search

Azure / AKS

Azure Kubernetes Service
https://azure.github.io/AKS/
1.97k stars 310 forks source link

Permissions issue with log Analytics Workspace During Istio Upgrade #4654

Open ngemi-bread opened 1 week ago

ngemi-bread commented 1 week ago

We encountered a permissions issue during an Istio upgrade on a cluster connected to a Log Analytics Workspace. The issue occurred when a user without sufficient access right attempted the upgrade. Despite not actively trying to modify or interact with the workspace, it seems the upgrade process requires access to the workspace.

This behavior was unexpected, as we didn't anticipate that the workspace permissions would impact the Istio upgrade process.

Additional Context The Log Analytic Workspace is a shared enterprise resource and reside in a separate resource group from the AKS cluster. This separation likely contributed to the permission issue, as the workspace has different access control from those in the AKS resource group.

Missing Permission The missing permission was Microsoft.OperationalInsights/workspace/write, and the scope was the Log Analytics Workspace.

Steps to Reproduce

  1. Initiate the AKS mesh upgrade to the desire ASM version: az aks mesh upgrade start --resource-group --name --revision asm-1-22
  2. Note: Ensure your cluster has container insight enable
microsoft-github-policy-service[bot] commented 1 week ago

@azure/aks-traffic would you be able to assist?

microsoft-github-policy-service[bot] commented 1 week ago

@kaarthis, @sdesai345 would you be able to assist?

nshankar13 commented 1 week ago

@ngemi-bread what is the exact error you are seeing?

Also, is this happening only for Istio upgrade commands - i.e are other cluster / addon update commands succeeding?