{"id":20381656,"url":"https://github.com/briandenicola/todo-app-azure-sql","last_synced_at":"2026-04-08T14:31:12.314Z","repository":{"id":43414436,"uuid":"460186636","full_name":"briandenicola/todo-app-azure-sql","owner":"briandenicola","description":"Example code to demo the various authentication methods in Azure","archived":false,"fork":false,"pushed_at":"2025-04-28T18:22:20.000Z","size":165,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-07T01:05:39.216Z","etag":null,"topics":["aks-pod-identity","aks-workload-identity","azure","azure-managed-service-identity","azure-sql","dotnet"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/briandenicola.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-02-16T21:39:42.000Z","updated_at":"2025-04-28T18:22:24.000Z","dependencies_parsed_at":"2024-01-03T22:29:50.628Z","dependency_job_id":"f0dcf07b-67e1-4d0e-af59-9665c0e51de8","html_url":"https://github.com/briandenicola/todo-app-azure-sql","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/briandenicola/todo-app-azure-sql","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/briandenicola%2Ftodo-app-azure-sql","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/briandenicola%2Ftodo-app-azure-sql/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/briandenicola%2Ftodo-app-azure-sql/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/briandenicola%2Ftodo-app-azure-sql/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/briandenicola","download_url":"https://codeload.github.com/briandenicola/todo-app-azure-sql/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/briandenicola%2Ftodo-app-azure-sql/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31559676,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-08T10:21:54.569Z","status":"ssl_error","status_checked_at":"2026-04-08T10:21:38.171Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aks-pod-identity","aks-workload-identity","azure","azure-managed-service-identity","azure-sql","dotnet"],"created_at":"2024-11-15T02:14:43.056Z","updated_at":"2026-04-08T14:31:12.291Z","avatar_url":"https://github.com/briandenicola.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview \n\nA Managed Identity is an Azure AD Service Principal (aka App Registration) in which the credentials are managed by Azure AD instead of being statically defined.  A Identity is assoicated with a resource (Virtual Machine or a Pod inside AKS) and then assigned roles to other Azure resources (like Key Vault or Azure SQL)\n\nThis repo has example code to show how to leverage these Identities. All examples leverage an identity to authenticate to Azure Key Vault to for a TLS certificate and to authenticate to a simple Azure SQL Todo databasde.\n\nAll infrastructure is configured with Terraform and the Code is written in C#.\n\n* The [Managed Identity Example](#managed-identity-example) is a simple example using Azure AD Managed Identity associated with an Azure VM.\n* The [Pod Identity Example](#pod-identity-example) is an example using Azure AD Managed Identity with [AKS Pod Identity](https://docs.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity) which is still supported but considered legacy inside AKS\n* The [Workload Identity Example](#workload-identity-example) is an example using Azure AD Managed Identity with [AKS Workload Identity](https://azure.github.io/azure-workload-identity/docs/introduction.html) which is in preview (as of 4/26/22) but is the direction forward for identities in AKS\n\n# Managed Identity Example\n## Infrastructure Setup\n```bash\ncd managed-identities/infrastructure\nterraform init\nterraform apply\n```\n\n## SQL Setup\n```sql\nCREATE USER [${MSI_IDENTITY}] FROM EXTERNAL PROVIDER\nALTER ROLE db_datareader ADD MEMBER [${MSI_IDENTITY}]\nALTER ROLE db_datawriter ADD MEMBER [${MSI_IDENTITY}]\nCREATE TABLE dbo.Todos ( [Id] INT PRIMARY KEY, [Name] VARCHAR(250) NOT NULL, [IsComplete] BIT);\n```\n\n## Run API\n```bash\nsh scripts/publish.sh\nscp managed-identities/src/publish/linux/todoapi manager@${vm-pip}:/tmp/\nssh manager@${vm-pip}\n/tmp/todoapi --keyvault ${vault_name} --sqlserver ${db_name}\n```\n\n# Pod Identity Example\n## Infrastructure Setup\n```bash\ncd pod-identities/infrastructure\nterraform init\nterraform apply\nsource ./scripts/setup-env.sh\n./scripts/pod-identity.sh --cluster-name ${AKS} -n default -i ${MSI_SELECTOR}\n```\n\n### Notes\n* The cluster name and managed identity name will be known after terraform creates the resources in Azure.\n* The managed identity name should be in the form of ${aks_cluster_name}-default-identity\n    * For example: jackal-59934-aks-default-identity\n\n## SQL Setup\n```sql\nCREATE USER [${MSI_IDENTITY_NAME}] FROM EXTERNAL PROVIDER\nALTER ROLE db_datareader ADD MEMBER [${MSI_IDENTITY_NAME}]\nALTER ROLE db_datawriter ADD MEMBER [${MSI_IDENTITY_NAME}]\nCREATE TABLE dbo.Todos ( [Id] INT PRIMARY KEY, [Name] VARCHAR(250) NOT NULL, [IsComplete] BIT);\n```\n\n## Deploy API\n```bash\nsource ./scripts/setup-env.sh\ncd pod-identities/src\ndocker build -t ${existing_docker_repo}/todoapi:1.0 .\ndocker push ${existing_docker_repo}/todoapi:1.0\ncd pod-identities/chart\nhelm upgrade -i podid \n    --set \"COMMIT_VERSION=1.0\" \\\n    --set \"ACR_NAME=${existing_docker_repo}\" \\\n    --set \"APP_NAME=${APP_NAME}\" \\\n    --set \"MSI_SELECTOR=${MSI_SELECTOR}\" \\\n    --set \"MSI_CLIENTID=${MSI_CLIENTID}\" \\\n    --set \"APP_INSIGHTS=${APP_INSIGHTS}\"\n    .\n```\n\n# Workload Identity Example\nThis implentation is showcases Workload Identities with AKS workloads. [What are workload identities?](https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview) covers the basics of workload identities. [Workload identities with AKS](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview?tabs=dotnet) covers the basics of workload identities with AKS.\n\n## Prerequisties \n* Terraform\n\n## Infrastructure Setup\n```bash\ncd workload-identities/infrastructure\nterraform init\nterraform apply\n```\n\n## SQL Setup\n```sql\nCREATE USER [${MSI_IDENTITY_NAME}] FROM EXTERNAL PROVIDER\nALTER ROLE db_datareader ADD MEMBER [${MSI_IDENTITY_NAME}]\nALTER ROLE db_datawriter ADD MEMBER [${MSI_IDENTITY_NAME}]\nCREATE TABLE dbo.Todos ( [Id] INT PRIMARY KEY, [Name] VARCHAR(250) NOT NULL, [IsComplete] BIT);\n```\n\n## Deploy API\n```bash\nsource ./scripts/setup-env.sh\ncd workload-identities/src\ndocker build -t ${existing_docker_repo}/todoapi:1.0 .\ndocker push ${existing_docker_repo}/todoapi:1.0\ncd workload-identities/chart\nhelm upgrade -i wki \\\n    --set COMMIT_VERSION=1.0 \\\n    --set ACR_NAME=${existing_docker_repo} \\\n    --set APP_NAME=${APP_NAME} \\\n    --set ARM_WORKLOAD_APP_ID=${ARM_WORKLOAD_APP_ID} \\\n    --set ARM_TENANT_ID=${ARM_TENANT_ID} \\\n    --set APP_INSIGHTS=${APP_INSIGHTS} \\\n    --set NAMESPACE=default \\\n    .\n```\n\n### Alternatively\n```\ntask up\n```\n* Useful when the existing docker registry already has the code built.\n\n\n# Testing\n## Virtual Machine \n```bash\nssh manager@${vm-pip}\ncurl -kv -X POST https://localhost:8443/api/todo/ -d '{\"Id\": 123456, \"Name\": \"Take out trash\"}' -H \"Content-Type: application/json\"\ncurl -kv -X POST https://localhost:8443/api/todo/ -d '{\"Id\": 7891011, \"Name\": \"Clean your bathroom\"}' -H \"Content-Type: application/json\"\ncurl -kv https://localhost:8443/api/todo/123456\ncurl -kv https://localhost:8443/api/todo/\n```\n## AKS\n```bash\nkubectl run --restart=Never --rm -it --image=bjd145/utils:2.2 utils\nkubectl exec -it utils -- bash\ncurl -kv -X POST https://todoapi-svc.default:8443/api/todo/ -d '{\"Id\": 123456, \"Name\": \"Take out trash\"}' -H \"Content-Type: application/json\"\ncurl -kv -X POST https://todoapi-svc.default:8443/api/todo/ -d '{\"Id\": 7891011, \"Name\": \"Clean your bathroom\"}' -H \"Content-Type: application/json\"\ncurl -kv https://todoapi-svc.default:8443/api/todo/123456\ncurl -kv https://todoapi-svc.default:8443/api/todo/\n```\n\n# Reference \n* https://github.com/davidfowl/Todos/tree/master/TodoWithDI\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbriandenicola%2Ftodo-app-azure-sql","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbriandenicola%2Ftodo-app-azure-sql","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbriandenicola%2Ftodo-app-azure-sql/lists"}