Rename SQL/Database Admins to PostgreSQL Admins and fix CI/CD firewall and Entra ID auth

tjementum · tjementum · commit 989648fc086f · 2026-03-16T02:04:09.000+01:00
diff --git a/.github/workflows/_deploy-infrastructure.yml b/.github/workflows/_deploy-infrastructure.yml
@@ -30,7 +30,7 @@ on:
       domain_name:
         required: true
         type: string
-      db_admin_object_id:
+      postgres_admin_object_id:
         required: true
         type: string
       production_service_principal_object_id:
@@ -84,7 +84,7 @@ jobs:
           STRIPE_PUBLISHABLE_KEY: ${{ vars.STRIPE_PUBLISHABLE_KEY }}
           STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
           STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-        run: bash ./cloud-infrastructure/cluster/deploy-cluster.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location }} ${{ inputs.cluster_location_acronym }} ${{ inputs.db_admin_object_id }} ${{ inputs.domain_name }} --plan
+        run: bash ./cloud-infrastructure/cluster/deploy-cluster.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location }} ${{ inputs.cluster_location_acronym }} ${{ inputs.postgres_admin_object_id }} ${{ inputs.domain_name }} --plan
 
       - name: Show DNS Configuration
         if: ${{ inputs.domain_name != '' && inputs.domain_name != '-' }}
@@ -149,7 +149,7 @@ jobs:
           STRIPE_PUBLISHABLE_KEY: ${{ vars.STRIPE_PUBLISHABLE_KEY }}
           STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
           STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-        run: bash ./cloud-infrastructure/cluster/deploy-cluster.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location }} ${{ inputs.cluster_location_acronym }} ${{ inputs.db_admin_object_id }} ${{ inputs.domain_name }} --apply
+        run: bash ./cloud-infrastructure/cluster/deploy-cluster.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location }} ${{ inputs.cluster_location_acronym }} ${{ inputs.postgres_admin_object_id }} ${{ inputs.domain_name }} --apply
 
       - name: Refresh Azure Tokens # The previous step may take a while, so we refresh the token to avoid timeouts
         uses: azure/login@v2
@@ -162,7 +162,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y postgresql-client
 
       - name: Add PostgreSQL Admin
-        run: bash ./cloud-infrastructure/cluster/add-postgres-admin.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location_acronym }} ${{ inputs.db_admin_object_id }}
+        run: bash ./cloud-infrastructure/cluster/add-postgres-admin.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location_acronym }} ${{ inputs.postgres_admin_object_id }}
 
       - name: Grant Database Permissions
         run: |
diff --git a/.github/workflows/_migrate-database.yml b/.github/workflows/_migrate-database.yml
@@ -91,7 +91,8 @@ jobs:
         id: generate-migration-script
         working-directory: application
         run: |
-          CONNECTION_STRING="Host=${{ env.POSTGRES_HOST }};Database=${{ inputs.database_name }};Username=$(az account show --query user.name --output tsv);Password=$(az account get-access-token --resource-type oss-rdbms --query accessToken --output tsv);Ssl Mode=Require;"
+          ENTRA_USER=$(az ad sp show --id $(az account show --query user.name --output tsv) --query displayName --output tsv)
+          CONNECTION_STRING="Host=${{ env.POSTGRES_HOST }};Database=${{ inputs.database_name }};Username=$ENTRA_USER;Password=$(az account get-access-token --resource-type oss-rdbms --query accessToken --output tsv);Ssl Mode=Require;"
           
           echo "Checking for pending migrations..."
           MIGRATION_INFO=$(dotnet ef migrations list \
@@ -274,7 +275,8 @@ jobs:
         run: |
           echo "Applying migrations to ${{ inputs.database_name }} database on ${{ env.POSTGRES_HOST }}..."
           ACCESS_TOKEN=$(az account get-access-token --resource-type oss-rdbms --query accessToken --output tsv)
-          PGPASSWORD=$ACCESS_TOKEN psql "host=${{ env.POSTGRES_HOST }} dbname=${{ inputs.database_name }} user=$(az account show --query user.name --output tsv) sslmode=require" -f migration.sql
+          ENTRA_USER=$(az ad sp show --id $(az account show --query user.name --output tsv) --query displayName --output tsv)
+          PGPASSWORD=$ACCESS_TOKEN psql "host=${{ env.POSTGRES_HOST }} dbname=${{ inputs.database_name }} user='$ENTRA_USER' sslmode=require" -f migration.sql
           echo "Migrations applied successfully!"
 
       - name: Display Migration Summary
diff --git a/.github/workflows/cloud-infrastructure.yml b/.github/workflows/cloud-infrastructure.yml
@@ -37,7 +37,7 @@ jobs:
       shared_location: ${{ vars.STAGING_SHARED_LOCATION }}
       cluster_location: ${{ vars.STAGING_CLUSTER_LOCATION }}
       domain_name: ${{ vars.STAGING_DOMAIN_NAME }}
-      db_admin_object_id: ${{ vars.STAGING_DB_ADMIN_OBJECT_ID }}
+      postgres_admin_object_id: ${{ vars.STAGING_POSTGRES_ADMIN_OBJECT_ID }}
       production_service_principal_object_id: ${{ vars.PRODUCTION_SERVICE_PRINCIPAL_OBJECT_ID }}
 
   prod1:
@@ -55,5 +55,5 @@ jobs:
       shared_location: ${{ vars.PRODUCTION_SHARED_LOCATION }}
       cluster_location: ${{ vars.PRODUCTION_CLUSTER1_LOCATION }}
       domain_name: ${{ vars.PRODUCTION_DOMAIN_NAME }}
-      db_admin_object_id: ${{ vars.PRODUCTION_DB_ADMIN_OBJECT_ID }}
+      postgres_admin_object_id: ${{ vars.PRODUCTION_POSTGRES_ADMIN_OBJECT_ID }}
       tenant_id: ${{ vars.TENANT_ID }}
diff --git a/cloud-infrastructure/cluster/add-postgres-admin.sh b/cloud-infrastructure/cluster/add-postgres-admin.sh
@@ -1,16 +1,16 @@
 UNIQUE_PREFIX=$1
 ENVIRONMENT=$2
 CLUSTER_LOCATION_ACRONYM=$3
-DB_ADMIN_OBJECT_ID=$4
+POSTGRES_ADMIN_OBJECT_ID=$4
 
 CLUSTER_RESOURCE_GROUP_NAME=$UNIQUE_PREFIX-$ENVIRONMENT-$CLUSTER_LOCATION_ACRONYM
 POSTGRES_SERVER_NAME=$CLUSTER_RESOURCE_GROUP_NAME
 
-echo "$(date +"%Y-%m-%dT%H:%M:%S") Adding Entra ID group $DB_ADMIN_OBJECT_ID as admin on PostgreSQL server $POSTGRES_SERVER_NAME"
+echo "$(date +"%Y-%m-%dT%H:%M:%S") Adding Entra ID group $POSTGRES_ADMIN_OBJECT_ID as admin on PostgreSQL server $POSTGRES_SERVER_NAME"
 
 az postgres flexible-server microsoft-entra-admin create \
   --resource-group $CLUSTER_RESOURCE_GROUP_NAME \
   --server-name $POSTGRES_SERVER_NAME \
-  --display-name "Database Admins" \
-  --object-id $DB_ADMIN_OBJECT_ID \
+  --display-name "PostgreSQL Admins" \
+  --object-id $POSTGRES_ADMIN_OBJECT_ID \
   --type Group
diff --git a/cloud-infrastructure/cluster/deploy-cluster.sh b/cloud-infrastructure/cluster/deploy-cluster.sh
@@ -4,7 +4,7 @@ UNIQUE_PREFIX=$1
 ENVIRONMENT=$2
 CLUSTER_LOCATION=$3
 CLUSTER_LOCATION_ACRONYM=$4
-DB_ADMIN_OBJECT_ID=$5
+POSTGRES_ADMIN_OBJECT_ID=$5
 DOMAIN_NAME=$6
 
 get_active_version()
@@ -105,7 +105,7 @@ then
     echo "BACK_OFFICE_IDENTITY_CLIENT_ID=$BACK_OFFICE_IDENTITY_CLIENT_ID" >> $GITHUB_OUTPUT
     echo "MAIN_IDENTITY_CLIENT_ID=$MAIN_IDENTITY_CLIENT_ID" >> $GITHUB_OUTPUT
   else
-    . ./add-postgres-admin.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM $DB_ADMIN_OBJECT_ID
+    . ./add-postgres-admin.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM $POSTGRES_ADMIN_OBJECT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'account' $ACCOUNT_IDENTITY_CLIENT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'back-office' $BACK_OFFICE_IDENTITY_CLIENT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'main' $MAIN_IDENTITY_CLIENT_ID
diff --git a/cloud-infrastructure/cluster/grant-database-permissions.sh b/cloud-infrastructure/cluster/grant-database-permissions.sh
@@ -24,7 +24,8 @@ echo "$(date +"%Y-%m-%dT%H:%M:%S") Granting $MANAGED_IDENTITY_NAME (Client ID: $
 # PostgreSQL uses roles instead of SQL Server users. Create a role for the managed identity
 # and grant it the necessary permissions. The pgaadauth_create_principal function handles
 # Entra ID principal creation in Azure Database for PostgreSQL Flexible Server.
-PGPASSWORD=$ACCESS_TOKEN psql "host=$POSTGRES_HOST dbname=$DATABASE_NAME user=$(az account show --query user.name --output tsv) sslmode=require" << EOF
+ENTRA_USER=$(az ad signed-in-user show --query userPrincipalName --output tsv 2>/dev/null || az ad sp show --id $(az account show --query user.name --output tsv) --query displayName --output tsv)
+PGPASSWORD=$ACCESS_TOKEN psql "host=$POSTGRES_HOST dbname=$DATABASE_NAME user='$ENTRA_USER' sslmode=require" << EOF
 DO \$\$
 BEGIN
     IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '$MANAGED_IDENTITY_NAME') THEN
diff --git a/cloud-infrastructure/cluster/main-cluster.bicep b/cloud-infrastructure/cluster/main-cluster.bicep
@@ -153,7 +153,6 @@ module postgresServer '../modules/postgresql-flexible-server.bicep' = {
     subnetId: subnetId
     virtualNetworkId: virtualNetwork.outputs.virtualNetworkId
   }
-  dependsOn: [virtualNetwork]
 }
 
 var isCustomDomainSet = domainName != ''
diff --git a/developer-cli/Commands/DeployCommand.cs b/developer-cli/Commands/DeployCommand.cs
@@ -62,7 +62,7 @@ private void Execute()
 
         ConfirmReuseIfAppRegistrationsExist();
 
-        ConfirmReuseIfDbAdminSecurityGroupExists();
+        ConfirmReuseIfPostgresAdminSecurityGroupExists();
 
         CollectAdditionalInfo();
 
@@ -82,7 +82,7 @@ private void Execute()
 
         GrantSubscriptionPermissionsToServicePrincipals();
 
-        CreateAzureDbAdminSecurityGroups();
+        CreateAzurePostgresAdminSecurityGroups();
 
         CreateGithubEnvironments();
 
@@ -403,12 +403,12 @@ void ConfirmReuseIfAppRegistrationExist(AppRegistration appRegistration)
         }
     }
 
-    private void ConfirmReuseIfDbAdminSecurityGroupExists()
+    private void ConfirmReuseIfPostgresAdminSecurityGroupExists()
     {
-        Config.StagingSubscription.DbAdminsGroup.ObjectId = ConfirmReuseIfDbAdminSecurityGroupExist(Config.StagingSubscription.DbAdminsGroup.Name);
-        Config.ProductionSubscription.DbAdminsGroup.ObjectId = ConfirmReuseIfDbAdminSecurityGroupExist(Config.ProductionSubscription.DbAdminsGroup.Name);
+        Config.StagingSubscription.PostgresAdminsGroup.ObjectId = ConfirmReuseIfPostgresAdminSecurityGroupExist(Config.StagingSubscription.PostgresAdminsGroup.Name);
+        Config.ProductionSubscription.PostgresAdminsGroup.ObjectId = ConfirmReuseIfPostgresAdminSecurityGroupExist(Config.ProductionSubscription.PostgresAdminsGroup.Name);
 
-        string? ConfirmReuseIfDbAdminSecurityGroupExist(string dbAdminsSecurityGroupName)
+        string? ConfirmReuseIfPostgresAdminSecurityGroupExist(string dbAdminsSecurityGroupName)
         {
             var dbAdminsObjectId = RunAzureCliCommand(
                 $"""ad group list --display-name "{dbAdminsSecurityGroupName}" --query "[].id" -o tsv"""
@@ -452,11 +452,11 @@ private void ConfirmChangesPrompt()
         var productionServicePrincipal = Config.ProductionSubscription.AppRegistration.Exists
             ? Config.ProductionSubscription.AppRegistration.ServicePrincipalId
             : "Will be generated";
-        var stagingDbAdminObject = Config.StagingSubscription.DbAdminsGroup.Exists
-            ? Config.StagingSubscription.DbAdminsGroup.ObjectId
+        var stagingPostgresAdminObject = Config.StagingSubscription.PostgresAdminsGroup.Exists
+            ? Config.StagingSubscription.PostgresAdminsGroup.ObjectId
             : "Will be generated";
-        var productionDbAdminObject = Config.ProductionSubscription.DbAdminsGroup.Exists
-            ? Config.ProductionSubscription.DbAdminsGroup.ObjectId
+        var productionPostgresAdminObject = Config.ProductionSubscription.PostgresAdminsGroup.Exists
+            ? Config.ProductionSubscription.PostgresAdminsGroup.ObjectId
             : "Will be generated";
 
         var setupConfirmPrompt =
@@ -472,10 +472,10 @@ [bold]Please review planned changes before continuing.[/]
                 [yellow]** The Service Principals will get 'Contributor' and 'User Access Administrator' role on the Azure Subscriptions.[/]
 
                 [bold]Active Directory Security Groups:[/]
-                * [blue]{Config.StagingSubscription.DbAdminsGroup.Name}[/]
-                * [blue]{Config.ProductionSubscription.DbAdminsGroup.Name}[/]
+                * [blue]{Config.StagingSubscription.PostgresAdminsGroup.Name}[/]
+                * [blue]{Config.ProductionSubscription.PostgresAdminsGroup.Name}[/]
 
-                [yellow]** The Database Admins Security Groups are used to grant Managed Identities and CI/CD permissions to PostgreSQL databases.[/]
+                [yellow]** The PostgreSQL Admins Security Groups are used to grant Managed Identities and CI/CD permissions to PostgreSQL databases.[/]
 
              2. The following GitHub environments will be created if not exists:
                 * [blue]staging[/]
@@ -493,7 +493,7 @@ [bold]Please review planned changes before continuing.[/]
                 * STAGING_SUBSCRIPTION_ID: [blue]{Config.StagingSubscription.Id}[/]
                 * STAGING_SHARED_LOCATION: [blue]{Config.StagingLocation.SharedLocation}[/]
                 * STAGING_SERVICE_PRINCIPAL_ID: [blue]{stagingServicePrincipal}[/]
-                * STAGING_DB_ADMIN_OBJECT_ID: [blue]{stagingDbAdminObject}[/]
+                * STAGING_POSTGRES_ADMIN_OBJECT_ID: [blue]{stagingPostgresAdminObject}[/]
                 * STAGING_DOMAIN_NAME: [blue]-[/] ([yellow]Manually changed this and triggered deployment to set up the domain[/])
 
                 [bold]Staging Cluster Variables:[/]
@@ -506,7 +506,7 @@ [bold]Please review planned changes before continuing.[/]
                 * PRODUCTION_SHARED_LOCATION: [blue]{Config.ProductionLocation.SharedLocation}[/]
                 * PRODUCTION_SERVICE_PRINCIPAL_ID: [blue]{productionServicePrincipal}[/]
                 * PRODUCTION_SERVICE_PRINCIPAL_OBJECT_ID: [blue]{Config.ProductionSubscription.AppRegistration.ServicePrincipalObjectId}[/]
-                * PRODUCTION_DB_ADMIN_OBJECT_ID: [blue]{productionDbAdminObject}[/]
+                * PRODUCTION_POSTGRES_ADMIN_OBJECT_ID: [blue]{productionPostgresAdminObject}[/]
                 * PRODUCTION_DOMAIN_NAME: [blue]-[/] ([yellow]Manually changed this and triggered deployment to set up the domain[/])
 
                 [bold]Production Cluster 1 Variables:[/]
@@ -662,12 +662,12 @@ void GrantAccess(Subscription subscription, string appRegistrationName)
         }
     }
 
-    private void CreateAzureDbAdminSecurityGroups()
+    private void CreateAzurePostgresAdminSecurityGroups()
     {
-        CreateAzureDbAdminSecurityGroup(Config.StagingSubscription.DbAdminsGroup, Config.StagingSubscription.AppRegistration);
-        CreateAzureDbAdminSecurityGroup(Config.ProductionSubscription.DbAdminsGroup, Config.ProductionSubscription.AppRegistration);
+        CreateAzurePostgresAdminSecurityGroup(Config.StagingSubscription.PostgresAdminsGroup, Config.StagingSubscription.AppRegistration);
+        CreateAzurePostgresAdminSecurityGroup(Config.ProductionSubscription.PostgresAdminsGroup, Config.ProductionSubscription.AppRegistration);
 
-        void CreateAzureDbAdminSecurityGroup(DbAdminsGroup dbAdminGroup, AppRegistration appRegistration)
+        void CreateAzurePostgresAdminSecurityGroup(PostgresAdminsGroup dbAdminGroup, AppRegistration appRegistration)
         {
             if (!dbAdminGroup.Exists)
             {
@@ -723,7 +723,7 @@ private static void CreateGithubSecretsAndVariables()
         SetGithubVariable(VariableNames.STAGING_SUBSCRIPTION_ID, Config.StagingSubscription.Id);
         SetGithubVariable(VariableNames.STAGING_SERVICE_PRINCIPAL_ID, Config.StagingSubscription.AppRegistration.ServicePrincipalId!);
         SetGithubVariable(VariableNames.STAGING_SHARED_LOCATION, Config.StagingLocation.SharedLocation);
-        SetGithubVariable(VariableNames.STAGING_DB_ADMIN_OBJECT_ID, Config.StagingSubscription.DbAdminsGroup.ObjectId!);
+        SetGithubVariable(VariableNames.STAGING_POSTGRES_ADMIN_OBJECT_ID, Config.StagingSubscription.PostgresAdminsGroup.ObjectId!);
         SetGithubVariable(VariableNames.STAGING_DOMAIN_NAME, "-");
 
         SetGithubVariable(VariableNames.STAGING_CLUSTER_ENABLED, "true");
@@ -734,7 +734,7 @@ private static void CreateGithubSecretsAndVariables()
         SetGithubVariable(VariableNames.PRODUCTION_SERVICE_PRINCIPAL_ID, Config.ProductionSubscription.AppRegistration.ServicePrincipalId!);
         SetGithubVariable(VariableNames.PRODUCTION_SERVICE_PRINCIPAL_OBJECT_ID, Config.ProductionSubscription.AppRegistration.ServicePrincipalObjectId!);
         SetGithubVariable(VariableNames.PRODUCTION_SHARED_LOCATION, Config.ProductionLocation.SharedLocation);
-        SetGithubVariable(VariableNames.PRODUCTION_DB_ADMIN_OBJECT_ID, Config.ProductionSubscription.DbAdminsGroup.ObjectId!);
+        SetGithubVariable(VariableNames.PRODUCTION_POSTGRES_ADMIN_OBJECT_ID, Config.ProductionSubscription.PostgresAdminsGroup.ObjectId!);
         SetGithubVariable(VariableNames.PRODUCTION_DOMAIN_NAME, "-");
 
         SetGithubVariable(VariableNames.PRODUCTION_CLUSTER1_ENABLED, "false");
@@ -1028,7 +1028,7 @@ public class Subscription(string id, string name, string tenantId, GithubInfo gi
 
     public AppRegistration AppRegistration { get; } = new(githubInfo, environmentName);
 
-    public DbAdminsGroup DbAdminsGroup { get; } = new(githubInfo, environmentName);
+    public PostgresAdminsGroup PostgresAdminsGroup { get; } = new(githubInfo, environmentName);
 }
 
 public class AppRegistration(GithubInfo githubInfo, string environmentName)
@@ -1044,11 +1044,11 @@ public class AppRegistration(GithubInfo githubInfo, string environmentName)
     public string? ServicePrincipalObjectId { get; set; }
 }
 
-public class DbAdminsGroup(GithubInfo githubInfo, string environmentName)
+public class PostgresAdminsGroup(GithubInfo githubInfo, string environmentName)
 {
-    public string Name => $"Database Admins - {environmentName} - {githubInfo.OrganizationName}/{githubInfo.RepositoryName}";
+    public string Name => $"PostgreSQL Admins - {environmentName} - {githubInfo.OrganizationName}/{githubInfo.RepositoryName}";
 
-    public string NickName => $"DatabaseAdmins{environmentName}{githubInfo.OrganizationName}{githubInfo.RepositoryName}";
+    public string NickName => $"PostgreSQLAdmins{environmentName}{githubInfo.OrganizationName}{githubInfo.RepositoryName}";
 
     public bool Exists => !string.IsNullOrEmpty(ObjectId);
 
@@ -1066,7 +1066,7 @@ public enum VariableNames
     STAGING_SUBSCRIPTION_ID,
     STAGING_SERVICE_PRINCIPAL_ID,
     STAGING_SHARED_LOCATION,
-    STAGING_DB_ADMIN_OBJECT_ID,
+    STAGING_POSTGRES_ADMIN_OBJECT_ID,
     STAGING_DOMAIN_NAME,
 
     STAGING_CLUSTER_ENABLED,
@@ -1077,7 +1077,7 @@ public enum VariableNames
     PRODUCTION_SERVICE_PRINCIPAL_ID,
     PRODUCTION_SERVICE_PRINCIPAL_OBJECT_ID,
     PRODUCTION_SHARED_LOCATION,
-    PRODUCTION_DB_ADMIN_OBJECT_ID,
+    PRODUCTION_POSTGRES_ADMIN_OBJECT_ID,
     PRODUCTION_DOMAIN_NAME,
 
     PRODUCTION_CLUSTER1_ENABLED,

Original file line number	Diff line number	Diff line change
`@@ -153,7 +153,6 @@ module postgresServer '../modules/postgresql-flexible-server.bicep' = {`
`153`	`153`	`subnetId: subnetId`
`154`	`154`	`virtualNetworkId: virtualNetwork.outputs.virtualNetworkId`
`155`	`155`	`}`
`156`		`- dependsOn: [virtualNetwork]`
`157`	`156`	`}`
`158`	`157`
`159`	`158`	`var isCustomDomainSet = domainName != ''`