cluster with autoscaling
- Configure Azure CNI networking and RBAC
- Add Log Analytics workspace for monitoring
- Enable Container Insights solution
- Create Azure AD application and service principal
- Configure client secret with 180-day rotation
- Grant ADX Database Ingestor and Viewer roles
- Orchestrate ADX, AKS, and identity modules
- Create resource group and virtual network
- Generate Kubernetes secrets YAML from Terraform
- Output deployment instructions and next steps
- Document all configurable variables with examples
- Add kubernetes/azure directory for generated secrets
- Create Azure-specific OTel collector configuration
- Configure ADX exporter for traces, metrics, and logs
- Add batch processor for efficient ingestion
- Configure spanmetrics connector for service metrics
- Add template for ADX connection settings
- Add Service Principal authentication variables
- Update .gitignore to exclude .env.azure.local with secrets
- Create secrets template for ADX credentials
- Document all required Azure authentication values
- Configure Kubernetes-aware OTel collector for ADX
- Add k8sattributes processor for pod metadata
- Configure spanmetrics connector for service metrics
- Create automated deployment script with Terraform integration
- Support manual deployment with --skip-terraform flag
- Add colorized output and status reporting
- Configure Azure Data Explorer datasource for Grafana
- Add separate datasource views for traces, metrics, and logs
- Support Service Principal authentication
- Create comprehensive APM dashboard for ADX
- Add service overview stats (spans, errors, latency)
- Add request rate and P95 latency time series
- Add error logs visualization
- Add service performance summary table
- Create standalone KQL schema for ADX tables
- Define traces, metrics, and logs table structures
- Add JSON ingestion mappings for OTLP format
- Configure retention and caching policies
- Add service overview queries
- Add trace analysis examples
- Add latency and error analysis
- Add log correlation queries
- Add metrics analysis examples
- Add architecture overview and prerequisites
- Document Terraform and manual deployment options
- Include configuration reference tables
- Add troubleshooting section
- Document cost estimation
- Add service-flow image reference
- Add mermaid architecture diagram showing data flow
- Add mermaid repo structure diagram for Azure-specific files
- Document benefits vs SaaS observability tools
- Link to detailed Azure deployment guide
@roy2392 roy2392 requested a review from a team as a code owner January 5, 2026 08:44
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Jan 5, 2026

CLA Missing ID CLA Not Signed

@github-actions github-actions bot added the helm-update-required Requires an update to the Helm chart when released label Jan 5, 2026
Roy Zalta added 2 commits January 5, 2026 10:56
- Change auto_scaling_enabled to enable_auto_scaling
- Change automatic_upgrade_channel to automatic_channel_upgrade
roy2392 and others added 10 commits January 5, 2026 11:27
feat: integrate Azure Data Explorer as telemetry backend
- Update default Kubernetes version from 1.29 to 1.32 (1.29 now requires LTS)
- Add explicit service_cidr (172.16.0.0/16) to avoid overlap with VNet
- Add dns_service_ip (172.16.0.10) for AKS DNS service
- Add comprehensive INTEGRATE_YOUR_SERVICES.md with examples for:
  - Python, Node.js, Java, .NET, and Go instrumentation
  - OTel Collector configuration for ADX
  - Kubernetes and Docker deployment examples
  - KQL queries for monitoring
  - Grafana integration
- Update README and AZURE_DEPLOYMENT.md with links to new guide
- Add ADX configuration section to values.yaml with cluster URI, database, tables
- Add Azure authentication settings (tenantId, clientId, clientSecret, existingSecret)
- Update otel-collector-deployment.yaml to inject ADX env vars from secret
- Create adx-secret.yaml template for automatic secret creation
- Create grafana-adx-datasource.yaml for automatic datasource provisioning
- Create values-azure.yaml example file with full Azure configuration
- Update README with Azure Data Explorer quick start guide
- Add Terraform resource to generate values-generated.yaml with ADX credentials
- Update outputs.tf with Helm installation commands
- Update deploy-to-aks.sh to use Helm by default (with kubectl fallback)
- Add generated files to .gitignore (secrets.yaml, values-generated.yaml)
- Update README with integrated deployment workflow

Terraform now generates a complete Helm values file that the deployment
script automatically uses, creating a seamless infrastructure-to-deployment
pipeline.
Migrate from Service Principal with client secret to Azure AD Workload
Identity for secure, secret-less authentication to Azure Data Explorer.

Changes:
- Enable OIDC issuer and Workload Identity on AKS cluster
- Replace Azure AD App/Service Principal with User-Assigned Managed Identity
- Add Federated Identity Credential linking K8s service account to identity
- Update OTel Collector config to use `use_azure_auth: true`
- Update Helm chart with conditional Workload Identity support
- Remove namespace.yaml template (conflicts with Helm --create-namespace)
- Fix RBAC ClusterRoleBinding service account name

Benefits:
- No secrets stored in Kubernetes
- Automatic token rotation (tokens expire in ~1 hour)
- Reduced blast radius (tokens only valid for specific pod)
- Full Azure AD audit logging
- Simplified secret management
@julianocosta89
Copy link
Member

Hello @roy2392, I think this PR was pointed to the wrong repo.
The updatream demo does not have vendor specific implementations.

What we have is a list of links to each vendor on the main README: https://github.com/open-telemetry/opentelemetry-demo?tab=readme-ov-file#demos-featuring-the-astronomy-shop

Feel free to have a fork of the Demo and open a PR adding a link to it in here.

As of now, I'm closing this PR.
Let me know if you need any assistance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

helm-update-required Requires an update to the Helm chart when released

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants