How to integrate Azure arc into data-api-builder container ?

[diallonortv]

Hello,

I did some testing with data-api-builder client and Azure Arc ( give you a Machine identity (Azure managed identity) for onpremise server ). It works great, so I can connect to the database ( SQL server 2022 with Azure Arc Agent ) without using any login/password, The Arc agent ( on the rest-api's server) provides the token and the SQL Server 2022 is capable of using it. What would be the best way to add Azure ARC (available for both Linux and windows ) to the container? Should I modify the image or build one for myself from scratch? I need to gain more knowledge in creating containers. Therefore any pointers would be helpful.

Regards

Vincent

[seantleonard]

Hi Vincent,

Can you clarify what you mean by "What would be the best way to add Azure ARC (available for both Linux and windows ) to the container?"

What kind of ARC agent/config are you referring to? You will probably need to build your own container from scratch using the docker compose files in this repo as a starting point.

[diallonortv]

Hello,
Azure ARc is a aprogram available by microsoft for Windowd and linux, creating a machine identity. So this agent have an identity, for example i have a laptop PM514, one i install the agent on this machine, i can request token to it, these token let me access Azure ressource, like a database ( SQL Server ). So its a remplacement for service account. And it's available for every .Net program including the api-builer. SO inside api-builder connnection string to the database i only need to specify the Database and the server name. The .Net program know it need to use the DefaultAuthentification and therefore request the token to the Azure arc agent, work wonderful. https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview .

[Aniruddh25]

That's an awesome use case @diallonortv!

Our docker image is available for pulling as per the instructions here:
https://learn.microsoft.com/en-us/azure/data-api-builder/run-using-container OR
https://mcr.microsoft.com/en-us/product/azure-databases/data-api-builder/about
Using this as the baseline, you could build your own docker image in which all the Arc Agent components are installed as well.

The Dockerfile we use to build our image is here: https://github.com/Azure/data-api-builder/blob/main/Dockerfile

[diallonortv]

Hello,

I start to work on it, the base image wasn't compatible with Azure ARC ( issue with a missing sytemd which is a requirement for Azure ARC ) . So i start from scratch using a windows image and this is my DockerFile :
The onboarding script is auto-generated by Azure when you add a new Azure ARC server, the the script ask for a device login so it get authorize.

`
from mcr.microsoft.com/windows/servercore:ltsc2019-amd64

Install dependancy for Azure ARC installation

RUN powershell Install-PackageProvider -Name NuGet -Force
RUN powershell Install-Module PowerShellGet -AllowClobber -Force
RUN powershell Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
RUN powershell Install-Module -name Az.Accounts -AllowClobber -AcceptLicense

Install Azure Arc

COPY OnboardingScript.ps1 ./
RUN powershell .\OnboardingScript.ps1

Install .Net 6 SDK

RUN curl -o dotnet6.exe https://download.visualstudio.microsoft.com/download/pr/6a7d9254-d184-41a1-91fc-00ed876297a9/9db88f1a5fe2375b8c389d7087db132e/dotnet-sdk-6.0.412-win-x64.exe
RUN dotnet6.exe /install /quiet /norestart

Prepare for compile of data-api-builder

RUN powershell md C:\App
RUN powershell md C:\src

#Copy source code
WORKDIR C:\src
COPY data-api-builder/src C:/src

#Compile source code

RUN dotnet build "C:/src/Service/Azure.DataApiBuilder.Service.csproj" -c Docker -o /out -r win-x64

WORKDIR C:\App
ENTRYPOINT [CMD]`

I first start using the dotnet install of the cli but when i start doing ENTRYPOINT dab start i got issue with dab not found. So now i am trying to compile the code and i get issue with "NU1100 : Unable to resolve like these :

C:\src\Service\Azure.DataApiBuilder.Service.csproj : error NU1100: Unable to resolve 'HotChocolate (>= 12.18.0)' for 'net6.0'. C:\src\Service\Azure.DataApiBuilder.Service.csproj : error NU1100: Unable to resolve 'HotChocolate.AspNetCore (>= 12.18.0)' for 'net6.0'. C:\src\Service\Azure.DataApiBuilder.Service.csproj : error NU1100: Unable to resolve 'HotChocolate.AspNetCore.Authorization (>= 12.18.0)' for 'net6.0'. C:\src\Service\Azure.DataApiBuilder.Service.csproj : error NU1100: Unable to resolve 'Microsoft.AspNetCore.Authentication.JwtBearer (>= 6.0.14)' for 'net6.0'.

So i keep working on this as it look like a nuget source issue.

Vincent

[diallonortv]

Hi,

So i finally got it to work (unfortunately docker is not really good options for me a the end because i run on VM (server is a VMWARE ) and virtualization on top of virtualization is a weird thing.

But for those who are interested this is my docker file :

from  mcr.microsoft.com/dotnet/sdk:6.0-windowsservercore-ltsc2022

#change machine name
USER ContainerAdministrator
RUN powershell Rename-Computer -NewName "RESTAPIDATASTOREDEV" -Force

# Install certificate for interception
USER ContainerAdministrator
RUN pwsh -Command md C:\\App
WORKDIR C:\\App
COPY FHVI_root.cer ./
COPY certoc.exe ./
RUN certoc.exe -addstore root FHVI_root.cer




#Install Azure Data API BUilder
RUN dotnet tool install --global  Microsoft.DataApiBuilder



# Install Azure Arc , need the administrator to install package
USER ContainerAdministrator
RUN powershell Install-PackageProvider -Name NuGet -Force
RUN powershell Install-Module PowerShellGet -AllowClobber -Force
RUN powershell Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
RUN powershell Install-Module -name Az.Accounts -AllowClobber -AcceptLicense
COPY OnboardingScriptSP.ps1 ./
RUN powershell .\OnboardingScriptSP.ps1
COPY dab-config.json C:/App/
# Set variable DAB_ENVIRONMENT
RUN setx DAB_ENVIRONMENT "C:/App/dab-config"
USER ContainerUser
RUN setx DAB_ENVIRONMENT "C:/App/dab-config"
#Add the .Net program to connect to the rest api to check how the Arc agent fonction
USER ContainerAdministrator

RUN pwsh -Command md C:\\Connector
WORKDIR C:\\Connector
COPY Release C:/Connector/
WORKDIR C:\\App
ENTRYPOINT dab start -c C:\\App\\dab-config.json

`` 

The onboardingsp.ps1 script is generated by Azure when you ask to create a Azure ARC server :

![image](https://github.com/Azure/data-api-builder/assets/122446401/10594559-b750-4c53-9351-9a1b1c0019cf)

Then you click on Add multiple server :
![image](https://github.com/Azure/data-api-builder/assets/122446401/7eca7ed0-7b2c-474e-a02e-5f5ea4b9865d)


Now your connection string look like this :

"connection-string": "Server=SDEVSQL75\\DATASTORE;Database=opaledev;TrustServerCertificate=true;Trusted_Connection=yes" and it will use the Azure ARC agent to authentificate with token against a SQL server 2022 ( with Azure arc agent ) or an Azure Database.
Therefore it ease the security management by removing service account and use a more modern approach with System assign managed identity.