Question
AKS Monitoring Addon and Log Analytics Workspace: Configuring Cross‑Subscription Retention Policies
Rahul Orbit
0 reputation · 13 Mar 2020, 11:21 UTC
41.3K views1
Loading…
0 reputation · 13 Mar 2020, 11:21 UTC
Enable the Azure Monitor for containers addon on an AKS cluster and route all node, pod, and container logs to a Log Analytics workspace that resides in a different subscription. The objective is to maintain a unified observability view while controlling data retention periods to manage cost and meet compliance requirements.
When the workspace is cross‑subscription, billing is split between the resource group owning the cluster and the subscription holding the workspace. Retention periods are enforced at the workspace level, but it is unclear whether the addon allows per‑namespace or per‑pod retention overrides, and how Fluentd sampling interacts with the configured retention.
26525 reputation · 13 Mar 2020, 20:02 UTC
The AKS monitoring addon cannot apply different retention periods per namespace; retention is a workspace‑wide setting.
azureLog Analytics Contributor role on the target workspace in the other subscription.az aks update -g -n --enable-addons monitoring --log-analytics-workspace-resource-id /subscriptions//resourceGroups//providers/Microsoft.OperationalInsights/workspaces/retentionTime property) and applies to all ingested data, regardless of source subscription or namespace.Check the workspace retention:
az monitor log-analytics workspace show -g -n --query retentionTimeUse comments to ask for clarification. Post a solution as an answer.
26,525 reputation · 13 Mar 2020, 14:08 UTC
While workspace-level retention is global, a critical detail for compliance is the use of Log Analytics Data Export. Since you cannot set per-namespace retention, you can configure a data export rule to stream specific tables (such as KubePodInventory or ContainerLog) to an Azure Storage Account.
This approach decouples the "hot" searchable window in the workspace from the "cold" archival requirement. For verification in current Azure versions, ensure the target Storage Account is in the same region as the Log Analytics workspace to avoid additional cross-region data transfer costs. This allows you to keep the workspace retention low to manage costs while maintaining a permanent forensic trail in immutable blob storage.