Home

LogAnalytics workspace - aks logs

mladents
Occasional Visitor

Hello,

 

we currently use azure aks and have a log workspace for logs from that cluster.

 

Is it possible to set up more detailed access permissions, for example, to ship logs from a (aks cluster applications) namespace to a specific log analytics workspace? The idea here is to configure user's access to the logs from their apps/namespace only, not to have access to all cluster logs.

 

Tried with azure cli, but it looks like that you can assign log workspace per cluster only.

 

Thanks,

 

Best regards,

Mladen.

 

2 Replies

When you setup monitoring there are many Log Analytics Tables that are produced.  

https://docs.microsoft.com/en-gb/azure/azure-monitor/insights/container-insights-analyze#container-d...

 

You can use Table level RBAC to restrict access to those Tables?  It only table level not fine grain to look at the data within.

Hi Mladen,

We are working these days on exactly that. The current resource-centric isn't working right now on AKS clusters as the logs are not tagged with the AKS resource ID. This supposed to be fixed in few weeks. Once it is fixed, you would be able to use the resource-based RBAC to define per-cluster RBAC.
Right now, we don't plan to support per-namespace as namespaces are internal Kube entity that doesn't receive Azure RBAC assignments. We consider options for the future.

Thanks,
Meir