Mimetis
commented
2 years ago Here are the checks I would do to investigate this issue (following the docs http://docs.promitor.io/walkthrough/use-promitor-with-managed-identity)
Be sure you have installed your AKS cluster using the managed identity option. Query the identity from the cluster:
echo "Retrieving cluster identity ID"
export aks_mi_identity="$(az aks show -g ${RG_NAME} -n ${CLUSTER_NAME} --query identityProfile.kubeletidentity.clientId -otsv)"If I remember well, you may have the managed identity item also in the AKS resource group (called MC_....)
If you have created another managed identity (to respect the separation of concerns), be sure this identity has the "Monitor Reader" role assigned on your subscription / resource group
az role assignment list --assignee $AD_POD_IDENTITY_CLIENT_ID -g $RG_NAME | jq -r '.[].roleDefinitionName'If you are using the system assigned identity, you can make the same check
From your cluster, check that your AAD Pod identity is correctly configured
kubectl get azureidentity
kubectl get azureidentitybindingIf you have correctly bind the AAD Pod Identity to your Managed Identity (System assigne or User Assigned) you should be able to use it. As an example, you can spin up a Azure CLI using this identity:
kubectl run azure-cli -it --image=mcr.microsoft.com/azure-cli --labels=aadpodidbinding=$AD_POD_IDENTITY_NAME /bin/bash
az login -i --debugIf you CLI is launching correctly that means your AAD pod Identity is configured correctly and ready to use.
Once you are sure everything is correctly configured on your AKS cluster, you can configure Promitor
azureAuthentication:
mode: SystemAssignedManagedIdentity
identity:
binding: <aad-pod-identity-name> 
anoop2503
tomkerkhove
Discussed in https://github.com/tomkerkhove/promitor/discussions/2011