LOG-7261: Implement AzureLogIngestion output in CLO by Clee2691 · Pull Request #3223 · openshift/cluster-logging-operator

Clee2691 · 2026-03-12T16:29:45Z

Description

This PR adds a new azureLogsIngestion output type that sends logs to Azure Monitor via the Logs Ingestion API.
The AzureMonitor output is deprecated and will be removed in a future release. Microsoft will retire the Data Collecter API in September 2026.

What's new:

Output type AzureLogsIngestion with required DCR immutable ID, stream name, and URL, plus optional token scope, timestamp field, and tuning
Two auth modes: clientSecret - long lived credentials and workloadIdentity - short lived tokens
Functional tests using a Mockoon mock server (mocks both the OAuth2 token endpoint and the DCR ingestion
endpoint over TLS)
Refactored Azure test helpers into a shared test/helpers/azure/ package used by both azureMonitor and
azureLogsIngestion
Add deprecation API comment to AzureMonitor output

/cc @cahartma @vparfonov
/assign @jcantrill

Links

Clee2691 · 2026-03-12T16:31:24Z

/test all

openshift-ci-robot · 2026-03-12T16:50:51Z

@Clee2691: This pull request references LOG-7261 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.8.0" version, but no target version was set.

Details

In response to this:

Description

This PR adds a new azureLogsIngestion output type that sends logs to Azure Monitor via the Logs Ingestion API.
The AzureMonitor output is deprecated and will be removed in a future release. Microsoft will retire the Data Collecter API in September 2026.

What's new:

Output type AzureLogsIngestion with required DCR immutable ID, stream name, and URL, plus optional token scope, timestamp field, and tuning

Two auth modes: clientSecret - long lived credentials and workloadIdentity - short lived tokens

Functional tests using a Mockoon mock server (mocks both the OAuth2 token endpoint and the DCR ingestion
endpoint over TLS)

Refactored Azure test helpers into a shared test/helpers/azure/ package used by both azureMonitor and
azureLogsIngestion

Add deprecation API comment to AzureMonitor output

/cc @cahartma @vparfonov
/assign @jcantrill

Links

JIRA: https://issues.redhat.com/browse/LOG-7261

Enhancement proposal: https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/workload-identity-auth-for-azure-monitor-logs.md

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-03-12T16:51:11Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

jcantrill · 2026-03-20T17:28:53Z

docs/features/logforwarding/outputs/azure-logs-ingestion-forwarding.adoc

+        minRetryDuration: 20s
+----
+
+==== Field Reference


Do we have any concerns this may get out of sync? Should we exclude it in favor of our reference doc?

What do you mean by reference doc? The API docs?

I think we should keep this as there is some background on the different API's (data collector, logs ingestion). This can be used to expand your below comment.

jcantrill · 2026-03-20T17:29:44Z

api/observability/v1/output_types.go

+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Azure Log Ingestion"
+	AzureLogsIngestion *AzureLogsIngestion `json:"azureLogsIngestion,omitempty"`
+
+	// DEPRECATED: Use AzureLogsIngestion instead. This output will be removed in a future release.


should we further expand that MS is dropping support Sept. 2026?

I think this is a good general statement and the doc created can shed more light into the change.

I also do think that someone who is forwarding to Azure now will (should) know about the removal of the data collector API as when they go to set it up, there are many warnings about it in their docs

jcantrill · 2026-03-20T17:35:48Z

internal/generator/vector/api/sinks/azure_logs_ingestion.go

+
+	Auth *AzureLogsIngestionAuth `json:"auth,omitempty" yaml:"auth,omitempty" toml:"auth,omitempty"`
+
+	Acknowledgements *Acknowledgements `json:"acknowledgements,omitempty" yaml:"acknowledgements,omitempty" toml:"acknowledgements,omitempty"`


Can these be replaced by "BaseSink"?

I was looking to see if I could BUT this sink does NOT support compression.

jcantrill · 2026-03-20T17:45:24Z

internal/generator/vector/api/sinks/azure_logs_ingestion.go

+	Batch            *Batch            `json:"batch,omitempty" yaml:"batch,omitempty" toml:"batch,omitempty"`
+	Buffer           *Buffer           `json:"buffer,omitempty" yaml:"buffer,omitempty" toml:"buffer,omitempty"`
+	Request          *Request          `json:"request,omitempty" yaml:"request,omitempty" toml:"request,omitempty"`
+	TLS              *transport.TLS    `json:"tls,omitempty" yaml:"tls,omitempty" toml:"tls,omitempty"`


Do we know if the vector TLS config for azure supports the cipher and other profile change? Is it the same config as the other sinks?

Yes this is similar to other sinks and is valid.

See:https://vector.dev/docs/reference/configuration/sinks/azure_logs_ingestion/#tls

jcantrill · 2026-03-20T17:46:16Z

internal/generator/vector/output/azure/azurelogsingestion/azurelogsingestion.go

+	vectorhelpers "github.com/openshift/cluster-logging-operator/internal/generator/vector/helpers"
+)
+
+type AzureLogsIngestion struct {


shouldnt need this at all with the new api changes

jcantrill · 2026-03-20T17:47:41Z

internal/generator/vector/output/azure/azurelogsingestion/azurelogsingestion.go

+}
+
+const (
+	AzureCredentialKindWorkloadIdentity = "workload_identity"


does this need to be public?

jcantrill · 2026-03-20T17:55:51Z

/hold
/approve

openshift-ci · 2026-03-20T17:58:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Clee2691, jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-03-20T19:46:53Z

@Clee2691: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/functional-target	`b69a8e3`	link	true	`/test functional-target`
ci/prow/e2e-target	`b69a8e3`	link	true	`/test e2e-target`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 12, 2026

openshift-ci bot assigned jcantrill Mar 12, 2026

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 12, 2026

openshift-ci bot requested review from cahartma and vparfonov March 12, 2026 16:51

jcantrill added the release/6.6 label Mar 12, 2026

Clee2691 force-pushed the LOG-7261 branch from fca5c9b to 5cd9f6b Compare March 20, 2026 15:38

Clee2691 marked this pull request as ready for review March 20, 2026 15:39

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 20, 2026

jcantrill reviewed Mar 20, 2026

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 20, 2026

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 20, 2026

LOG-7261: Implement AzureLogIngestion output in CLO

b69a8e3

Clee2691 force-pushed the LOG-7261 branch from 5cd9f6b to b69a8e3 Compare March 20, 2026 18:26


		Auth *AzureLogsIngestionAuth `json:"auth,omitempty" yaml:"auth,omitempty" toml:"auth,omitempty"`

		Acknowledgements *Acknowledgements `json:"acknowledgements,omitempty" yaml:"acknowledgements,omitempty" toml:"acknowledgements,omitempty"`

Conversation

Clee2691 commented Mar 12, 2026

Description

Links

Uh oh!

Clee2691 commented Mar 12, 2026

Uh oh!

openshift-ci-robot commented Mar 12, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Links

Uh oh!

openshift-ci bot commented Mar 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcantrill commented Mar 20, 2026

Uh oh!

openshift-ci bot commented Mar 20, 2026

Uh oh!

openshift-ci bot commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openshift-ci-robot commented Mar 12, 2026 •

edited by openshift-ci bot

Loading