crossplane-azure-insights

packaged by Chainguard

Chainguard Container for crossplane-azure-insights

Crossplane provider for managing Azure Monitor and Application Insights (insights) resources in Kubernetes.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/crossplane-azure-insights:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Chainguard's Crossplane Azure providers are comparable to the upstream Azure providers with the following architectural differences:

• Upstream providers can be deployed independently and automatically resolve their dependencies.
• Chainguard providers require manual installation of the family provider and use skipDependencyResolution: true for component providers to prevent automatic upstream dependency resolution.
• Deployment pattern: install the Chainguard family provider first, then add individual component providers as needed.

This image is built with Go from the upstream provider-upjet-azure project, licensed under the Apache License 2.0. It runs as a non-root user (UID 65532) with the provider entrypoint and manages the 22 Kinds in the insights API group, covering Application Insights resources such as ApplicationInsights, ApplicationInsightsStandardWebTest, and ApplicationInsightsWorkbook, and Azure Monitor resources such as MonitorActionGroup, MonitorMetricAlert, MonitorDataCollectionRule, and MonitorDiagnosticSetting. Each Kind is served in both the cluster-scoped insights.azure.upbound.io group and the namespaced insights.azure.m.upbound.io group.

Upstream sets AZURE_HTTP_USER_AGENT with an architecture and operating system suffix, as in crossplane-provider-upjet-azure/vX.Y.Z (amd64-linux). This image omits that suffix so a single configuration covers both amd64 and arm64. The ARM_PARTNER_ID, ARM_DISABLE_TERRAFORM_PARTNER_ID, and USER_ID values match upstream.

Prerequisites

• A Kubernetes cluster with Crossplane installed.
• An Azure service principal with permission to manage Application Insights and Azure Monitor resources in the target subscription.

Getting Started

Confirm the image runs and reports the flags the provider registers:

docker run --rm cgr.dev/ORGANIZATION/crossplane-azure-insights:latest --help

usage: provider [<flags>] <command> [<args> ...]

Terraform based Crossplane provider for Azure

Install the family provider. This must be installed before any component providers:

cat <<EOF | kubectl apply -f -
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-family-azure
spec:
  package: cgr.dev/ORGANIZATION/crossplane-azure:latest
EOF

Then add the insights component provider with skipDependencyResolution: true:

cat <<EOF | kubectl apply -f -
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-azure-insights
spec:
  package: cgr.dev/ORGANIZATION/crossplane-azure-insights:latest
  skipDependencyResolution: true
EOF

Wait for the provider to become healthy:

kubectl wait provider.pkg provider-azure-insights --for condition=Healthy --timeout=300s

Configuration

After installing the providers, configure Azure credentials with a ProviderConfig. Create a service principal in your Azure tenant and store its credentials in a Kubernetes Secret:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: azure-secret
  namespace: crossplane-system
type: Opaque
stringData:
  creds: |
    {
      "clientId": "${AZURE_CLIENT_ID}",
      "clientSecret": "${AZURE_CLIENT_SECRET}",
      "subscriptionId": "${AZURE_SUBSCRIPTION_ID}",
      "tenantId": "${AZURE_TENANT_ID}"
    }
EOF

Point a ProviderConfig at that Secret:

cat <<EOF | kubectl apply -f -
apiVersion: azure.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: Secret
    secretRef:
      namespace: crossplane-system
      name: azure-secret
      key: creds
EOF

Application Insights components live in a resource group. The family provider ships the ResourceGroup Kind, so create one first, or substitute the name of a group that already exists in your subscription:

cat <<EOF | kubectl apply -f -
apiVersion: azure.upbound.io/v1beta1
kind: ResourceGroup
metadata:
  name: example-rg
spec:
  forProvider:
    location: eastus
EOF

kubectl wait resourcegroups.azure.upbound.io/example-rg --for condition=Ready --timeout=300s

With the ProviderConfig and the resource group in place, create an Application Insights component. Only applicationType and location are required by the CRD's validation rules; the Azure provider supplies the remaining defaults, such as a 100 GB daily data cap and 90-day retention:

cat <<EOF | kubectl apply -f -
apiVersion: insights.azure.upbound.io/v1beta1
kind: ApplicationInsights
metadata:
  name: example-app-insights
spec:
  forProvider:
    applicationType: web
    location: eastus
    resourceGroupNameRef:
      name: example-rg
EOF

Follow the reconcile result on the resource's status conditions:

kubectl get applicationinsights.insights.azure.upbound.io/example-app-insights -o jsonpath='{.status.conditions}'

The container listens on :8080 for Prometheus metrics and :8081 for health and readiness probes, and serves its conversion webhook on :9443 using the certificate pair that Crossplane mounts at /tls/server. Override any of these with --metrics-bind-address, --health-probe-bind-addr, --webhook-port, and --certs-dir, or with the equivalent environment variables shown in --help.

Crossplane's package manager runs the provider from a DeploymentRuntimeConfig. Set container arguments there rather than overriding the image entrypoint.

Upstream Equivalent

Documentation and Resources

• Crossplane Azure Provider Documentation
• Crossplane Getting Started Guide
• Azure Provider Examples

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.