Skip to content

feat(azure_metrics): add resource_manager_audience for sovereign cloud (GovCloud) support#20266

Open
zmoog wants to merge 3 commits into
mainfrom
fix/azure-metrics-govcloud-resource-manager-audience
Open

feat(azure_metrics): add resource_manager_audience for sovereign cloud (GovCloud) support#20266
zmoog wants to merge 3 commits into
mainfrom
fix/azure-metrics-govcloud-resource-manager-audience

Conversation

@zmoog

@zmoog zmoog commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds the missing resource_manager_audience configuration field to all eight azure_metrics data streams (monitor, compute_vm, compute_vm_scaleset, container_instance, container_registry, container_service, database_account, storage_account)
  • Updates docs/README.md with field description and sovereign-cloud audience values
  • Bumps package version to 1.15.0

Problem

Azure sovereign clouds (e.g. GovCloud) require three settings to be redirected correctly:

Setting GovCloud value
resource_manager_endpoint https://management.usgovcloudapi.net/
active_directory_endpoint https://login.microsoftonline.us
resource_manager_audience https://management.core.usgovcloudapi.net

azure_metrics exposed only the first two. Without resource_manager_audience, the Beats Azure Monitor client requests an OAuth2 token scoped for the public cloud audience (https://management.core.windows.net/) even when the other endpoints are set to GovCloud values. ARM then rejects the token with:

RESPONSE 404: 404 Not Found
ERROR CODE: SubscriptionNotFound

azure_billing already exposes all three settings correctly. This PR brings azure_metrics to parity.

Test plan

  • Deploy azure_metrics integration with GovCloud endpoints and resource_manager_audience: https://management.core.usgovcloudapi.net — verify metrics are collected without SubscriptionNotFound errors
  • Deploy without resource_manager_audience set — verify existing public-cloud behaviour is unchanged
  • Confirm the field appears (hidden by default, show_user: false) in the Kibana integration UI advanced settings

🤖 Generated with Claude Code

…d support

Add the missing `resource_manager_audience` configuration option to all
azure_metrics data streams (monitor, compute_vm, compute_vm_scaleset,
container_instance, container_registry, container_service, database_account,
storage_account).

Without this field, users targeting sovereign clouds (e.g. GovCloud) cannot
override the OAuth2 token audience. Even with resource_manager_endpoint and
active_directory_endpoint correctly set to GovCloud values, ARM rejects the
request with SubscriptionNotFound because the token is scoped for the public
cloud audience (management.core.windows.net).

The fix mirrors azure_billing, which already exposes all three settings.

Fixes: elastic/sdh-beats#7390

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@zmoog
zmoog requested a review from a team as a code owner July 21, 2026 20:32
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Package docs validation failed. Please check the workflow run for details.

For support, reach out in the #docs Slack channel.

cc @elastic/integration-docs

@github-actions

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

zmoog and others added 2 commits July 21, 2026 22:37
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add resource_manager_audience to the _dev/build/docs/README.md template
and regenerate docs/README.md with elastic-package build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions

This comment has been minimized.

@github-actions

Copy link
Copy Markdown
Contributor

TL;DR

The azure_metrics check failed because the generated docs/README.md was stale at commit 6c2ed327bcb70c68d424efd4251a025b3a4caccc. The Buildkite log reports that the existing README contained the new Resource Manager Audience section, while the generated output omitted it. This is a documentation-generation mismatch, not a runtime or test failure.

Remediation

  • Rerun the Buildkite check against the current PR head ed9d73228eafddc14d33433fb57f501ee9590eda; that commit adds the field to packages/azure_metrics/_dev/build/docs/README.md and regenerates packages/azure_metrics/docs/README.md.
  • If the check is rerun at the older commit, run elastic-package build for packages/azure_metrics and commit the generated README changes.
Investigation details

Root Cause

At the failed SHA, the README template at packages/azure_metrics/_dev/build/docs/README.md did not contain the newly added Resource Manager Audience section, while the checked-in generated README did. The package consistency check therefore rejected the generated output. The PR’s latest commit, ed9d73228eafddc14d33433fb57f501ee9590eda, explicitly fixes this by updating the template and regenerating the docs.

Evidence

  • Build: https://buildkite.com/elastic/integrations/builds/46400
  • Job/step: Check integrations azure_metrics
  • Key log excerpt: README.md is outdated. Rebuild the package with 'elastic-package build'; the diff shows the Resource Manager Audience section present in want and absent from got.
  • Failed commit: 6c2ed327bcb70c68d424efd4251a025b3a4caccc

Verification

No local package test was run because the workspace is on main, not the PR revision. The PR history confirms the generated-doc fix was added after the failed build.


What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

History

@andrewkroh andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:azure_metrics Azure Resource Metrics Team:obs-ds-hosted-services Observability Hosted Services team [elastic/obs-ds-hosted-services] labels Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:azure_metrics Azure Resource Metrics Team:obs-ds-hosted-services Observability Hosted Services team [elastic/obs-ds-hosted-services]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants