Skip to content

Commit c6eb42a

Browse files
ganga1980ganga1980
authored
[AKS] aks enable-addons: Add new parameter --enable-msi-auth-for-monitoring to support enabling managed identity auth (Azure#21661)
* add cluster spn with metric publisher role to aks cluster resource * refactor the code * fix default workspace issue in china cloud * add metrics publisher role assignment only in public cloud * fix pr feedback * fix build error * fix lint error * update region mapping * order regions in sortorder * fix trailing whitespaces * fix default log analytics region mapping * fix map index error if key not found * fix lint errors * fix uninitialized error * update to new API version for ARO * use latest api version for ARO * revert to workspace_resource_id in os management profile * fix test case * fixed test failure * added recording file * dont containerinsights solution * remove tests * remove unused imports * remove tests * revert import change * revert change * monitoring addon msi updates * monitoring addon msi updates * monitoring addon msi updates * monitoring addon msi updates * monitoring addon msi updates * monitoring addon msi updates * monitoring addon msi updates * health updates * update ws region mapping for canary regions * remove Microsoft-KubeHealth stream from ci dcr * bug fix
1 parent 75f7048 commit c6eb42a

File tree

9 files changed

+443
-95
lines changed

9 files changed

+443
-95
lines changed

‎linter_exclusions.yml

+6
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,9 @@ aks create:
291291
workspace_resource_id:
292292
rule_exclusions:
293293
- option_length_too_long
294+
enable_msi_auth_for_monitoring:
295+
rule_exclusions:
296+
- option_length_too_long
294297
node_osdisk_diskencryptionset_id:
295298
rule_exclusions:
296299
- option_length_too_long
@@ -305,6 +308,9 @@ aks enable-addons:
305308
workspace_resource_id:
306309
rule_exclusions:
307310
- option_length_too_long
311+
enable_msi_auth_for_monitoring:
312+
rule_exclusions:
313+
- option_length_too_long
308314
aks install-cli:
309315
parameters:
310316
kubelogin_install_location:

‎src/azure-cli/azure/cli/command_modules/acs/_consts.py

+1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@
6060
# monitoring
6161
CONST_MONITORING_ADDON_NAME = "omsagent"
6262
CONST_MONITORING_LOG_ANALYTICS_WORKSPACE_RESOURCE_ID = "logAnalyticsWorkspaceResourceID"
63+
CONST_MONITORING_USING_AAD_MSI_AUTH = "useAADAuth"
6364

6465
# virtual node
6566
CONST_VIRTUAL_NODE_ADDON_NAME = "aciConnector"

‎src/azure-cli/azure/cli/command_modules/acs/_help.py

+8
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,7 @@
339339
- http_application_routing : configure ingress with automatic public DNS name creation.
340340
- monitoring : turn on Log Analytics monitoring. Uses the Log Analytics Default Workspace if it exists, else creates one.
341341
Specify "--workspace-resource-id" to use an existing workspace.
342+
Specify "--enable-msi-auth-for-monitoring" to use Managed Identity Auth.
342343
If monitoring addon is enabled --no-wait argument will have no effect
343344
- azure-policy : enable Azure policy. The Azure Policy add-on for AKS enables at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
344345
Learn more at aka.ms/aks/policy.
@@ -396,6 +397,9 @@
396397
- name: --workspace-resource-id
397398
type: string
398399
short-summary: The resource ID of an existing Log Analytics Workspace to use for storing monitoring data. If not specified, uses the default Log Analytics Workspace if it exists, otherwise creates one.
400+
- name: --enable-msi-auth-for-monitoring
401+
type: bool
402+
short-summary: Enable Managed Identity Auth for Monitoring addon.
399403
- name: --uptime-sla
400404
type: bool
401405
short-summary: Enable a paid managed cluster service with a financially backed SLA.
@@ -778,6 +782,7 @@
778782
These addons are available:
779783
- http_application_routing : configure ingress with automatic public DNS name creation.
780784
- monitoring : turn on Log Analytics monitoring. Requires "--workspace-resource-id".
785+
Requires "--enable_msi_auth_for_monitoring" for managed identity auth.
781786
If monitoring addon is enabled --no-wait argument will have no effect
782787
- virtual-node : enable AKS Virtual Node. Requires --subnet-name to provide the name of an existing subnet for the Virtual Node to use.
783788
- azure-policy : enable Azure policy. The Azure Policy add-on for AKS enables at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
@@ -792,6 +797,9 @@
792797
- name: --workspace-resource-id
793798
type: string
794799
short-summary: The resource ID of an existing Log Analytics Workspace to use for storing monitoring data.
800+
- name: --enable-msi-auth-for-monitoring
801+
type: bool
802+
short-summary: Enable Managed Identity Auth for Monitoring addon.
795803
- name: --appgw-name
796804
type: string
797805
short-summary: Name of the application gateway to create/use in the node resource group. Use with ingress-azure addon.

‎src/azure-cli/azure/cli/command_modules/acs/_params.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
from argcomplete.completers import FilesCompleter
1212
from azure.cli.core.commands.parameters import (
13-
file_type, get_enum_type, get_resource_name_completion_list, name_type, tags_type, zones_type, edge_zone_type)
13+
file_type, get_enum_type, get_resource_name_completion_list, get_three_state_flag, name_type, tags_type, zones_type, edge_zone_type)
1414
from azure.cli.core.commands.validators import validate_file_or_dict
1515
from azure.cli.core.profiles import ResourceType
1616
from knack.arguments import CLIArgumentType
@@ -260,6 +260,7 @@ def load_arguments(self, _):
260260
c.argument('vnet_subnet_id', type=str,
261261
validator=validate_vnet_subnet_id)
262262
c.argument('workspace_resource_id')
263+
c.argument('enable_msi_auth_for_monitoring', arg_type=get_three_state_flag(), is_preview=True)
263264
c.argument('skip_subnet_role_assignment', action='store_true')
264265
c.argument('api_server_authorized_ip_ranges',
265266
type=str, validator=validate_ip_ranges)

‎src/azure-cli/azure/cli/command_modules/acs/addonconfiguration.py

+87-71
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
from azure.cli.core.azclierror import (
88
AzCLIError,
9+
CLIError,
910
ClientRequestError,
1011
)
1112
from azure.cli.core.commands import LongRunningOperation
@@ -118,6 +119,7 @@ def ensure_default_log_analytics_workspace_for_monitoring(
118119
"germanynorth": "germanywestcentral",
119120
"uaecentral": "uaecentral",
120121
"eastus2euap": "eastus2euap",
122+
"centraluseuap": "eastus2euap",
121123
"brazilsoutheast": "brazilsoutheast",
122124
}
123125

@@ -238,7 +240,30 @@ def sanitize_loganalytics_ws_resource_id(workspace_resource_id):
238240
return workspace_resource_id
239241

240242

241-
# pylint: disable=too-many-locals,too-many-branches,too-many-statements
243+
def is_container_insights_extension_dcr_exists(cmd, dcr_url, workspace_resource_id):
244+
containerinsights_extension_dcr_exists = False
245+
_MAX_RETRY_TIMES = 3
246+
for retry_count in range(0, _MAX_RETRY_TIMES):
247+
try:
248+
resp = send_raw_request(
249+
cmd.cli_ctx, "GET", dcr_url
250+
)
251+
json_response = json.loads(resp.text)
252+
destinations = json_response["properties"]["destinations"]
253+
if not destinations and not destinations["logAnalytics"] and len(destinations["logAnalytics"]) > 0:
254+
destinationLogAnalyticsResourceId = destinations["logAnalytics"][0]
255+
if destinationLogAnalyticsResourceId.tolower() == workspace_resource_id.tolower():
256+
containerinsights_extension_dcr_exists = True
257+
break
258+
except CLIError as e:
259+
if "ResourceNotFound" in str(e):
260+
break
261+
if retry_count >= (_MAX_RETRY_TIMES - 1):
262+
raise e
263+
return containerinsights_extension_dcr_exists
264+
265+
266+
# pylint: disable=too-many-locals,too-many-branches,too-many-statements,line-too-long
242267
def ensure_container_insights_for_monitoring(
243268
cmd,
244269
addon,
@@ -286,7 +311,6 @@ def ensure_container_insights_for_monitoring(
286311
try:
287312
subscription_id = workspace_resource_id.split("/")[2]
288313
resource_group = workspace_resource_id.split("/")[4]
289-
workspace_name = workspace_resource_id.split("/")[8]
290314
except IndexError:
291315
raise AzCLIError(
292316
"Could not locate resource group in workspace-resource-id URL."
@@ -308,7 +332,7 @@ def ensure_container_insights_for_monitoring(
308332
f"/subscriptions/{cluster_subscription}/resourceGroups/{cluster_resource_group_name}/"
309333
f"providers/Microsoft.ContainerService/managedClusters/{cluster_name}"
310334
)
311-
dataCollectionRuleName = f"MSCI-{workspace_name}"
335+
dataCollectionRuleName = f"MSCI-{cluster_name}-{cluster_region}"
312336
dcr_resource_id = (
313337
f"/subscriptions/{subscription_id}/resourceGroups/{resource_group}/"
314338
f"providers/Microsoft.Insights/dataCollectionRules/{dataCollectionRuleName}"
@@ -320,12 +344,9 @@ def ensure_container_insights_for_monitoring(
320344
# retry the request up to two times
321345
for _ in range(3):
322346
try:
323-
location_list_url = (
324-
f"https://management.azure.com/subscriptions/{subscription_id}/"
325-
"locations?api-version=2019-11-01"
326-
)
347+
location_list_url = cmd.cli_ctx.cloud.endpoints.resource_manager + \
348+
f"/subscriptions/{subscription_id}/locations?api-version=2019-11-01"
327349
r = send_raw_request(cmd.cli_ctx, "GET", location_list_url)
328-
329350
# this is required to fool the static analyzer. The else statement will only run if an exception
330351
# is thrown, but flake8 will complain that e is undefined if we don't also define it here.
331352
error = None
@@ -344,10 +365,8 @@ def ensure_container_insights_for_monitoring(
344365
# check if region supports DCRs and DCR-A
345366
for _ in range(3):
346367
try:
347-
feature_check_url = (
348-
f"https://management.azure.com/subscriptions/{subscription_id}/"
349-
"providers/Microsoft.Insights?api-version=2020-10-01"
350-
)
368+
feature_check_url = cmd.cli_ctx.cloud.endpoints.resource_manager + \
369+
f"/subscriptions/{subscription_id}/providers/Microsoft.Insights?api-version=2020-10-01"
351370
r = send_raw_request(cmd.cli_ctx, "GET", feature_check_url)
352371
error = None
353372
break
@@ -374,78 +393,77 @@ def ensure_container_insights_for_monitoring(
374393
raise ClientRequestError(
375394
f"Data Collection Rule Associations are not supported for cluster region {location}"
376395
)
377-
378-
# create the DCR
379-
dcr_creation_body = json.dumps(
380-
{
381-
"location": location,
382-
"properties": {
383-
"dataSources": {
384-
"extensions": [
396+
dcr_url = cmd.cli_ctx.cloud.endpoints.resource_manager + f"{dcr_resource_id}?api-version=2019-11-01-preview"
397+
# Create DCR if doesnt exists already with same destination
398+
if not is_container_insights_extension_dcr_exists(cmd, dcr_url, workspace_resource_id):
399+
# create the DCR
400+
dcr_creation_body = json.dumps(
401+
{
402+
"location": location,
403+
"properties": {
404+
"dataSources": {
405+
"extensions": [
406+
{
407+
"name": "ContainerInsightsExtension",
408+
"streams": [
409+
"Microsoft-Perf",
410+
"Microsoft-ContainerInventory",
411+
"Microsoft-ContainerLog",
412+
"Microsoft-ContainerLogV2",
413+
"Microsoft-ContainerNodeInventory",
414+
"Microsoft-KubeEvents",
415+
"Microsoft-KubeMonAgentEvents",
416+
"Microsoft-KubeNodeInventory",
417+
"Microsoft-KubePodInventory",
418+
"Microsoft-KubePVInventory",
419+
"Microsoft-KubeServices",
420+
"Microsoft-InsightsMetrics",
421+
],
422+
"extensionName": "ContainerInsights",
423+
}
424+
]
425+
},
426+
"dataFlows": [
385427
{
386-
"name": "ContainerInsightsExtension",
387428
"streams": [
388429
"Microsoft-Perf",
389430
"Microsoft-ContainerInventory",
390431
"Microsoft-ContainerLog",
391432
"Microsoft-ContainerLogV2",
392433
"Microsoft-ContainerNodeInventory",
393434
"Microsoft-KubeEvents",
394-
"Microsoft-KubeHealth",
395435
"Microsoft-KubeMonAgentEvents",
396436
"Microsoft-KubeNodeInventory",
397437
"Microsoft-KubePodInventory",
398438
"Microsoft-KubePVInventory",
399439
"Microsoft-KubeServices",
400440
"Microsoft-InsightsMetrics",
401441
],
402-
"extensionName": "ContainerInsights",
442+
"destinations": ["la-workspace"],
403443
}
404-
]
444+
],
445+
"destinations": {
446+
"logAnalytics": [
447+
{
448+
"workspaceResourceId": workspace_resource_id,
449+
"name": "la-workspace",
450+
}
451+
]
452+
},
405453
},
406-
"dataFlows": [
407-
{
408-
"streams": [
409-
"Microsoft-Perf",
410-
"Microsoft-ContainerInventory",
411-
"Microsoft-ContainerLog",
412-
"Microsoft-ContainerLogV2",
413-
"Microsoft-ContainerNodeInventory",
414-
"Microsoft-KubeEvents",
415-
"Microsoft-KubeHealth",
416-
"Microsoft-KubeMonAgentEvents",
417-
"Microsoft-KubeNodeInventory",
418-
"Microsoft-KubePodInventory",
419-
"Microsoft-KubePVInventory",
420-
"Microsoft-KubeServices",
421-
"Microsoft-InsightsMetrics",
422-
],
423-
"destinations": ["la-workspace"],
424-
}
425-
],
426-
"destinations": {
427-
"logAnalytics": [
428-
{
429-
"workspaceResourceId": workspace_resource_id,
430-
"name": "la-workspace",
431-
}
432-
]
433-
},
434-
},
435-
}
436-
)
437-
dcr_url = f"https://management.azure.com/{dcr_resource_id}?api-version=2019-11-01-preview"
438-
for _ in range(3):
439-
try:
440-
send_raw_request(
441-
cmd.cli_ctx, "PUT", dcr_url, body=dcr_creation_body
442-
)
443-
error = None
444-
break
445-
except AzCLIError as e:
446-
error = e
447-
else:
448-
raise error
454+
}
455+
)
456+
for _ in range(3):
457+
try:
458+
send_raw_request(
459+
cmd.cli_ctx, "PUT", dcr_url, body=dcr_creation_body
460+
)
461+
error = None
462+
break
463+
except AzCLIError as e:
464+
error = e
465+
else:
466+
raise error
449467

450468
if create_dcra:
451469
# only create or delete the association between the DCR and cluster
@@ -458,10 +476,8 @@ def ensure_container_insights_for_monitoring(
458476
},
459477
}
460478
)
461-
association_url = (
462-
f"https://management.azure.com/{cluster_resource_id}/providers/Microsoft.Insights/"
463-
f"dataCollectionRuleAssociations/send-to-{workspace_name}?api-version=2019-11-01-preview"
464-
)
479+
association_url = cmd.cli_ctx.cloud.endpoints.resource_manager + \
480+
f"{cluster_resource_id}/providers/Microsoft.Insights/dataCollectionRuleAssociations/ContainerInsightsExtension?api-version=2019-11-01-preview"
465481
for _ in range(3):
466482
try:
467483
send_raw_request(

0 commit comments

Comments
 (0)