Azure / Azure/AKS

[Question] New unexpected outbound flows to *.monitor.azure.com

Open
#5,022 3 comments 0 reactions 1 assignee Claimed by @vishiy View on GitHub
action-required question
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
4d 15h
Merged PRs (30d)
14

Description

**Describe scenario**
Since the 11th May we've spotted some **new** network traffic from our clusters. It appears that you have deployed a change which now sends https requests to global.handler.control.monitor.azure.com (and region-specific variants of a similar name).

These have been detected by network controls which are presently blocking the requests.

I note that this is a listed egress destination ([documented here](https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#azure-monitor---managed-prometheus-and-container-insights)) but only if you're using Managed Prometheus and Container Insights which doesn't apply in my case.

**Question**
1. For those who are **not** using Managed Prometheus or Container Insights - please can you explain the purpose of these calls?

2. Should these URL's now be included in the more general "[Azure Global required FQDN / application rules](https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#azure-global-required-fqdn--application-rules)" instead?

3. What impact will AKS consumers be causing if the block these requests? (Since they've only started a few days ago, and since they're only conditionally required according to the docs, then I imagine I'm not the only one who don't have these destinations allow-listed)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.