Control Plane Query Pack¶
This query pack focuses on Azure Kubernetes Service control-plane evidence. Use it when API requests, admission, audit activity, or autoscaler decisions point to a cluster-management problem instead of a workload-only failure.
Queries¶
| Query | Focus | Tables |
|---|---|---|
| API Server Health and Latency | Request latency, throttling, and response-code errors | AzureDiagnostics, AKSControlPlane |
| Audit Log Analysis | RBAC denies, admission failures, ServiceAccount misuse, namespace activity | AzureDiagnostics, AKSAudit, AKSAuditAdmin |
| Cluster Autoscaler Decisions | Scale-up, scale-down, no-scale reasons, node-pool lag | AzureDiagnostics, AKSControlPlane |
Usage Notes¶
- These queries depend on AKS control-plane resource logs. If no diagnostic setting exists, the queries return no data.
- Prefer resource-specific mode when possible so
AKSControlPlane,AKSAudit, andAKSAuditAdmintables are available alongside the legacyAzureDiagnosticspattern. - Because control-plane log payloads can differ by category and mode, several queries normalize the record into a
RawLogstring first and then extract fields.