CI OTLP GA

src/azure-cli/HISTORY.rst

@@ -24,6 +24,13 @@ Release History
 * `az aks nodepool rollback`: Show an accurate warning when only the node OS upgrade channel is enabled (#33854)
 * Implement enable/disable flags for user-defined scheduler configuration (#33934)
 * `az aks update`: Fix Azure Container Storage configuration detection for lowercase and boolean extension settings (#33938)
+* `az aks create`, `az aks update`: Add `--enable-azure-monitor-logs` to onboard Container Insights through the Azure Monitor profile using managed identity authentication
+* `az aks update`: Add `--disable-azure-monitor-logs` to offboard Container Insights
+* `az aks create`, `az aks update`: Add `--syslog-port`, `--enable-prometheus-metrics-scraping` and `--disable-prometheus-metrics-scraping` to tune the Azure Monitor Container Insights configuration
+* `az aks create`, `az aks update`: Add `--enable-opentelemetry-metrics`, `--disable-opentelemetry-metrics`, `--opentelemetry-metrics-port-http` and `--opentelemetry-metrics-port-grpc` for the OpenTelemetry metrics receiver
+* `az aks create`, `az aks update`: Add `--enable-opentelemetry-logs-traces`, `--disable-opentelemetry-logs-traces`, `--opentelemetry-logs-traces-port-http` and `--opentelemetry-logs-traces-port-grpc` for the OpenTelemetry logs and traces receiver
+* `az aks create`, `az aks update`: Write container network logs to `azureMonitorProfile.containerInsights.containerNetworkLogs` instead of the monitoring addon configuration, and reject `--enable-container-network-logs` on clusters using legacy shared key authentication
+* `az aks create`, `az aks update`, `az aks enable-addons`: Deprecate `--enable-msi-auth-for-monitoring` in favor of `--enable-azure-monitor-logs`
 
 **App Config**
 

src/azure-cli/azure/cli/command_modules/acs/_consts.py

@@ -160,6 +160,13 @@
 CONST_MONITORING_LOG_ANALYTICS_WORKSPACE_RESOURCE_ID = "logAnalyticsWorkspaceResourceID"
 CONST_MONITORING_USING_AAD_MSI_AUTH = "useAADAuth"
 
+# container network logs (azureMonitorProfile.containerInsights.containerNetworkLogs)
+CONST_CONTAINER_NETWORK_LOGS_ENABLED = "Enabled"
+CONST_CONTAINER_NETWORK_LOGS_DISABLED = "Disabled"
+# legacy omsagent addon config key, superseded by containerNetworkLogs on the Azure Monitor
+# profile path. Only read, to keep recognizing clusters onboarded before the switch.
+CONST_MONITORING_ENABLE_RETINA_NETWORK_FLAGS = "enableRetinaNetworkFlags"
+
 # virtual node
 CONST_VIRTUAL_NODE_ADDON_NAME = "aciConnector"
 CONST_VIRTUAL_NODE_SUBNET_NAME = "SubnetName"

src/azure-cli/azure/cli/command_modules/acs/_help.py

@@ -330,6 +330,21 @@
   - name: --enable-high-log-scale-mode
     type: bool
     short-summary: Enable High Log Scale Mode for Container Logs. Auto-enabled when --enable-container-network-logs is specified.
+  - name: --enable-azure-monitor-logs
+    type: bool
+    short-summary: Enable Azure Monitor logs (Container Insights) for the cluster using managed identity authentication.
+    long-summary: |
+        Configures Container Insights through the cluster's Azure Monitor profile instead of the monitoring addon.
+        Cannot be combined with "--enable-addons monitoring" or with "--enable-msi-auth-for-monitoring".
+  - name: --syslog-port
+    type: int
+    short-summary: TCP port that the Azure Monitor agent listens on for syslog data. Requires --enable-azure-monitor-logs.
+  - name: --enable-prometheus-metrics-scraping
+    type: bool
+    short-summary: Enable Prometheus metrics scraping by the Azure Monitor agent. Requires --enable-azure-monitor-logs.
+  - name: --disable-prometheus-metrics-scraping
+    type: bool
+    short-summary: Disable Prometheus metrics scraping by the Azure Monitor agent. Requires --enable-azure-monitor-logs.
   - name: --sku
     type: string
     short-summary: Specify SKU name for managed clusters. Use '--sku base' enables a base managed cluster. Use '--sku automatic' enables an automatic managed cluster.
@@ -564,6 +579,30 @@
   - name: --enable-azure-monitor-app-monitoring
     type: bool
     short-summary: Enable Azure Monitor Application Monitoring auto-instrumentation for a Kubernetes cluster.
+  - name: --enable-opentelemetry-metrics
+    type: bool
+    short-summary: Enable the OpenTelemetry (OTLP) metrics receiver. Requires --enable-azure-monitor-metrics.
+  - name: --disable-opentelemetry-metrics
+    type: bool
+    short-summary: Disable the OpenTelemetry (OTLP) metrics receiver.
+  - name: --opentelemetry-metrics-port-http
+    type: int
+    short-summary: HTTP/protobuf port for the OpenTelemetry metrics receiver.
+  - name: --opentelemetry-metrics-port-grpc
+    type: int
+    short-summary: gRPC port for the OpenTelemetry metrics receiver.
+  - name: --enable-opentelemetry-logs-traces
+    type: bool
+    short-summary: Enable the OpenTelemetry (OTLP) logs and traces receiver. Requires --enable-azure-monitor-logs.
+  - name: --disable-opentelemetry-logs-traces
+    type: bool
+    short-summary: Disable the OpenTelemetry (OTLP) logs and traces receiver.
+  - name: --opentelemetry-logs-traces-port-http
+    type: int
+    short-summary: HTTP/protobuf port for the OpenTelemetry logs and traces receiver.
+  - name: --opentelemetry-logs-traces-port-grpc
+    type: int
+    short-summary: gRPC port for the OpenTelemetry logs and traces receiver.
   - name: --nodepool-taints
     type: string
     short-summary: The node taints for all node pool.
@@ -752,6 +791,14 @@
     text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-keda
   - name: Create a kubernetes cluster with the Azure Monitor managed service for Prometheus integration enabled.
     text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-metrics
+  - name: Create a kubernetes cluster with Azure Monitor logs (Container Insights) enabled.
+    text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-logs
+  - name: Create a kubernetes cluster with Azure Monitor logs enabled and syslog collected on a custom port.
+    text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-logs --enable-syslog --syslog-port 28330
+  - name: Create a kubernetes cluster with the OpenTelemetry logs and traces receiver enabled.
+    text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-logs --enable-opentelemetry-logs-traces --opentelemetry-logs-traces-port-grpc 4317
+  - name: Create a kubernetes cluster with the OpenTelemetry metrics receiver enabled.
+    text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-metrics --enable-opentelemetry-metrics --opentelemetry-metrics-port-grpc 4319
   - name: Create a kubernetes cluster with vertical pod autoscaler enaled.
     text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-vpa
   - name: create a kubernetes cluster with a Capacity Reservation Group(CRG) ID.
@@ -1120,6 +1167,63 @@
   - name: --disable-azure-monitor-app-monitoring
     type: bool
     short-summary: Disable Azure Monitor Application Monitoring auto-instrumentation for a Kubernetes cluster.
+  - name: --enable-azure-monitor-logs
+    type: bool
+    short-summary: Enable Azure Monitor logs (Container Insights) for the cluster using managed identity authentication.
+    long-summary: |
+        Configures Container Insights through the cluster's Azure Monitor profile instead of the monitoring addon.
+        Clusters still using legacy shared key authentication must first migrate to managed identity authentication.
+  - name: --disable-azure-monitor-logs
+    type: bool
+    short-summary: Disable Azure Monitor logs (Container Insights) for the cluster.
+  - name: --workspace-resource-id
+    type: string
+    short-summary: The resource ID of an existing Log Analytics Workspace to use for storing monitoring data. If not specified, uses the default Log Analytics Workspace if it exists, otherwise creates one.
+  - name: --enable-msi-auth-for-monitoring
+    type: bool
+    short-summary: Enable Managed Identity Auth for Monitoring addon.
+  - name: --enable-syslog
+    type: bool
+    short-summary: Enable syslog data collection for Monitoring addon.
+  - name: --data-collection-settings
+    type: string
+    short-summary: Path to JSON file containing data collection settings for Monitoring addon.
+  - name: --ampls-resource-id
+    type: string
+    short-summary: Resource ID of Azure Monitor Private Link scope for Monitoring Addon.
+  - name: --syslog-port
+    type: int
+    short-summary: TCP port that the Azure Monitor agent listens on for syslog data. Requires Azure Monitor logs to be enabled.
+  - name: --enable-prometheus-metrics-scraping
+    type: bool
+    short-summary: Enable Prometheus metrics scraping by the Azure Monitor agent. Requires Azure Monitor logs to be enabled.
+  - name: --disable-prometheus-metrics-scraping
+    type: bool
+    short-summary: Disable Prometheus metrics scraping by the Azure Monitor agent. Requires Azure Monitor logs to be enabled.
+  - name: --enable-opentelemetry-metrics
+    type: bool
+    short-summary: Enable the OpenTelemetry (OTLP) metrics receiver. Requires Azure Monitor metrics to be enabled.
+  - name: --disable-opentelemetry-metrics
+    type: bool
+    short-summary: Disable the OpenTelemetry (OTLP) metrics receiver.
+  - name: --opentelemetry-metrics-port-http
+    type: int
+    short-summary: HTTP/protobuf port for the OpenTelemetry metrics receiver.
+  - name: --opentelemetry-metrics-port-grpc
+    type: int
+    short-summary: gRPC port for the OpenTelemetry metrics receiver.
+  - name: --enable-opentelemetry-logs-traces
+    type: bool
+    short-summary: Enable the OpenTelemetry (OTLP) logs and traces receiver. Requires Azure Monitor logs to be enabled.
+  - name: --disable-opentelemetry-logs-traces
+    type: bool
+    short-summary: Disable the OpenTelemetry (OTLP) logs and traces receiver.
+  - name: --opentelemetry-logs-traces-port-http
+    type: int
+    short-summary: HTTP/protobuf port for the OpenTelemetry logs and traces receiver.
+  - name: --opentelemetry-logs-traces-port-grpc
+    type: int
+    short-summary: gRPC port for the OpenTelemetry logs and traces receiver.
   - name: --nodepool-taints
     type: string
     short-summary: The node taints for all node pool.
@@ -1247,6 +1351,16 @@
 examples:
   - name: Reconcile the cluster back to its current state.
     text: az aks update -g MyResourceGroup -n MyManagedCluster
+  - name: Enable Azure Monitor logs (Container Insights) on an existing cluster.
+    text: az aks update -g MyResourceGroup -n MyManagedCluster --enable-azure-monitor-logs
+  - name: Disable Azure Monitor logs (Container Insights) on an existing cluster.
+    text: az aks update -g MyResourceGroup -n MyManagedCluster --disable-azure-monitor-logs
+  - name: Change the syslog port used by Azure Monitor logs on an existing cluster.
+    text: az aks update -g MyResourceGroup -n MyManagedCluster --enable-syslog --syslog-port 28330
+  - name: Enable the OpenTelemetry logs and traces receiver on an existing cluster.
+    text: az aks update -g MyResourceGroup -n MyManagedCluster --enable-opentelemetry-logs-traces --opentelemetry-logs-traces-port-grpc 4317
+  - name: Enable the OpenTelemetry metrics receiver on an existing cluster.
+    text: az aks update -g MyResourceGroup -n MyManagedCluster --enable-opentelemetry-metrics --opentelemetry-metrics-port-grpc 4319
   - name: Update a kubernetes cluster with standard SKU load balancer to use two AKS created IPs for the load balancer outbound connection usage.
     text: az aks update -g MyResourceGroup -n MyManagedCluster --load-balancer-managed-outbound-ip-count 2
   - name: Update a kubernetes cluster with standard SKU load balancer to use the provided public IPs for the load balancer outbound connection usage.

src/azure-cli/azure/cli/command_modules/acs/_params.py

@@ -140,6 +140,12 @@
     validate_bootstrap_container_registry_resource_id,
     validate_gateway_prefix_size,
     validate_artifact_streaming,
+    validate_azure_monitor_logs_and_enable_addons,
+    validate_azure_monitor_logs_enable_disable,
+    validate_container_insights_settings_for_create,
+    validate_container_insights_settings_for_update,
+    validate_azure_monitor_and_opentelemetry_for_create,
+    validate_azure_monitor_and_opentelemetry_for_update,
 )
 from azure.cli.core.commands.parameters import (
     edge_zone_type, file_type, get_enum_type,
@@ -504,11 +510,44 @@ def load_arguments(self, _):
         # addons
         c.argument('enable_addons', options_list=['--enable-addons', '-a'])
         c.argument('workspace_resource_id')
-        c.argument('enable_msi_auth_for_monitoring', arg_type=get_three_state_flag())
+        c.argument(
+            'enable_msi_auth_for_monitoring',
+            arg_type=get_three_state_flag(),
+            deprecate_info=c.deprecate(
+                target='--enable-msi-auth-for-monitoring',
+                redirect='--enable-azure-monitor-logs',
+            ),
+        )
         c.argument('enable_syslog', arg_type=get_three_state_flag())
         c.argument('data_collection_settings')
         c.argument('ampls_resource_id', validator=validate_azuremonitor_privatelinkscope_resourceid)
         c.argument('enable_high_log_scale_mode', arg_type=get_three_state_flag())
+        # azure monitor logs (container insights on the azure monitor profile)
+        c.argument(
+            'enable_azure_monitor_logs',
+            action='store_true',
+            validator=validate_azure_monitor_logs_and_enable_addons,
+        )
+        c.argument(
+            'syslog_port',
+            type=int,
+            validator=validate_container_insights_settings_for_create,
+        )
+        c.argument('enable_prometheus_metrics_scraping', action='store_true')
+        c.argument('disable_prometheus_metrics_scraping', action='store_true')
+        # opentelemetry
+        c.argument(
+            'enable_opentelemetry_metrics',
+            action='store_true',
+            validator=validate_azure_monitor_and_opentelemetry_for_create,
+        )
+        c.argument('disable_opentelemetry_metrics', action='store_true')
+        c.argument('opentelemetry_metrics_port_http', type=int)
+        c.argument('opentelemetry_metrics_port_grpc', type=int)
+        c.argument('enable_opentelemetry_logs_traces', action='store_true')
+        c.argument('disable_opentelemetry_logs_traces', action='store_true')
+        c.argument('opentelemetry_logs_traces_port_http', type=int)
+        c.argument('opentelemetry_logs_traces_port_grpc', type=int)
         c.argument('aci_subnet_name')
         c.argument('appgw_name', arg_group='Application Gateway')
         c.argument('appgw_subnet_cidr', arg_group='Application Gateway')
@@ -846,6 +885,45 @@ def load_arguments(self, _):
         )
         c.argument('enable_azure_monitor_app_monitoring', action='store_true')
         c.argument('disable_azure_monitor_app_monitoring', action='store_true')
+        # azure monitor logs (container insights on the azure monitor profile)
+        c.argument(
+            'enable_azure_monitor_logs',
+            action='store_true',
+            validator=validate_azure_monitor_logs_enable_disable,
+        )
+        c.argument('disable_azure_monitor_logs', action='store_true')
+        c.argument('workspace_resource_id')
+        c.argument(
+            'enable_msi_auth_for_monitoring',
+            arg_type=get_three_state_flag(),
+            deprecate_info=c.deprecate(
+                target='--enable-msi-auth-for-monitoring',
+                redirect='--enable-azure-monitor-logs',
+            ),
+        )
+        c.argument('enable_syslog', arg_type=get_three_state_flag())
+        c.argument('data_collection_settings')
+        c.argument('ampls_resource_id', validator=validate_azuremonitor_privatelinkscope_resourceid)
+        c.argument(
+            'syslog_port',
+            type=int,
+            validator=validate_container_insights_settings_for_update,
+        )
+        c.argument('enable_prometheus_metrics_scraping', action='store_true')
+        c.argument('disable_prometheus_metrics_scraping', action='store_true')
+        # opentelemetry
+        c.argument(
+            'enable_opentelemetry_metrics',
+            action='store_true',
+            validator=validate_azure_monitor_and_opentelemetry_for_update,
+        )
+        c.argument('disable_opentelemetry_metrics', action='store_true')
+        c.argument('opentelemetry_metrics_port_http', type=int)
+        c.argument('opentelemetry_metrics_port_grpc', type=int)
+        c.argument('enable_opentelemetry_logs_traces', action='store_true')
+        c.argument('disable_opentelemetry_logs_traces', action='store_true')
+        c.argument('opentelemetry_logs_traces_port_http', type=int)
+        c.argument('opentelemetry_logs_traces_port_grpc', type=int)
         # azure container storage
         c.argument(
             "enable_azure_container_storage",
@@ -969,7 +1047,14 @@ def load_arguments(self, _):
         c.argument('enable_sgxquotehelper', action='store_true')
         c.argument('enable_secret_rotation', action='store_true')
         c.argument('rotation_poll_interval')
-        c.argument('enable_msi_auth_for_monitoring', arg_type=get_three_state_flag())
+        c.argument(
+            'enable_msi_auth_for_monitoring',
+            arg_type=get_three_state_flag(),
+            deprecate_info=c.deprecate(
+                target='--enable-msi-auth-for-monitoring',
+                redirect='--enable-azure-monitor-logs',
+            ),
+        )
         c.argument('enable_syslog', arg_type=get_three_state_flag())
         c.argument('data_collection_settings')
         c.argument('ampls_resource_id', validator=validate_azuremonitor_privatelinkscope_resourceid)