Create service connections from the microservices to the database server

The apps deployed as the Spring Petclinic microservices will now connect using a service connector to the MySQL Flexible server. A service connector will set up the needed environment variables the service needs to make the connection. You can use the following guidance to create a service connector:

• Connect an Azure Database for MySQL instance to your application in Azure Spring Apps.

The following three apps of your application use the database hosted by the Azure Database for MySQL Flexible Server instance, so they will need to be assigned a service connector:

• customers-service
• vets-service
• visits-service

Since each of these apps already has a user assigned managed identity assigned to them, you will make use of this same identity to get access to the database.

Step by step guidance

1. For creating a service connector you will need to add the serviceconnector-passwordless extension:

   az extension add --name serviceconnector-passwordless --upgrade
   

2. You will also need the clientId of each of the user assigned managed identities of your microservices. Store these clientId’s in environment variables, by running the following commands from Git Bash shell:

   CUSTOMERS_SERVICE_CID=$(az identity show -g $RESOURCE_GROUP -n customers-svc-uid --query clientId -o tsv)
   VISITS_SERVICE_CID=$(az identity show -g $RESOURCE_GROUP -n visits-svc-uid --query clientId -o tsv)
   VETS_SERVICE_CID=$(az identity show -g $RESOURCE_GROUP -n vets-svc-uid --query clientId -o tsv)
   

3. You will also need your subscription ID for creating the service connections:

   SUBID=$(az account show --query id -o tsv)
   

4. Create now the service connections for the customers-service.

   az spring connection create mysql-flexible \
       --resource-group $RESOURCE_GROUP \
       --service $SPRING_APPS_SERVICE \
       --app $CUSTOMERS_SERVICE \
       --target-resource-group $RESOURCE_GROUP \
       --server $MYSQL_SERVER_NAME \
       --database $DATABASE_NAME \
       --user-identity mysql-identity-id=$ADMIN_IDENTITY_RESOURCE_ID client-id=$CUSTOMERS_SERVICE_CID subs-id=$SUBID
   

5. You can test the validity of this new connection with the validate command:

   CONNECTION=$(az spring connection list \
       --resource-group $RESOURCE_GROUP \
       --service $SPRING_APPS_SERVICE \
       --app $CUSTOMERS_SERVICE \
       --query [].id -o tsv)
      
   az spring connection validate \
       --resource-group ${RESOURCE_GROUP} \
       --service ${SPRING_APPS_SERVICE} \
       --app ${CUSTOMERS_SERVICE} \
       --id $CONNECTION
   

   The output of this command should show that the connection was made successful.

6. In the same way create the service connections for the vets-service and visits-service:

   az spring connection create mysql-flexible \
       --resource-group $RESOURCE_GROUP \
       --service $SPRING_APPS_SERVICE \
       --app $VISITS_SERVICE \
       --target-resource-group $RESOURCE_GROUP \
       --server $MYSQL_SERVER_NAME \
       --database $DATABASE_NAME \
       --user-identity mysql-identity-id=$ADMIN_IDENTITY_RESOURCE_ID client-id=$VISITS_SERVICE_CID subs-id=$SUBID
      
   az spring connection create mysql-flexible \
       --resource-group $RESOURCE_GROUP \
       --service $SPRING_APPS_SERVICE \
       --app $VETS_SERVICE \
       --target-resource-group $RESOURCE_GROUP \
       --server $MYSQL_SERVER_NAME \
       --database $DATABASE_NAME \
       --user-identity mysql-identity-id=$ADMIN_IDENTITY_RESOURCE_ID client-id=$VETS_SERVICE_CID subs-id=$SUBID
   

7. In the Azure Portal, navigate to your Spring Apps Service instance. Navigate to Apps and open your customers-service app. In the customers-service app, select the Service Connector menu item. Notice in this screen you can see the details of your service connector. Notice that the service connector has all the config values set like spring.datasource.url, spring.datasource.username, but for instance no spring.datasource.password. These values get turned into environment variables at runtime for your app. This is also why you could remove them from the Key Vault. Instead of spring.datasource.password it has a spring.cloud.azure.credential.client-id, which is the client ID of your managed identity. It also defines 2 additional variables spring.datasource.azure.passwordless-enabled and spring.cloud.azure.credential.managed-identity-enabled for enabling the passwordless connectivity.