Container insights not working when using existing Log Analytics Workspace

[dboden-nitro]

Is there an existing issue for this?

• I have searched the existing issues

Greenfield/Brownfield provisioning

greenfield

Terraform Version

1.9.8

Module Version

9.2.0

AzureRM Provider Version

3.117.0

Affected Resource(s)/Data Source(s)

N/A

Terraform Configuration Files

module "aks" {
  source  = "Azure/aks/azurerm"
  version = "9.2.0"
...
  log_analytics_workspace = {
    id = "/subscriptions/../../providers/Microsoft.OperationalInsights/workspaces/<workspacename>"
    name = "<workspacename>"
  }
  msi_auth_for_monitoring_enabled = true
}

tfvars variables values

N/A

Debug Output/Panic Output

N/A

Expected Behaviour

Container insight logs are available in the existing log analytics workspace provided as an input variable.
I believe this is due to a missing data collection rule.

Actual Behaviour

No logs are available in the existing log analytics workspace.

The following warning is shown when looking at the monitor settings:
You do not have access to the associated data collection rule to view the log analytics workspace name or the data collection rule has been deleted.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[zioproto]

Please could you clarify if the log_analytics_workspace.id is pointing to a workspace in the same subscription ?

Related issue: #588

[dboden-nitro]

@zioproto I confirm that log_analytics_workspace.id is pointing to a workspace in the same subscription.

[zioproto]

You are right the diagnostic settings are not created in this module. There is no azurerm_monitor_diagnostic_setting resource.

I think the expectation was that if you bring your work Log Analytics Workspace you also provide the necessary azurerm_monitor_diagnostic_setting.

You can add a resource like this:

resource "azurerm_monitor_diagnostic_setting" "aks" {
  name                           = "my-diagnostic-setting-name"
  target_resource_id             = module.aks.aks_id
  log_analytics_destination_type = "Dedicated"

# This is "/subscriptions/../../providers/Microsoft.OperationalInsights/workspaces/<workspacename>"
  log_analytics_workspace_id     = azurerm_log_analytics_workspace.this.id 

  # Kubernetes API Server
  enabled_log {
    category = "kube-apiserver"
  }
  # Kubernetes Audit
  enabled_log {
    category = "kube-audit"
  }
  # Kubernetes Audit Admin Logs
  enabled_log {
    category = "kube-audit-admin"
  }
  # Kubernetes Controller Manager
  enabled_log {
    category = "kube-controller-manager"
  }
  # Kubernetes Scheduler
  enabled_log {
    category = "kube-scheduler"
  }
  #Kubernetes Cluster Autoscaler
  enabled_log {
    category = "cluster-autoscaler"
  }
  #Kubernetes Cloud Controller Manager
  enabled_log {
    category = "cloud-controller-manager"
  }
  #guard
  enabled_log {
    category = "guard"
  }
  #csi-azuredisk-controller
  enabled_log {
    category = "csi-azuredisk-controller"
  }
  #csi-azurefile-controller
  enabled_log {
    category = "csi-azurefile-controller"
  }
  #csi-snapshot-controller
  enabled_log {
    category = "csi-snapshot-controller"
  }
  metric {
    category = "AllMetrics"
  }
}

Please let me know if this fixes the problem.