[Question] New unexpected outbound flows to *.monitor.azure.com
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 14
Description
**Describe scenario**
Since the 11th May we've spotted some **new** network traffic from our clusters. It appears that you have deployed a change which now sends https requests to global.handler.control.monitor.azure.com (and region-specific variants of a similar name).
These have been detected by network controls which are presently blocking the requests.
I note that this is a listed egress destination ([documented here](https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#azure-monitor---managed-prometheus-and-container-insights)) but only if you're using Managed Prometheus and Container Insights which doesn't apply in my case.
**Question**
1. For those who are **not** using Managed Prometheus or Container Insights - please can you explain the purpose of these calls?
2. Should these URL's now be included in the more general "[Azure Global required FQDN / application rules](https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#azure-global-required-fqdn--application-rules)" instead?
3. What impact will AKS consumers be causing if the block these requests? (Since they've only started a few days ago, and since they're only conditionally required according to the docs, then I imagine I'm not the only one who don't have these destinations allow-listed)
Contributor guide
Assessment
This issue has not been assessed yet.