Skip to content

Migrate AI Gateway monitoring to native OTLP/OpenTelemetry exporter - #11

Closed
Paul Yuknewicz (paulyuk) with Copilot wants to merge 7 commits into
mainfrom
copilot/update-ai-gateway-monitoring
Closed

Paul Yuknewicz (paulyuk) with Copilot wants to merge 7 commits into
mainfrom
copilot/update-ai-gateway-monitoring

Conversation

Copilot AI commented Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

The AI Gateway currently provisions a legacy applicationInsights-kind telemetry exporter, which the portal's monitoring experience no longer reliably recognizes. It expects the native OTLP/OpenTelemetry exporter contract instead, backed by a workspace-based Application Insights resource with managed DCR/DCE endpoints.

Bicep (infra/ai-gateway/main.bicep, infra/main.bicep)

  • Enable AzureMonitorWorkspaceIngestionMode: Enabled on the Application Insights resource so it generates managed DCR/DCE and OTLP ingestion endpoints.
  • Remove the inline legacy exporter resource — OTLP endpoints/DCR are created asynchronously by Azure Monitor after Application Insights deployment, so they can't be read back within the same ARM deployment.
  • Surface new outputs (AI_GATEWAY_APPLICATION_INSIGHTS_ID, AI_GATEWAY_PRINCIPAL_ID, AI_GATEWAY_TELEMETRY_EXPORTER_NAME) for the postprovision hook to consume.

Provisioning hooks (infra/scripts/configure-ai-gateway.sh / .ps1)

  • Preprovision: register the Microsoft.Monitor resource provider; delete any pre-existing legacy exporter (exporter kind is immutable, so migrating an existing sample requires delete/recreate rather than update).
  • Postprovision: poll Application Insights until it exposes OTLP metrics/logs/traces endpoints and a DCR id, then PUT an OpenTelemetry-kind exporter configured with managed-identity authentication (audience https://monitor.azure.com).
  • Assign the Monitoring Metrics Publisher role (3913510d-42f4-4e42-8a64-420c390055eb) to the AI Gateway's system-assigned identity directly at the DCR scope via az role assignment create, rather than as a nested Bicep role assignment — the generated managed resource group carries a deny assignment that blocks nested ARM/Bicep writes, but a direct out-of-band call succeeds.

Docs (IMPLEMENTATION_NOTES.md)

  • Document the new OTLP-based flow, why the role assignment happens outside Bicep, and that exporter kind is immutable when migrating existing deployments.

Copilot AI and others added 6 commits September 16, 2026 07:36
Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
…setup

Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
… constants

Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
Co-authored-by: paulyuk <1968137+paulyuk@users.noreply.github.com>
Copilot AI changed the title [WIP] Update AI Gateway monitoring to use current OpenTelemetry configuration Migrate AI Gateway monitoring to native OTLP/OpenTelemetry exporter Sep 16, 2026
@paulyuk

Copy link
Copy Markdown
Member

Closing stale draft written against the legacy Microsoft.ApiManagement/service/gateways resource. Issue #9 will be re-assigned to @copilot on top of the new Microsoft.ApiManagement/aigateways Bicep structure from #23.

@paulyuk
Paul Yuknewicz (paulyuk) deleted the copilot/update-ai-gateway-monitoring branch October 25, 2026 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update AI Gateway monitoring to use the current OpenTelemetry configuration

2 participants