Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,662 questions
how to integrate azure monitor workspace with istio
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 7.000000000000001%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
Benil Raj
0
Reputation points
I have been trying to integrate Istio service mesh with azure monitor workspace. I have provided the Query endpoint in my kiali configuration but not able to get the istio metrics and kiali throws client error 401. I have also used bearer token in kiali config to authenticate.
Azure Monitor
{count} votes
-
tbgangav-MSFT 10,426 Reputation points Moderator2023-10-20T13:20:41.3533333+00:00 Hi @Benil Raj ,
To integrate Istio service mesh with Azure Monitor workspace, you can enable the Istio-based service mesh add-on for AKS clusters, which provides observability to your microservices architecture. Istio is an open-source service mesh that layers transparently onto existing distributed applications. The add-on assists in the deployment and management of Istio for AKS. Once enabled, you can use Container Insights to collect container stdout/stderr, infrastructure logs, and performance data, and send them to a Log Analytics workspace in Azure Monitor for analysis using Kusto Query Language (KQL).
If you are still experiencing issues with authentication, you may want to double-check that you have followed the steps to register an app with Microsoft Entra ID and granted access for the app to your Azure Monitor workspace, as described in the Query Prometheus metrics using the API and PromQL documentation.
References:
Note: This response is partially based on Microsoft Q&A AI Assist and posted after manually validating the accuracy of the response and making necessary changes as appropriate.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 70%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
marc.caron 5 Reputation points2023-11-01T18:24:36.9766667+00:00 I've been struggling with the same. The below doesn't help if you've already implemented az's federated identity tooling. Which does work against keyvault and the like.
That said, I've put a follow-up on a kiali issue 5926 that is related and linked in 2 other issues that are similar in scope. This may help.
Also, it appears kiali is supposed to be able to pass user oidc token to prometheus if you configure it as the kiali auth mechanism. But there is an issue 4677 for that also. I've not managed to get it working yet.
-
marc.caron 5 Reputation points
2023-11-15T22:43:34.2166667+00:00 I finally found a currently "functional" solution.
It's possible to use aad-auth-proxyhttps://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-authorization-proxy?tabs=query-metrics-example not as good as federated identities but functional.
Be aware that after assigning the roles it can take quite a long time before the permissions will propagate and get you an actual success in the test curl call. When viewing the pod logs you'll get 403s for a bit.
You'll also note there is an issue open on the git project to use workload identity instead of the cluster node pool identity.
This is currently not a good setup. But it does at least function.
Sign in to comment
Sign in to answer