AKS Monitoring Addon and Log Analytics Workspace: Configuring Cross‑Subscription Retention Policies

Question

Goal
Enable the Azure Monitor for containers addon on an AKS cluster and route all node, pod, and container logs to a Log Analytics workspace that resides in a different subscription. The objective is to maintain a unified observability view while controlling data retention periods to manage cost and meet compliance requirements.
Constraints and Uncertainty
When the workspace is cross‑subscription, billing is split between the resource group owning the cluster and the subscription holding the workspace. Retention periods are enforced at the workspace level, but it is unclear whether the addon allows per‑namespace or per‑pod retention overrides, and how Fluentd sampling interacts with the configured retention.
Key Questions

Can the monitoring addon be configured to apply different retention periods for logs from distinct namespaces when the Log Analytics workspace is in another subscription?
How does the retention policy affect the billing model and the ability to export logs for forensic or compliance purposes?
What Fluentd sampling or filtering settings can be tuned to keep critical logs while staying within the ingestion quota imposed by the workspace?

Tasadduq Burney · Answer

Answer
The AKS monitoring addon cannot apply different retention periods per namespace; retention is a workspace‑wide setting.
Steps to enable cross‑subscription logging

Identify the AKS cluster’s managed identity (system‑assigned or user‑assigned).
Grant that identity the Log Analytics Contributor role on the target workspace in the other subscription.
Enable the monitoring addon, supplying the full resource ID of the remote workspace.

az aks update -g  -n  --enable-addons monitoring --log-analytics-workspace-resource-id /subscriptions//resourceGroups//providers/Microsoft.OperationalInsights/workspaces/
Retention, billing and compliance

Retention is set on the Log Analytics workspace (retentionTime property) and applies to all ingested data, regardless of source subscription or namespace.
Storage costs are billed to the subscription that holds the workspace.
For per‑namespace retention you need separate workspaces; otherwise use data export rules to archive specific logs to cheaper storage.

Controlling ingestion volume (Fluent Bit)

Create a ConfigMap that filters out unwanted namespaces, labels or log levels before forwarding to the agent.
Adjust metric collection intervals (e.g., from 15 s to 60 s) to reduce quota usage.

Verification
Check the workspace retention:
az monitor log-analytics workspace show -g  -n  --query retentionTime

AKS Monitoring Addon and Log Analytics Workspace: Configuring Cross‑Subscription Retention Policies

Goal

Constraints and Uncertainty

Key Questions

1 answer

Answer

Steps to enable cross‑subscription logging

Retention, billing and compliance

Controlling ingestion volume (Fluent Bit)

Verification

Your perspective belongs here.

0 question comments