cockroachdb · github-actions · Jul 9, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add `AZURE_LOG_ANALYTICS_V2` log export type for exporting to Azure Monitor via the Logs Ingestion API and DCR-based ingestion.
+- Add Azure V2 log export configuration fields: `AzureClientId`, `AzureClientSecret`, `AzureTenantId`, `AzureDceEndpoint`, `AzureDcrImmutableId`, `AzureDcrResourceId`, and `AzureWorkspaceResourceId`.
+- Add `UPDATE_BACKUP_CONFIGURATION` audit log action.
+- Add `CLUSTER_DEVELOPER` role to private endpoint and egress private endpoint read operations.
+
+### Changed
+
+- Breaking Change: `AuthPrincipal` is no longer required on `EnableLogExportBody`; it is now optional to support the new `AZURE_LOG_ANALYTICS_V2` type which does not use it.
+
+### Deprecated
+
+- Deprecate `AZURE_LOG_ANALYTICS` log export type in favor of `AZURE_LOG_ANALYTICS_V2` (retiring 2026-09-14).
+- Deprecate `AzureSharedKey` field on log export models in favor of `AzureClientSecret`.
+
 ### Fixed
 
 - Fix the OpenAPI sync workflow's changelog generation step, which failed on large

diff --git a/README.md b/README.md
@@ -212,3 +212,4 @@ API | Method | HTTP request | Description
 
 ## Author
 support@cockroachlabs.com
+
diff --git a/docs/AuditLogAction.md b/docs/AuditLogAction.md
@@ -212,6 +212,8 @@
 
 * `DELETE_MIGRATION_ASSISTANT` (value: `"AUDIT_LOG_ACTION_DELETE_MIGRATION_ASSISTANT"`)
 
+* `UPDATE_BACKUP_CONFIGURATION` (value: `"AUDIT_LOG_ACTION_UPDATE_BACKUP_CONFIGURATION"`)
+
 
 [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
 

diff --git a/docs/EgressPrivateEndpointsApi.md b/docs/EgressPrivateEndpointsApi.md
@@ -165,6 +165,7 @@ Get egress private endpoint
 Can be used by the following roles assigned at the organization, folder or cluster scope:
 - CLUSTER_ADMIN
 - CLUSTER_OPERATOR_WRITER
+- CLUSTER_DEVELOPER
 
 
 ### Example
@@ -237,6 +238,7 @@ List egress private endpoints
 Can be used by the following roles assigned at the organization, folder or cluster scope:
 - CLUSTER_ADMIN
 - CLUSTER_OPERATOR_WRITER
+- CLUSTER_DEVELOPER
 
 
 ### Example

diff --git a/docs/EnableLogExportBody.md b/docs/EnableLogExportBody.md
@@ -4,9 +4,16 @@
 
 Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
-**AuthPrincipal** | **string** |  | 
+**AuthPrincipal** | Pointer to **string** | auth_principal is used in different contexts based on integration. CloudWatch: AWS Role ARN that identifies a role that the cluster account can assume to write to CloudWatch GCP Cloud Logging: GCP Project ID that the cluster service account has permissions to write to for cloud logging. Azure Log Analytics (AZURE_LOG_ANALYTICS): CustomerID or WorkspaceID. Required for AWS_CLOUDWATCH, GCP_CLOUD_LOGGING, and AZURE_LOG_ANALYTICS. Not used for AZURE_LOG_ANALYTICS_V2. | [optional] 
 **AwsExternalId** | Pointer to **string** | aws_external_id to include when assuming the IAM role specified by role_arn. Optional. A specific value may be required by the role&#39;s trust policy. Only supported for Advanced clusters on AWS. If provided for a Standard cluster, the request is rejected. | [optional] 
-**AzureSharedKey** | Pointer to **string** | The primary or the secondary connected sources client authentication key. This is used to export logs to Azure Log Analytics. | [optional] 
+**AzureClientId** | Pointer to **string** | Azure client ID for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureClientSecret** | Pointer to **string** | Azure client secret for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureDceEndpoint** | Pointer to **string** | Logs ingestion endpoint of the Azure Data Collection Endpoint (DCE). For example, https://{dce-name}.{region}.ingest.monitor.azure.com. | [optional] 
+**AzureDcrImmutableId** | Pointer to **string** | Immutable ID of the Azure Data Collection Rule (DCR), for example dcr-... | [optional] 
+**AzureDcrResourceId** | Pointer to **string** | Full ARM resource ID of the Azure Data Collection Rule (DCR). Cockroach Cloud reads and updates this DCR to add streams for each configured log group. For example, /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Insights/dataCollectionRules/{dcr-name}. | [optional] 
+**AzureSharedKey** | Pointer to **string** | The primary or the secondary connected sources client authentication key. This is used to export logs to Azure Log Analytics via the legacy HTTP Data Collector API. Deprecated: use azure_client_secret instead. | [optional] 
+**AzureTenantId** | Pointer to **string** | Azure tenant ID for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureWorkspaceResourceId** | Pointer to **string** | Full ARM resource ID of the Log Analytics workspace. Cockroach Cloud creates or updates the required custom tables for each configured log group. For example, /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.OperationalInsights/workspaces/{workspace-name}. | [optional] 
 **Groups** | Pointer to [**[]LogExportGroup**](LogExportGroup.md) | groups is a collection of log group configurations that allows the customer to define collections of CRDB log channels that are aggregated separately at the target sink. | [optional] 
 **LogName** | **string** | log_name is an identifier for the logs in the customer&#39;s log sink. | 
 **OmittedChannels** | Pointer to **[]string** | omitted_channels is a list of channels that the user does not want to export logs for. | [optional] 
@@ -18,7 +25,7 @@ Name | Type | Description | Notes
 
 ### NewEnableLogExportBody
 
-`func NewEnableLogExportBody(authPrincipal string, logName string, type_ LogExportType, ) *EnableLogExportBody`
+`func NewEnableLogExportBody(logName string, type_ LogExportType, ) *EnableLogExportBody`
 
 NewEnableLogExportBody instantiates a new EnableLogExportBody object.
 This constructor will assign default values to properties that have it defined,
@@ -57,6 +64,66 @@ GetAwsExternalId returns the AwsExternalId field if non-nil, zero value otherwis
 
 SetAwsExternalId sets AwsExternalId field to given value.
 
+### GetAzureClientId
+
+`func (o *EnableLogExportBody) GetAzureClientId() string`
+
+GetAzureClientId returns the AzureClientId field if non-nil, zero value otherwise.
+
+### SetAzureClientId
+
+`func (o *EnableLogExportBody) SetAzureClientId(v string)`
+
+SetAzureClientId sets AzureClientId field to given value.
+
+### GetAzureClientSecret
+
+`func (o *EnableLogExportBody) GetAzureClientSecret() string`
+
+GetAzureClientSecret returns the AzureClientSecret field if non-nil, zero value otherwise.
+
+### SetAzureClientSecret
+
+`func (o *EnableLogExportBody) SetAzureClientSecret(v string)`
+
+SetAzureClientSecret sets AzureClientSecret field to given value.
+
+### GetAzureDceEndpoint
+
+`func (o *EnableLogExportBody) GetAzureDceEndpoint() string`
+
+GetAzureDceEndpoint returns the AzureDceEndpoint field if non-nil, zero value otherwise.
+
+### SetAzureDceEndpoint
+
+`func (o *EnableLogExportBody) SetAzureDceEndpoint(v string)`
+
+SetAzureDceEndpoint sets AzureDceEndpoint field to given value.
+
+### GetAzureDcrImmutableId
+
+`func (o *EnableLogExportBody) GetAzureDcrImmutableId() string`
+
+GetAzureDcrImmutableId returns the AzureDcrImmutableId field if non-nil, zero value otherwise.
+
+### SetAzureDcrImmutableId
+
+`func (o *EnableLogExportBody) SetAzureDcrImmutableId(v string)`
+
+SetAzureDcrImmutableId sets AzureDcrImmutableId field to given value.
+
+### GetAzureDcrResourceId
+
+`func (o *EnableLogExportBody) GetAzureDcrResourceId() string`
+
+GetAzureDcrResourceId returns the AzureDcrResourceId field if non-nil, zero value otherwise.
+
+### SetAzureDcrResourceId
+
+`func (o *EnableLogExportBody) SetAzureDcrResourceId(v string)`
+
+SetAzureDcrResourceId sets AzureDcrResourceId field to given value.
+
 ### GetAzureSharedKey
 
 `func (o *EnableLogExportBody) GetAzureSharedKey() string`
@@ -69,6 +136,30 @@ GetAzureSharedKey returns the AzureSharedKey field if non-nil, zero value otherw
 
 SetAzureSharedKey sets AzureSharedKey field to given value.
 
+### GetAzureTenantId
+
+`func (o *EnableLogExportBody) GetAzureTenantId() string`
+
+GetAzureTenantId returns the AzureTenantId field if non-nil, zero value otherwise.
+
+### SetAzureTenantId
+
+`func (o *EnableLogExportBody) SetAzureTenantId(v string)`
+
+SetAzureTenantId sets AzureTenantId field to given value.
+
+### GetAzureWorkspaceResourceId
+
+`func (o *EnableLogExportBody) GetAzureWorkspaceResourceId() string`
+
+GetAzureWorkspaceResourceId returns the AzureWorkspaceResourceId field if non-nil, zero value otherwise.
+
+### SetAzureWorkspaceResourceId
+
+`func (o *EnableLogExportBody) SetAzureWorkspaceResourceId(v string)`
+
+SetAzureWorkspaceResourceId sets AzureWorkspaceResourceId field to given value.
+
 ### GetGroups
 
 `func (o *EnableLogExportBody) GetGroups() []LogExportGroup`

diff --git a/docs/LogExportApi.md b/docs/LogExportApi.md
@@ -106,7 +106,7 @@ import (
 
 func main() {
     clusterId := "clusterId_example" // string | 
-    enableLogExportBody := *openapiclient.NewEnableLogExportBody("AuthPrincipal_example", "LogName_example", openapiclient.LogExportType("AWS_CLOUDWATCH")) // EnableLogExportBody | 
+    enableLogExportBody := *openapiclient.NewEnableLogExportBody("LogName_example", openapiclient.LogExportType("AWS_CLOUDWATCH")) // EnableLogExportBody | 
 
     configuration := openapiclient.NewConfiguration()
     api_client := openapiclient.NewClient(configuration)

diff --git a/docs/LogExportClusterSpecification.md b/docs/LogExportClusterSpecification.md
@@ -4,9 +4,16 @@
 
 Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
-**AuthPrincipal** | Pointer to **string** | auth_principal is either the AWS Role ARN that identifies a role that the cluster account can assume to write to CloudWatch or the GCP Project ID that the cluster service account has permissions to write to for cloud logging. | [optional] 
+**AuthPrincipal** | Pointer to **string** | auth_principal is used in different contexts based on integration. CloudWatch: AWS Role ARN that identifies a role that the cluster account can assume to write to CloudWatch GCP Cloud Logging: GCP Project ID that the cluster service account has permissions to write to for cloud logging. Azure Log Analytics (AZURE_LOG_ANALYTICS): CustomerID or WorkspaceID. Not used for AZURE_LOG_ANALYTICS_V2. | [optional] 
 **AwsExternalId** | Pointer to **string** | aws_external_id, if set, is included when assuming the IAM role. Supported for Advanced clusters on AWS only. | [optional] 
-**AzureSharedKey** | Pointer to **string** | The primary or the secondary connected sources client authentication key. This is used to export logs to Azure Log Analytics. | [optional] 
+**AzureClientId** | Pointer to **string** | Azure client ID for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureClientSecret** | Pointer to **string** | Azure client secret for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureDceEndpoint** | Pointer to **string** | Logs ingestion endpoint of the Azure Data Collection Endpoint (DCE). For example, https://{dce-name}.{region}.ingest.monitor.azure.com. | [optional] 
+**AzureDcrImmutableId** | Pointer to **string** | Immutable ID of the Azure Data Collection Rule (DCR), for example dcr-... | [optional] 
+**AzureDcrResourceId** | Pointer to **string** | Full ARM resource ID of the Azure Data Collection Rule (DCR). Cockroach Cloud reads and updates this DCR to add streams for each configured log group. For example, /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Insights/dataCollectionRules/{dcr-name}. | [optional] 
+**AzureSharedKey** | Pointer to **string** | The primary or the secondary connected sources client authentication key. This is used to export logs to Azure Log Analytics via the legacy HTTP Data Collector API. Deprecated: use azure_client_secret instead. | [optional] 
+**AzureTenantId** | Pointer to **string** | Azure tenant ID for the app registration used by the Logs Ingestion API. | [optional] 
+**AzureWorkspaceResourceId** | Pointer to **string** | Full ARM resource ID of the Log Analytics workspace. Cockroach Cloud creates or updates the required custom tables for each configured log group. For example, /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.OperationalInsights/workspaces/{workspace-name}. | [optional] 
 **Groups** | Pointer to [**[]LogExportGroup**](LogExportGroup.md) | groups is a collection of log group configurations to customize which CRDB channels get aggregated into different groups at the target sink. Unconfigured channels will be sent to the default locations via the settings above. | [optional] 
 **LogName** | Pointer to **string** | log_name is an identifier for the logs in the customer&#39;s log sink. | [optional] 
 **OmittedChannels** | Pointer to **[]string** | omitted_channels is a list of channels that the user does not want to export logs for. | [optional] 
@@ -49,6 +56,66 @@ GetAwsExternalId returns the AwsExternalId field if non-nil, zero value otherwis
 
 SetAwsExternalId sets AwsExternalId field to given value.
 
+### GetAzureClientId
+
+`func (o *LogExportClusterSpecification) GetAzureClientId() string`
+
+GetAzureClientId returns the AzureClientId field if non-nil, zero value otherwise.
+
+### SetAzureClientId
+
+`func (o *LogExportClusterSpecification) SetAzureClientId(v string)`
+
+SetAzureClientId sets AzureClientId field to given value.
+
+### GetAzureClientSecret
+
+`func (o *LogExportClusterSpecification) GetAzureClientSecret() string`
+
+GetAzureClientSecret returns the AzureClientSecret field if non-nil, zero value otherwise.
+
+### SetAzureClientSecret
+
+`func (o *LogExportClusterSpecification) SetAzureClientSecret(v string)`
+
+SetAzureClientSecret sets AzureClientSecret field to given value.
+
+### GetAzureDceEndpoint
+
+`func (o *LogExportClusterSpecification) GetAzureDceEndpoint() string`
+
+GetAzureDceEndpoint returns the AzureDceEndpoint field if non-nil, zero value otherwise.
+
+### SetAzureDceEndpoint
+
+`func (o *LogExportClusterSpecification) SetAzureDceEndpoint(v string)`
+
+SetAzureDceEndpoint sets AzureDceEndpoint field to given value.
+
+### GetAzureDcrImmutableId
+
+`func (o *LogExportClusterSpecification) GetAzureDcrImmutableId() string`
+
+GetAzureDcrImmutableId returns the AzureDcrImmutableId field if non-nil, zero value otherwise.
+
+### SetAzureDcrImmutableId
+
+`func (o *LogExportClusterSpecification) SetAzureDcrImmutableId(v string)`
+
+SetAzureDcrImmutableId sets AzureDcrImmutableId field to given value.
+
+### GetAzureDcrResourceId
+
+`func (o *LogExportClusterSpecification) GetAzureDcrResourceId() string`
+
+GetAzureDcrResourceId returns the AzureDcrResourceId field if non-nil, zero value otherwise.
+
+### SetAzureDcrResourceId
+
+`func (o *LogExportClusterSpecification) SetAzureDcrResourceId(v string)`
+
+SetAzureDcrResourceId sets AzureDcrResourceId field to given value.
+
 ### GetAzureSharedKey
 
 `func (o *LogExportClusterSpecification) GetAzureSharedKey() string`
@@ -61,6 +128,30 @@ GetAzureSharedKey returns the AzureSharedKey field if non-nil, zero value otherw
 
 SetAzureSharedKey sets AzureSharedKey field to given value.
 
+### GetAzureTenantId
+
+`func (o *LogExportClusterSpecification) GetAzureTenantId() string`
+
+GetAzureTenantId returns the AzureTenantId field if non-nil, zero value otherwise.
+
+### SetAzureTenantId
+
+`func (o *LogExportClusterSpecification) SetAzureTenantId(v string)`
+
+SetAzureTenantId sets AzureTenantId field to given value.
+
+### GetAzureWorkspaceResourceId
+
+`func (o *LogExportClusterSpecification) GetAzureWorkspaceResourceId() string`
+
+GetAzureWorkspaceResourceId returns the AzureWorkspaceResourceId field if non-nil, zero value otherwise.
+
+### SetAzureWorkspaceResourceId
+
+`func (o *LogExportClusterSpecification) SetAzureWorkspaceResourceId(v string)`
+
+SetAzureWorkspaceResourceId sets AzureWorkspaceResourceId field to given value.
+
 ### GetGroups
 
 `func (o *LogExportClusterSpecification) GetGroups() []LogExportGroup`

diff --git a/docs/LogExportType.md b/docs/LogExportType.md
@@ -1,14 +1,16 @@
 # LogExportType
 
 ## Enum
-> LogExportType encodes the cloud selection that we're exporting to along with the cloud logging platform.  Currently, each cloud has a single logging platform.
+> LogExportType encodes the cloud selection that we're exporting to along with the cloud logging platform.  Currently, each cloud has a single logging platform.   - AZURE_LOG_ANALYTICS: AZURE_LOG_ANALYTICS is the legacy Azure export path via Fluent Bit's HTTP Data Collector API (retiring 2026-09-14). Deprecated: use AZURE_LOG_ANALYTICS_V2 instead.  - AZURE_LOG_ANALYTICS_V2: AZURE_LOG_ANALYTICS_V2 exports to Azure Monitor via the Logs Ingestion API and DCR-based ingestion (OTel pipeline), replacing the deprecated AZURE_LOG_ANALYTICS path that uses Fluent Bit's HTTP Data Collector API (retiring 2026-09-14). V2 authenticates with a tenant/client/secret + DCR endpoint and rule, whereas the legacy type uses a workspace ID + shared key.
 
 * `AWS_CLOUDWATCH` (value: `"AWS_CLOUDWATCH"`)
 
 * `GCP_CLOUD_LOGGING` (value: `"GCP_CLOUD_LOGGING"`)
 
 * `AZURE_LOG_ANALYTICS` (value: `"AZURE_LOG_ANALYTICS"`)
 
+* `AZURE_LOG_ANALYTICS_V2` (value: `"AZURE_LOG_ANALYTICS_V2"`)
+
 
 [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
 

diff --git a/docs/PrivateEndpointServicesApi.md b/docs/PrivateEndpointServicesApi.md
@@ -383,6 +383,7 @@ List all AwsEndpointConnections for a cluster
 Can be used by the following roles assigned at the organization, folder or cluster scope:
 - CLUSTER_ADMIN
 - CLUSTER_OPERATOR_WRITER
+- CLUSTER_DEVELOPER
 
 
 ### Example
@@ -452,6 +453,7 @@ List all connections to a cluster's private endpoint service.
 Can be used by the following roles assigned at the organization, folder or cluster scope:
 - CLUSTER_ADMIN
 - CLUSTER_OPERATOR_WRITER
+- CLUSTER_DEVELOPER
 
 
 ### Example
@@ -523,6 +525,7 @@ The internal_dns property from the regions field in the ListClusters response ca
 Can be used by the following roles assigned at the organization, folder or cluster scope:
 - CLUSTER_ADMIN
 - CLUSTER_OPERATOR_WRITER
+- CLUSTER_DEVELOPER
 
 
 ### Example

diff --git a/docs/README.md b/docs/README.md
@@ -212,3 +212,4 @@ API | Method | HTTP request | Description
 
 ## Author
 support@cockroachlabs.com
+
Original file line number	Diff line number	Diff line change
Expand Up		@@ -212,3 +212,4 @@ API \| Method \| HTTP request \| Description

		## Author
		support@cockroachlabs.com
Original file line number	Diff line number	Diff line change
Expand Up		@@ -212,6 +212,8 @@

		* `DELETE_MIGRATION_ASSISTANT` (value: `"AUDIT_LOG_ACTION_DELETE_MIGRATION_ASSISTANT"`)

		* `UPDATE_BACKUP_CONFIGURATION` (value: `"AUDIT_LOG_ACTION_UPDATE_BACKUP_CONFIGURATION"`)


		[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)

Expand Down