azure - 如何将 AKS 应用程序群集、节点、Pod、容器指标发送到 Log Analytics 工作区，以便在 Azure 监控中可用？

Question

我使用以下 Terraform 代码创建了 AKS 集群

resource "azurerm_virtual_network" "test" {
  name                = var.virtual_network_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = [var.virtual_network_address_prefix]

  subnet {
    name           = var.aks_subnet_name
    address_prefix = var.aks_subnet_address_prefix
  }

  tags = var.tags
}

data "azurerm_subnet" "kubesubnet" {
  name                 = var.aks_subnet_name
  virtual_network_name = azurerm_virtual_network.test.name
  resource_group_name  = azurerm_resource_group.rg.name
  depends_on           = [azurerm_virtual_network.test]
}

# Create Log Analytics Workspace
module "log_analytics_workspace" {
  source                = "./modules/log_analytics_workspace"
  count                 = var.enable_log_analytics_workspace == true ? 1 : 0
  app_or_service_name   = "log" 
  subscription_type     = var.subscription_type 
  environment           = var.environment 
  resource_group_name   = azurerm_resource_group.rg.name 
  location              = var.location 
  instance_number       = var.instance_number  
  sku                   = var.log_analytics_workspace_sku
  retention_in_days     = var.log_analytics_workspace_retention_in_days 
  tags                  = var.tags
}

resource "azurerm_kubernetes_cluster" "k8s" {
  name       = var.aks_name
  location   = azurerm_resource_group.rg.location
  dns_prefix = var.aks_dns_prefix

  resource_group_name = azurerm_resource_group.rg.name

  http_application_routing_enabled = false

  linux_profile {
    admin_username = var.vm_user_name

    ssh_key {
      key_data = file(var.public_ssh_key_path)
    }
  }

  default_node_pool {
    name            = "agentpool"
    node_count      = var.aks_agent_count
    vm_size         = var.aks_agent_vm_size
    os_disk_size_gb = var.aks_agent_os_disk_size
    vnet_subnet_id  = data.azurerm_subnet.kubesubnet.id
  }

  service_principal {
    client_id     = local.client_id
    client_secret = local.client_secret
  }

  network_profile {
    network_plugin     = "azure"
    dns_service_ip     = var.aks_dns_service_ip
    docker_bridge_cidr = var.aks_docker_bridge_cidr
    service_cidr       = var.aks_service_cidr
  }

  # Enabled the cluster configuration to the Azure kubernets with RBAC
  azure_active_directory_role_based_access_control { 
    managed                     = var.azure_active_directory_role_based_access_control_managed
    admin_group_object_ids      = var.active_directory_role_based_access_control_admin_group_object_ids
    azure_rbac_enabled          = var.azure_rbac_enabled
  }

  oms_agent {
    log_analytics_workspace_id  = module.log_analytics_workspace[0].id
  }

  timeouts {
    create = "20m"
    delete = "20m"
  }  

  depends_on = [data.azurerm_subnet.kubesubnet,module.log_analytics_workspace]
  tags       = var.tags
}

我想将 AKS 应用程序群集、节点、Pod、容器指标发送到 Log Analytics 工作区，以便在 Azure 监控中可用。

我已经配置了如下所述的诊断设置

resource "azurerm_monitor_diagnostic_setting" "aks_cluster" {
  name                       = "${azurerm_kubernetes_cluster.k8s.name}-audit"
  target_resource_id         = azurerm_kubernetes_cluster.k8s.id
  log_analytics_workspace_id = module.log_analytics_workspace[0].id

  log {
    category = "kube-apiserver"
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = "kube-controller-manager"
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = "cluster-autoscaler"
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = "kube-scheduler"
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  log {
    category = "kube-audit"
    enabled  = true

    retention_policy {
      enabled = false
    }
  }

  metric {
    category = "AllMetrics"
    enabled  = false

    retention_policy {
      enabled = false
    }
  }
}

这些都需要吗？我确实看到一篇文章，其中他们使用 azurerm_application_insights，但我不明白为什么需要 azurerm_application_insights 来捕获集群级别指标？

Answer 1

您不需要 Application Insights，这实际上取决于您是否需要应用程序级别监控。

这可能是您希望阅读的内容:
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/application_insights
“管理 Application Insights 组件。”
Application Insights 提供对 AKS 和其他环境中运行的应用程序的完整监控。
https://learn.microsoft.com/en-us/azure/aks/monitor-aks#level-4--applications

根据良好实践，您需要启用其他一些功能:

• 如果您使用 AAD，则应启用guard。
• 启用AllMetrics。
• 考虑使用 kube-audit-admin 来减少日志记录事件。
• 考虑csi-azuredisk-controller。
• 考虑使用 cloud-controller-manager 作为 cloud-node-manager 组件。

在此处查看更多内容:

• https://learn.microsoft.com/en-us/azure/aks/monitor-aks#configure-monitoring
• https://learn.microsoft.com/en-us/azure/aks/monitor-aks-reference