[AKS] az aks create/update: Onboard Container Insights via azureMonitorProfile and deprecate the monitoring addon

[ChFlick]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-preview

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	aks create	cmd aks create added parameter disable_prometheus_metrics_scraping
⚠️ 1006 - ParaAdd	aks create	cmd aks create added parameter enable_prometheus_metrics_scraping
⚠️ 1006 - ParaAdd	aks create	cmd aks create added parameter syslog_port
⚠️ 1009 - ParaPropRemove	aks create	cmd aks create update parameter enable_msi_auth_for_monitoring: removed property default=True
⚠️ 1009 - ParaPropRemove	aks enable-addons	cmd aks enable-addons update parameter enable_msi_auth_for_monitoring: removed property default=True
⚠️ 1006 - ParaAdd	aks update	cmd aks update added parameter disable_prometheus_metrics_scraping
⚠️ 1006 - ParaAdd	aks update	cmd aks update added parameter enable_prometheus_metrics_scraping
⚠️ 1006 - ParaAdd	aks update	cmd aks update added parameter syslog_port

Summary

Container Insights onboarding still went through the legacy omsagent addon profile, even when
using --enable-azure-monitor-logs. This switches that flag over to
azureMonitorProfile.containerInsights, adds controls that only exist on that profile, and starts
deprecating the addon path. az aks enable-addons -a monitoring keeps working as before.

What changed

• --enable-azure-monitor-logs / --disable-azure-monitor-logs now read and write
  azureMonitorProfile.containerInsights. The CLI no longer authors an omsagent addon entry.
• --enable/--disable-container-network-logs set containerInsights.containerNetworkLogs
  instead of the enableRetinaNetworkFlags addon config key.
• DCR / DCE / DCRA / AMPLS provisioning no longer requires the addon object. --enable-syslog,
  --data-collection-settings, --enable-high-log-scale-mode, --ampls-resource-id and
  --workspace-resource-id behave as before.
• New: --syslog-port, --enable-prometheus-metrics-scraping / --disable-prometheus-metrics-scraping.
• --enable-msi-auth-for-monitoring is rejected with --enable-azure-monitor-logs (that path is
  managed-identity only), and now prints a deprecation warning on enable-addons -a monitoring.
• Using the monitoring addon prints a notice pointing at --enable-azure-monitor-logs.

Testing

Tested end to end on live clusters:

• Enable/disable on create and update, explicit and default workspace, repeat runs, and updating a
  cluster originally onboarded via the addon.
• Confirmed the request body only contains azureMonitorProfile.containerInsights and an empty
  addonProfiles, and that the agent deploys and logs reach the workspace.
• Compared the generated DCR against one from enable-addons -a monitoring: same streams,
  destinations and settings. DCRA created on both, removed on disable.
• Syslog DCR source, data collection settings, high log scale mode, workspace change,
  container network logs, --syslog-port (verified on the agent) and the scraping toggles.
• Error and warning cases for the flag combinations above.

---

Related command

az aks create / az aks update (--enable/disable-azure-monitor-logs,
--syslog-port, --enable/disable-prometheus-metrics-scraping,
--enable/disable-container-network-logs),
az aks enable-addons -a monitoring

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[a0x1ab]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[a0x1ab]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).