Implementation of instruction to use PostgreSQL in the application #127
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| # COMMON APPLICATION PROPERTIES | ||
|
|
||
|
There was a problem hiding this comment. to reduce duplicated configuration, we should not copy all content of the yaml |
||
| # embedded database init, supports PostgreSQL too trough the 'PostgreSQL' spring profile | ||
| spring: | ||
| datasource: | ||
| url: jdbc:postgresql://<your-postgresql-server-name>.database.azure.com:5432/petclinic?sslmode=require | ||
| username: myadmin | ||
| password: <your-postgresql-password> | ||
| sql: | ||
| init: | ||
| schema-locations: classpath*:db/postgres/schema.sql | ||
| data-locations: classpath*:db/postgres/data.sql | ||
| mode: ALWAYS | ||
| jms: | ||
| queue: | ||
| visits-requests: visits-requests | ||
| visits-confirmations: visits-confirmations | ||
| servicebus: | ||
| enabled: false # disable messaging support by default | ||
| namespace: ${SERVICEBUS_NAMESPACE} | ||
| pricing-tier: premium | ||
| passwordless-enabled: true | ||
| credential: | ||
| managed-identity-enabled: true | ||
| client-id: ${CLIENT_ID} | ||
| sleuth: | ||
| sampler: | ||
| probability: 1.0 | ||
| cloud: | ||
| config: | ||
| # Allow the microservices to override the remote properties with their own System properties or config file | ||
| allow-override: true | ||
| # Override configuration with any local property source | ||
| override-none: true | ||
| jpa: | ||
| open-in-view: false | ||
| hibernate: | ||
| ddl-auto: none | ||
| show-sql: true | ||
|
|
||
| # Spring Boot 1.5 makes actuator secure by default | ||
| management.security.enabled: false | ||
| # Enable all Actuators and not only the two available by default /health and /info starting Spring Boot 2.0 | ||
| management.endpoints.web.exposure.include: "*" | ||
|
|
||
| # Temporary hack required by the Spring Boot 2 / Spring Cloud Finchley branch | ||
| # Waiting issue https://github.com/spring-projects/spring-boot/issues/13042 | ||
| spring.cloud.refresh.refreshable: false | ||
|
|
||
| # Logging | ||
| logging.level.org.springframework: INFO | ||
|
|
||
| # enable health probes | ||
| management.health.livenessState.enabled: true | ||
| management.health.readinessState.enabled: true | ||
| management.endpoint.health.probes.enabled: true | ||
|
|
||
| # Metrics | ||
| management: | ||
| endpoint: | ||
| metrics: | ||
| enabled: true | ||
| prometheus: | ||
| enabled: true | ||
| endpoints: | ||
| web: | ||
| exposure: | ||
| include: '*' | ||
| metrics: | ||
| export: | ||
| prometheus: | ||
| enabled: true | ||
| eureka: | ||
| client: | ||
| serviceUrl: | ||
| defaultZone: http://discovery-server:8761/eureka/ | ||
| enableSelfPreservation: true | ||
| registryFetchIntervalSeconds: 20 | ||
| instance: | ||
| preferIpAddress: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| --- | ||
| title: '3.2 PostgreSQL database [OPTIONAL]' | ||
| layout: default | ||
| nav_order: 3 | ||
| parent: 'Lab 2: Migrate to Azure Container Apps' | ||
| --- | ||
|
|
||
| # Create an Azure PostgreSQL Database service | ||
|
|
||
| You now have the compute service that will host your applications and the config server that will be used by your migrated application. Before you start deploying individual microservices as Azure Container Apps, you need to first create an Azure Database for PostgreSQL Flexible Server-hosted database for them. To accomplish this, you can use the following guidance: | ||
|
|
||
| - [Quickstart: Create an Azure Database for PostgreSQL Flexible Server using Azure CLI](https://learn.microsoft.com/azure/PostgreSQL/flexible-server/quickstart-create-server-cli). | ||
|
|
||
| You will also need to update the config for your applications to use the newly provisioned PostgreSQL Server. This will involve updating the application.yml config file in your private git config repo with the values provided in the PostgreSQL Server connection string. | ||
|
|
||
| Your PostgreSQL database will also have a firewall enabled. This firewall will by default block all incoming calls. You will need to open this firewall in case you want to connect to it from your microservices running in the ACA environment. | ||
|
|
||
| ## Step by step guidance | ||
|
|
||
| 1. Run the following commands to create an instance of PostgreSQL Flexible server. Note that the name of the server must be globally unique, so adjust it accordingly in case the randomly generated name is already in use. Keep in mind that the name can contain only lowercase letters, numbers and hyphens. In addition, replace the `<sqladmin-password>` placeholder with a complex password and record its value. | ||
| {: .note } | ||
| > Here we use PostgreSQL admin password for apps to connect to sql server, this is for demo/test/learn purpose, not recommand in production environment. Please refer to [Lab 04: Connect to Database securely using identity](https://azure-samples.github.io/java-microservices-aca-lab/docs/04_lab_secrets/04_openlab_secrets_aca.html) for the secured managed identity solution. | ||
|
|
||
| ```bash | ||
| POSTGRES_SERVER_NAME=postgres-$APPNAME-$UNIQUEID | ||
| POSTGRES_ADMIN_USERNAME=sqladmin | ||
| POSTGRES_ADMIN_PASSWORD="<sqladmin-password>" | ||
| DATABASE_NAME=petclinic | ||
|
|
||
| az postgres flexible-server create \ | ||
| --admin-user myadmin \ | ||
| --admin-password "$POSTGRES_ADMIN_PASSWORD" \ | ||
| --name "$POSTGRES_SERVER_NAME" \ | ||
| --resource-group "$RESOURCE_GROUP" | ||
| ``` | ||
|
|
||
| {: .note } | ||
| > During the creation you will be asked whether access for your IP address should be added and whether access for all IP's should be added. Answer `n` for no on both questions. | ||
|
|
||
| {: .note } | ||
| > In case this statement fails with the message `ERROR: Unable to prompt for confirmation as no tty available`, add the `--yes` flag to the above statement. This will auto-install any missing resource providers. | ||
|
|
||
| {: .note } | ||
| > Wait for the provisioning to complete. This might take about 3 minutes. | ||
|
|
||
| 1. Once the Azure Database for PostgreSQL Flexible Server instance gets created, it will output details about its settings. In the output, you will find the server connection string. Record its value since you will need it later in this exercise. | ||
|
|
||
| 1. Run the following commands to create a database in the Azure Database for PostgreSQL Flexible Server instance. | ||
|
|
||
| ```bash | ||
| az postgres flexible-server db create \ | ||
| --server-name $POSTGRES_SERVER_NAME \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| -d $DATABASE_NAME | ||
| ``` | ||
|
|
||
| 1. You will also need to allow connections to the server from your ACA environment. For now, to accomplish this, you will create a server firewall rule to allow inbound traffic from all Azure Services. | ||
|
|
||
| Check the status of your sql server | ||
|  | ||
|
|
||
| Checking `Allow Azure services and resources to access this server` adds an IP based firewall rule with start and end IP address of `0.0.0.0`, See [Connections from inside Azure](https://learn.microsoft.com/en-us/azure/azure-sql/database/firewall-configure?view=azuresql#connections-from-inside-azure). | ||
|
|
||
| This way your apps running in Azure Container Apps will be able to reach the PostgreSQL database. In one of the upcoming exercises, you will restrict this connectivity to limit it exclusively to the apps hosted by your ACA. | ||
|
|
||
| ```bash | ||
| az postgres flexible-server firewall-rule create \ | ||
| --rule-name allAzureIPs \ | ||
| --name $POSTGRES_SERVER_NAME \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0 | ||
| ``` | ||
|
|
||
| Check the sql server firewall rules with command | ||
| ```bash | ||
| az postgres flexible-server firewall-rule list \ | ||
| --name $POSTGRES_SERVER_NAME \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| ``` | ||
|
|
||
| 1. From the Git Bash window, in the config repository you cloned locally, use your favorite text editor to open the _application.yml_ file. Replace the full contents of the _application.yml_ file with the contents of [this application.yml](0203_postgres_application.yaml) file. The updated _application.yml_ file includes the following changes: | ||
|
|
||
| * It removes the default `0` value for the `server.port` on line 5. | ||
| * It changes the default `spring.sql.init` values to use `PostgreSQL` configuration on lines 15 to 19. | ||
| * It adds a `spring.datasource` property for your PostgreSQL database on lines 10 to 14. | ||
| * It adds extra `eureka` config on lines 61 to 66. | ||
| * It removes the `chaos-monkey` and `PostgreSQL` profiles. | ||
|
|
||
| 1. In the part you pasted, update the values of the target datasource endpoint on line 6, the corresponding admin user account on line 7, and its password on line 8 to match your configuration. Set these values by using the information in the Azure Database for PostgreSQL Flexible Server connection string you recorded earlier in this task. | ||
|
|
||
| 1. Save the changes and push the updates you made to the _application.yml_ file to your private GitHub repo by running the following commands from the Git Bash prompt: | ||
|
|
||
| ```bash | ||
| git add . | ||
| git commit -m 'azure postgres info' | ||
| git push | ||
| ``` | ||
|
|
||
| {: .note } | ||
| > At this point, the admin account user name and password are stored in clear text in the application.yml config file. In one of upcoming exercises, you will remediate this potential vulnerability by removing clear text credentials from your configuration. | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| --- | ||
|
There was a problem hiding this comment. It is not a good idea to add new lab for postgres sql Seems the configuration differences are minor for MySQL & PostgresSQL, I think we may replace MySQL with PostgresSQL in the main thread, and use a Optional page to describe the differences for MySQL |
||
| title: '1. Create db admin account' | ||
| layout: default | ||
| nav_order: 1 | ||
| parent: 'Lab 4: Connect to Database securely using identity [PostgreSQL]' | ||
| --- | ||
|
|
||
| # Create a database administrator account | ||
|
|
||
| You are already using a managed Identity to connect to the Azure Container Registry. You can use this same identity to also connect to the database. This will allow you to remove the username and password from the config repository. | ||
|
|
||
| - [Configure passwordless database connections for Java apps](https://learn.microsoft.com/azure/developer/java/ee/how-to-configure-passwordless-datasource?toc=%2Fazure%2Fdeveloper%2Fintro%2Ftoc.json&bc=%2Fazure%2Fdeveloper%2Fintro%2Fbreadcrumb%2Ftoc.json&tabs=postgresql-passwordless-flexible-server) | ||
|
|
||
| ## Step by step guidance | ||
|
|
||
| 1. Before creating the administrator account, you need to enable Microsoft Entra Authentication from the portal. | ||
|
|
||
| 1. In the Azure Portal, navigate to your PostgreSQL server page. | ||
|
|
||
| 1. On your PostgreSQL page, select Authentication (1) from left menu under security, check PostgreSQL and Microsoft Entra authentication (2) option and save it using the Save (3) option from top menu. | ||
|
|
||
|  | ||
|
|
||
| 1. You will need to allow the user assigned managed identity access to the database. To configure this, you will need to first make your current logged in user account database administrator. For this to work on a PostgreSQL database you first need an additional managed identity. | ||
|
|
||
| ```bash | ||
| DB_ADMIN_USER_ASSIGNED_IDENTITY_NAME=uid-dbadmin-$APPNAME-$UNIQUEID | ||
|
|
||
| ADMIN_IDENTITY_RESOURCE_ID=$(az identity create \ | ||
| --name $DB_ADMIN_USER_ASSIGNED_IDENTITY_NAME \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --query id \ | ||
| --output tsv) | ||
| ``` | ||
|
|
||
| 1. This identity needs to be assigned to your PostgreSQL server. | ||
|
|
||
| ```bash | ||
| az postgres flexible-server identity assign \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --server-name $POSTGRES_SERVER_NAME \ | ||
| --identity $DB_ADMIN_USER_ASSIGNED_IDENTITY_NAME | ||
|
|
||
|
|
||
| az postgres flexible-server identity list \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --server-name $POSTGRES_SERVER_NAME | ||
| ``` | ||
|
|
||
| 1. Get the current logged in user and object ID. This will give you the info of the user account you are currently logged in with in the Azure CLI. | ||
|
|
||
| ```bash | ||
| CURRENT_USER=$(az account show --query user.name --output tsv) | ||
| echo $CURRENT_USER | ||
| CURRENT_USER_OBJECTID=$(az ad signed-in-user show --query id --output tsv) | ||
| echo $CURRENT_USER_OBJECTID | ||
| ``` | ||
|
|
||
| 1. Next you create a database administrator based on your current user account. | ||
|
|
||
| ```bash | ||
| az postgres flexible-server ad-admin create \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| --server-name $POSTGRES_SERVER_NAME \ | ||
| --object-id $CURRENT_USER_OBJECTID \ | ||
| --display-name $CURRENT_USER \ | ||
|
|
||
| DB_ID=$(az postgres flexible-server db show \ | ||
| --server-name $POSTGRES_SERVER_NAME \ | ||
| --resource-group $RESOURCE_GROUP \ | ||
| -d $DATABASE_NAME \ | ||
| --query id \ | ||
| -o tsv) | ||
| ``` | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we'd better and children pages here