Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/syedhassaanahmed/tf-aks-sql-aad
This Terraform template enables authentication to Azure SQL DB using AAD Pod Identity from AKS
https://github.com/syedhassaanahmed/tf-aks-sql-aad
aad-pod-identity aks-kubernetes-cluster azure-active-directory azure-sql-database managed-identity powershell-core terraform-template
Last synced: about 1 month ago
JSON representation
This Terraform template enables authentication to Azure SQL DB using AAD Pod Identity from AKS
- Host: GitHub
- URL: https://github.com/syedhassaanahmed/tf-aks-sql-aad
- Owner: syedhassaanahmed
- License: mit
- Created: 2020-05-04T16:53:31.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2020-05-30T01:10:40.000Z (over 4 years ago)
- Last Synced: 2024-12-23T12:35:30.121Z (2 months ago)
- Topics: aad-pod-identity, aks-kubernetes-cluster, azure-active-directory, azure-sql-database, managed-identity, powershell-core, terraform-template
- Language: HCL
- Homepage:
- Size: 28.3 KB
- Stars: 3
- Watchers: 3
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# tf-aks-sql-aad
This Terraform template enables authentication to Azure SQL Database using [AAD Pod Identity](https://github.com/Azure/aad-pod-identity) from an AKS Cluster. The template is loosely based on [this document](https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-connect-msi) with the following differences;
- We use [PowerShell sqlserver module](https://docs.microsoft.com/en-us/powershell/module/sqlserver/invoke-sqlcmd?view=sqlserver-ps) instead of [sqlcmd utility](https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15). When applying the template from an Azure DevOps pipeline, PowerShell already exists on all [hosted agents](https://github.com/actions/virtual-environments/blob/master/images/linux/Ubuntu1804-README.md).
- We set the Service Principal under which Terraform is running, as the [Azure AD Admin for SQL Server](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure?tabs=azure-powershell#provision-an-azure-active-directory-administrator-for-your-managed-instance).
- When granting database roles to the managed identity, we create the external user via following T-SQL statement;
```sql
CREATE USER [] WITH default_schema=[dbo], SID=[], TYPE=E;
```
instead of
```sql
CREATE USER [] FROM EXTERNAL PROVIDER;
```
The later T-SQL statement requires `[]` to be a user principal and if a service principal/managed identity is specified, it will fail with the following error;
```
Principal 'abc' could not be found at this time. Please try again later.
```
Many thanks to my colleague [Noel Bundick](https://www.noelbundick.com/) for pointing out to [this solution](https://github.com/microsoft/data-contest-toolkit/blob/noel/azure-infra/deploy/bootstrap/bootstrap.ps1) based on the [pseudo-documented SID hack](https://stackoverflow.com/questions/53001874/cant-create-azure-sql-database-users-mapped-to-azure-ad-identities-using-servic/56150547#56150547).
## Requirements
- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest)
- [kubectl](https://docs.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-install-cli)
- [PowerShell](https://github.com/PowerShell/PowerShell#get-powershell)
- [Terraform](https://www.terraform.io/downloads.html)
- [Terraform authenticated via Service Principal](https://www.terraform.io/docs/providers/azurerm/guides/service_principal_client_secret.html)
>**Note:** This template performs [Azure AD role assignments](https://docs.microsoft.com/en-us/azure/role-based-access-control/overview) required by AAD Pod Identity. Therefore the Service Principal used for Terraform authentication must be created with `Owner` privileges.
## Azure resources
- Azure SQL Database
- User-Assigned Managed Identity
- AKS Cluster
## Smoke Test
Once `terraform apply` has successfully completed, fill the following variables from the Terraform output;
```sh
export aad_pod_id_binding_selector="aad-pod-id-binding-selector"
export aks_cluster_name="aks-xxxxxx"
export rg_name="rg-xxxxxx"
export sql_db_name="sqldb-test"
export sql_server_fqdn="sql-xxxxxx"
```
Alternatively, you can execute the following;
```sh
eval $(terraform output | sed 's/^/export /; s/ = /="/g; s/$/"/')
```
Then;
```
./smoke_test.sh
```
The smoke test will create a test pod in the newly provisioned AKS cluster and will attempt to authenticate to the SQL DB from the pod using managed identity. Once authentication is successful it will perform DDL and CRUD operations to validate the database roles.