Skip to content

Add AKS as a supported k8sMode #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
movence merged 2 commits into from
Jul 10, 2026
Merged

Add AKS as a supported k8sMode #333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0199331
Add AKS as a supported k8sMode
movence Jul 9, 2026
9b7a106
Require roleArn in fluent-bit template on AKS
movence Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions charts/amazon-cloudwatch-observability/templates/linux/cloudwatch-agent-custom-resource.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@ data:
{{- $clusterName := .Values.clusterName | required ".Values.clusterName is required." -}}
{{- $region := .Values.region | required ".Values.region is required." -}}
{{- $isROSA := eq $.Values.k8sMode "ROSA" -}}
{{- $isAKS := eq $.Values.k8sMode "AKS" -}}
{{- if $isAKS }}{{- $_ := $.Values.roleArn | required ".Values.roleArn is required when k8sMode is AKS." -}}{{- end }}
{{- range .Values.agents }}
{{- $agent := mergeOverwrite (deepCopy $.Values.agent) . }}
{{/* Skip cluster-scraper agent when otelContainerInsights is disabled */}}
Expand Down Expand Up @@ -185,6 +187,11 @@ spec:
name: kubelet-ca
readOnly: true
{{ end }}
{{ if $isAKS }}
- mountPath: /var/run/secrets/aws
name: aws-iam-token
readOnly: true
{{ end }}
volumes:
- name: kubelet-podresources
hostPath:
Expand Down Expand Up @@ -255,6 +262,15 @@ spec:
hostPath:
path: /etc/kubernetes/kubelet-ca.crt
{{end }}
{{ if $isAKS }}
- name: aws-iam-token
projected:
sources:
- serviceAccountToken:
audience: sts.amazonaws.com
expirationSeconds: 3600
path: token
{{ end }}
env:
- name: K8S_NODE_NAME
valueFrom:
Expand All @@ -276,6 +292,14 @@ spec:
- name: RUN_IN_ROSA
value: "True"
{{ end }}
{{ if $isAKS }}
- name: RUN_IN_AKS
value: "True"
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: /var/run/secrets/aws/token
- name: AWS_ROLE_ARN
value: {{ $.Values.roleArn | quote }}
{{ end }}
- name: K8S_CLUSTER_NAME
value: {{ $.Values.clusterName | quote }}
{{- if $.Values.otelContainerInsights.enabled }}
Expand Down
22 changes: 22 additions & 0 deletions charts/amazon-cloudwatch-observability/templates/linux/fluent-bit-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
{{- if .Values.containerLogs.enabled }}
{{- $clusterName := .Values.clusterName | required ".Values.clusterName is required." -}}
{{- $region := .Values.region | required ".Values.region is required." -}}
{{- $isAKS := eq .Values.k8sMode "AKS" -}}

@mitali-salvi mitali-salvi Jul 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing validation for missing Role ARN similar to the CWA template

{{- $isAKS := eq $.Values.k8sMode "AKS" -}}
{{- if $isAKS }}{{- $_ := $.Values.roleArn | required ".Values.roleArn is required when k8sMode is AKS." -}}{{- end }}

Helm should render the CWA template before the fluent-bit one but helps to keep validations consistent across YAMLs

{{- if $isAKS }}{{- $_ := .Values.roleArn | required ".Values.roleArn is required when k8sMode is AKS." -}}{{- end }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
Expand Down Expand Up @@ -54,6 +56,12 @@ spec:
fieldPath: metadata.name
- name: CI_VERSION
value: "k8s/1.3.17"
{{- if $isAKS }}
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: /var/run/secrets/aws/token
- name: AWS_ROLE_ARN
value: {{ .Values.roleArn | quote }}
{{- end }}
{{- with .Values.containerLogs.fluentBit.resources }}
resources: {{- toYaml . | nindent 10}}
{{- end }}
Expand Down Expand Up @@ -85,6 +93,11 @@ spec:
- mountPath: /etc/amazon-cloudwatch-observability-agent-server-cert
name: agentservertls
readOnly: true
{{- if $isAKS }}
- mountPath: /var/run/secrets/aws
name: aws-iam-token
readOnly: true
{{- end }}
terminationGracePeriodSeconds: 10
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
Expand Down Expand Up @@ -122,6 +135,15 @@ spec:
items:
- key: ca.crt
path: tls-ca.crt
{{- if $isAKS }}
- name: aws-iam-token
projected:
sources:
- serviceAccountToken:
audience: sts.amazonaws.com
expirationSeconds: 3600
path: token
{{- end }}
serviceAccountName: {{ template "cloudwatch-agent.serviceAccountName" . }}
{{- with .Values.containerLogs.fluentBit.affinity }}
affinity: {{- toYaml . | nindent 8 }}
Expand Down
4 changes: 3 additions & 1 deletion charts/amazon-cloudwatch-observability/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,9 @@ adcEndpointOverrides:
eusc-de-east-1: amazonaws.eu
## Provide the Region (this is a required parameter)
region:
k8sMode: EKS # can be EKS | ROSA | K8S
k8sMode: EKS # can be EKS | ROSA | K8S | AKS
## IAM role ARN for AKS workload-identity federation (required when k8sMode is AKS)
roleArn:
## Enable dualstack endpoints for IPv6 support (default: false)
useDualstackEndpoint: false
## Provide default tolerations
Expand Down
Loading