{AKS} Fix monitoring consistency and live scenario prerequisites

src/aks-preview/HISTORY.rst

@@ -11,6 +11,7 @@ To release a new version, please select a new version number (usually plus 1 to
 
 Pending
 +++++++
+* `az aks enable-addons`, `az aks disable-addons` and `az aks update`: Keep Container Insights monitoring and container network log settings consistent with the legacy monitoring addon when updating clusters.
 * `az aks machine add`: Add preview `--capacity-reservation-group` support to associate a machine with a Capacity Reservation Group.
 * Add `az aks alert-config` commands to manage AKS-managed alert configurations.
 * `az aks create`: Honor `--enable-osdisk-full-caching` for the default agent pool.

src/aks-preview/azext_aks_preview/custom.py

@@ -4085,6 +4085,19 @@ def _update_addons(cmd,  # pylint: disable=too-many-branches,too-many-statements
                     raise CLIError(f"The addon {addon} is not installed.")
             addon_profiles[addon].config = None
         addon_profiles[addon].enabled = enable
+        if addon == CONST_MONITORING_ADDON_NAME:
+            monitor_profile = getattr(instance, "azure_monitor_profile", None)
+            if getattr(monitor_profile, "container_insights", None) is not None:
+                # Reset canonical monitoring values along with the legacy addon config.
+                ContainerInsights = cmd.get_models(
+                    "ManagedClusterAzureMonitorProfileContainerInsights",
+                    resource_type=CUSTOM_MGMT_AKS_PREVIEW,
+                    operation_group="managed_clusters",
+                )
+                monitor_profile.container_insights = ContainerInsights(
+                    enabled=enable,
+                    log_analytics_workspace_resource_id=workspace_resource_id if enable else None,
+                )
 
     instance.addon_profiles = addon_profiles
 

src/aks-preview/azext_aks_preview/managed_cluster_decorator.py

@@ -6662,6 +6662,11 @@ def update_monitoring_profile_flow_logs(self, mc: ManagedCluster) -> ManagedClus
                     config = monitoring_addon_profile.config or {}
                     config["enableRetinaNetworkFlags"] = str(container_network_logs_enabled)
                     mc.addon_profiles[monitoring_addon_key].config = config
+            container_insights = getattr(mc.azure_monitor_profile, "container_insights", None)
+            if container_insights is not None:
+                container_insights.container_network_logs = (
+                    "Enabled" if container_network_logs_enabled else "Disabled"
+                )
 
         # When enabling CNL, the DCR must be updated to add the high-scale stream.
         # Set the postprocessing intermediate so that the update path calls ensure_container_insights.

src/aks-preview/azext_aks_preview/tests/latest/data/setup_proxy.sh

@@ -1,28 +1,20 @@
 #!/usr/bin/env bash
-set -x
+set -euxo pipefail
 
 echo "setting up"
 WORKDIR="${1:-$(mktemp -d)}"
 echo "setting up ${WORKDIR}"
 
 pushd "$WORKDIR"
 
-apt update -y && apt install -y apt-transport-https curl gnupg make gcc < /dev/null
-
-# add diladele apt key
-wget -qO - https://packages.diladele.com/diladele_pub.asc | apt-key add -
-
-# add new repo
-tee /etc/apt/sources.list.d/squid413-ubuntu20.diladele.com.list <<EOF
-deb https://squid413-ubuntu20.diladele.com/ubuntu/ focal main
-EOF
-
-# and install
-apt-get update && apt-get install -y squid-common squid-openssl squidclient libecap3 libecap3-dev < /dev/null
+apt-get -o Acquire::Retries=3 update
+DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl squid-openssl < /dev/null
 
 mkdir -p /var/lib/squid
 
-/usr/lib/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 4MB || true
+if [ ! -d /var/lib/squid/ssl_db ]; then
+    /usr/lib/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 4MB
+fi
 
 chown -R proxy:proxy /var/lib/squid
 
@@ -129,11 +121,14 @@ update-ca-certificates
 sed -i 's~http_access deny all~http_access allow all~' /etc/squid/squid.conf
 sed -i "s~http_port 3128~http_port $HOST:3128\nhttps_port $HOST:3129 tls-cert=/etc/squid/squidc.pem tls-key=/etc/squid/squidk.pem~" /etc/squid/squid.conf
 
+squid -k parse
 systemctl restart squid
-systemctl status squid
-
-# validation, fails VM creation if commands fail
-curl -fsSl -o /dev/null -w '%{http_code}\n' -x http://${HOST}:3128/ -I http://www.google.com
-curl -fsSl -o /dev/null -w '%{http_code}\n' -x http://${HOST}:3128/ -I https://www.google.com
-curl -fsSl -o /dev/null -w '%{http_code}\n' -x https://${HOST}:3129/ -I http://www.google.com
-curl -fsSl -o /dev/null -w '%{http_code}\n' -x https://${HOST}:3129/ -I https://www.google.com
+systemctl is-active --quiet squid
+
+# Fail cloud-init unless both proxy listeners can reach the required endpoints.
+for proxy in "http://${HOST}:3128/" "https://${HOST}:3129/"; do
+    for endpoint in "http://packages.microsoft.com/" "https://mcr.microsoft.com/v2/"; do
+        curl -fsSL --connect-timeout 10 --max-time 30 --retry 2 --retry-connrefused \
+            -o /dev/null -w '%{http_code}\n' -x "$proxy" "$endpoint"
+    done
+done