Connecting Azure Kubernetes Service and Azure Database for PostgreSQL using Azure Key Vault

Question

Connecting Azure Kubernetes Service and Azure Database for PostgreSQL using Azure Key Vault .

• AKS : Cluster is ready
• Azure Database for PostgreSQL : DB is ready

I would like to know the steps to connect to PostgreSQL DB on existing the AKS cluster using Key Vaults.

Right we are passing DB username and Password, etc details are passing configmap yaml file level.

Now we want to integrate the credentials with azure key vault and use them as part of AKS deployment with PostgreSQL connection.

Please let me know if anyone across the same use case.

Thank you!

Answer 1

You don't need Keyvault to connect securely to PostgreSQL from AKS (or to most of the other Azure services). You can use managed identity of the cluster. This is much simpler setup than using a Keyvault.

You need to do following steps:

• Enable aad-pod-identity for the cluster (https://learn.microsoft.com/en-us/azure/aks/use-managed-identity)
• Add the managed identity as a user to PostgreSQL
• Use the access-token from the clusters managed identity as password for the PostgreSQL connection. The Microsoft Azure SDKs have support for getting this token, but it can be extracted easily with a REST call as well. Details here: https://learn.microsoft.com/en-us/azure/postgresql/howto-connect-with-managed-identity (note, this documentation is for VM and most of the setup steps can be omitted for AKS).