LogAnalytics workspace - aks logs

[mladents]

Hello,

we currently use azure aks and have a log workspace for logs from that cluster.

Is it possible to set up more detailed access permissions, for example, to ship logs from a (aks cluster applications) namespace to a specific log analytics workspace? The idea here is to configure user's access to the logs from their apps/namespace only, not to have access to all cluster logs.

Tried with azure cli, but it looks like that you can assign log workspace per cluster only.

Thanks,

Best regards,

Mladen.

[#2]

When you setup monitoring there are many Log Analytics Tables that are produced.  

https://docs.microsoft.com/en-gb/azure/azure-monitor/insights/container-insights-analyze#container-d...

You can use Table level RBAC to restrict access to those Tables?  It only table level not fine grain to look at the data within.

[#3]

Hi Mladen,

We are working these days on exactly that. The current resource-centric isn't working right now on AKS clusters as the logs are not tagged with the AKS resource ID. This supposed to be fixed in few weeks. Once it is fixed, you would be able to use the resource-based RBAC to define per-cluster RBAC.
Right now, we don't plan to support per-namespace as namespaces are internal Kube entity that doesn't receive Azure RBAC assignments. We consider options for the future.

Thanks,
Meir

[#4]

@Meir Mendelovich

Hello, 

was there any progress on fine-grained access to data in log analytics?

thanks 

[#5]

@miyamotooo,

There was lots of progress :)

Cluster level RBAC is working and we have many customers that are using it.

We are working on namespace level RBAC but it would take few more months to complete it end-to-end.

Thanks,

Meir :>