Connect a Kong Gateway Azure PostgreSQL Server using Azure Managed Identity

Microsoft Entra authentication (formerly Azure AD) provides a secure way to connect Kong Gateway to your Azure PostgreSQL database without storing database passwords in configuration files. This feature supports both Service Principal and Managed Identity authentication methods. This documentation provides an example about how to use Azure Managed Identity authentication to connect to Azure PostgreSQL Server.

Before configuring Azure authentication in Kong Gateway, you need the following:

• Enable Azure PostgreSQL Flexible Server by selecting PostgreSQL and Microsoft Entra authentication as your authentication method for your Azure Database for PostgreSQL flexible server instance.
• You need a managed identity and an Azure resource that uses the managed identity for authentication. For example, you can create a user-assigned managed identity and assign it to an Azure VM. Copy and save the managed identity’s client ID. You can find the client ID on the managed identity’s detail page in the Azure Portal.
• Create an Azure Database for PostgreSQL flexible server user for your Managed Identity. To create a PostgreSQL user for your managed identity, you’ll need to connect to the Azure PostgreSQL server as Microsoft Entra administrator. After successfully logging in to the Azure PostgreSQL server, run the following SQL command:

  postgres=> select * from pgaadauth_create_principal('my-managed-identity', false, false);
  
            pgaadauth_create_principal
  ------------------------------------------------
  Created role for "my-managed-identity"
  (1 row)
  

  Copied!

  You’ll also need to prepare the correct Kong Gateway database for the Azure PostgreSQL user. For example the following command creates a kong database and assigns permissions on the public schema to the managed identity:

  postgres=> create database kong owner 'my-managed-identity' encoding 'utf-8';
  CREATE DATABASE
  postgres=> \c kong
  SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
  You are now connected to database "kong" as user "XXXXX".
  kong=> grant all on schema public to "my-managed-identity";
  GRANT
  

  Copied!

Now you can configure Azure authentication in Kong Gateway by setting configuration settings for your database.

# Basic database configuration
export KONG_DATABASE=postgres
export KONG_PG_HOST=your-server.postgres.database.azure.com
export KONG_PG_PORT=5432
export KONG_PG_DATABASE=kong
export KONG_PG_USER=my-managed-identity # needs to be the name of the managed identity

export KONG_PG_AZURE_AUTH=on
export KONG_PG_AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000001 # the Client ID of the user assigned managed identity

# Read-only database configuration
export KONG_PG_RO_HOST=your-ro-server.postgres.database.azure.com
export KONG_PG_RO_PORT=5432
export KONG_PG_RO_DATABASE=kong
export KONG_PG_RO_USER=my-managed-identity # needs to be the name of the managed identity

export KONG_PG_RO_AZURE_AUTH=on
export KONG_PG_RO_AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000001 # the Client ID of the user assigned managed identity

# Basic database configuration
database = postgres
pg_host = your-server.postgres.database.azure.com
pg_port = 5432
pg_database = kong
pg_user = my-managed-identity # needs to be the name of the managed identity

pg_azure_auth = on
pg_azure_client_id = 00000000-0000-0000-0000-000000000001 # the Client ID of the user assigned managed identity

# Read-only database configuration
pg_ro_host = your-ro-server.postgres.database.azure.com
pg_ro_port = 5432
pg_ro_database = kong
pg_ro_user = my-managed-identity # needs to be the name of the managed identity

pg_ro_azure_auth = on
pg_ro_azure_client_id = 00000000-0000-0000-0000-000000000001 # the Client ID of the user assigned managed identity

The following table describes the different configuration parameters you can set when configuring Azure Service Principal authentication to connect to the Azure PostgreSQL Server: