How to include Liquibase into or Continuous Deployment in Azure?

Question

Hello!

Summary: How to add use liquibase and managed identities in continuous deployment?

We are using Azure to host multiple APIs that communicate with a Postgresql database that is running in a Postgres Flexible server in azure.

For local development we have been using Liquibase to handle database migrations and there it is a simple matter running a container to handle the execution of the liquibase scripts.

How would you recommend to set this up in azure?

I would prefer using Managed Identities as far as possible (that is how the APIs have access to eachother and the database).

I've containerized the liquibase scripts so that I have a container that is ready to run the migrations, but using a Container App, Function App (with container) hasn't worked since neither of them work with managed identities. I've experimented with entrypoints similar to this

#!/bin/bash
# Obtain token for Azure SQL Database
TOKEN=$(az account get-access-token --resource https://database.windows.net/ --query accessToken -o tsv)
# Export token as environment variable (or directly pass it to the Liquibase command)
export LIQUIBASE_COMMAND_PASSWORD=$TOKEN
# Run Liquibase with the token
liquibase update

But here the problem is that the container is not logged in to azure, and the "az login" command demands browser interaction.

In essence what I would like to acheive is this.

1. I commit migration changes to my github repo
2. That builds a container for the migrations and pushes it to my acr repo
3. Some resource in azure detects that this container got updated and runs, which executes the database migrations

1 and 2 I have no problems setting up. For for some reason 3 is giving me headache.

I really want to run the migrations from within azure and not something like github because we want to keep our database secure on restricted networks we have in azure.

Please help.

Answer 1

I found a solution. It is so simple when you know it.

1. Make sure the Dockerfile has Azure CLI
2. In the entrypoint/cmd for the Dockerfile reference a bash script
3. In the bash script use Azure CLI to sign in and receive an access token
4. Use the access token to sign in.

I got stuck at 3 before because I was unaware of the --identity option. And for this to work in any container app (job), you will need to use the workaround of export APPSETTING_WEBSITE_SITE_NAME=DUMMY for az login --identity to work properly. Why? See this issue https://github.com/Azure/azure-cli/issues/22677

Example bash script.

#!/bin/bash
# Workaround to get az login --identity to use the correct url for authentication
export APPSETTING_WEBSITE_SITE_NAME=DUMMY

# Get access token and username
az login --identity
token=$(az account get-access-token --resource https://database.windows.net/ --query accessToken -o tsv)
username=$(az ad signed-in-user show --query userPrincipalName --output tsv)

# Example Setup your jbdc url
jdbc=jdbc:postgresql://[server]:5432/[database]

# Run liquibase with token
liquibase update --username $username --password $token --url $jdbc