Skip to content

[RHIDP-14196]: Add Azure Managed Identity for PostgreSQL documentation - #2575

Draft
themr0c wants to merge 5 commits into
redhat-developer:mainfrom
themr0c:worktree-RHIDP-14196-azure-mi-postgresql
Draft

[RHIDP-14196]: Add Azure Managed Identity for PostgreSQL documentation#2575
themr0c wants to merge 5 commits into
redhat-developer:mainfrom
themr0c:worktree-RHIDP-14196-azure-mi-postgresql

Conversation

@themr0c

@themr0c themr0c commented Sep 2, 2026

Copy link
Copy Markdown
Member

Important

IMPORTANT: Do Not Merge
This PR is in draft while pending engineering review of the Azure Managed Identity configuration details.

Summary

  • Add concept module explaining Azure Managed Identity (Entra ID) passwordless PostgreSQL authentication, covering three credential modes (DefaultAzureCredential, ManagedIdentityCredential, ClientSecretCredential), RBAC automatic compatibility, and HA connection pool sizing
  • Add Helm chart procedure for configuring connection.type: azure with Azure Workload Identity pod labels and service account binding
  • Add Operator procedure using spec.deployment.patch for pod labels and ConfigMap-based app-config
  • Wire new assembly into the configure title (after external PostgreSQL) with cross-reference TIP from existing external PostgreSQL assembly
  • Add JTBD Secure category nav entry (Job 3: "Configure Azure Managed Identity to secure PostgreSQL database connections")
  • Add assemblies symlink in secure category-map for assembly include resolution

Version(s): 2.1.0

Issue: https://redhat.atlassian.net/browse/RHIDP-14196

Preview: N/A (draft)

Test plan

  • build-ccutil.sh — 36 passed, 0 failed
  • Lychee link validation — 2754 OK, 0 errors
  • CQA — 22 checks, 22 pass, 0 fail
  • Review against upstream Backstage docs (backstage.io/docs/getting-started/config/database/#azure-with-entra-authentication)
  • Engineering review of Helm chart podLabels and serviceAccount values
  • Engineering review of Operator spec.deployment.patch pattern for Azure Workload Identity
  • Verify tokenCredential config options match RHDH 2.1 Backstage version

🤖 Generated with Claude Code

themr0c and others added 2 commits September 2, 2026 10:27
Add concept module, Helm and Operator procedures, assembly, and JTBD
Secure category nav for configuring passwordless PostgreSQL auth via
Microsoft Entra ID. Add cross-reference from existing external
PostgreSQL assembly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…x CQA-05

- Add assemblies symlink in secure category-map for assembly includes
- Fix broken Microsoft docs URL (entra → azure-ad)
- Replace non-standard block title with inline text (CQA-05)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@rhdh-bot

rhdh-bot commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

PR Build Results

Build failed -- 36/36 titles | 189s
Preview: https://redhat-developer.github.io/red-hat-developers-documentation-rhdh/pr-2575/

View full logs


Content Quality Assessment

CQA Report

  • CQA-00a: Orphaned modules
  • CQA-00b: Directory structure
  • CQA-01: Vale AsciiDoc DITA compliance
  • CQA-02: Verify assembly structure (1 issues)
    • [AUTOFIX] assemblies/configure_configuring-rhdh/assembly-configure-azure-managed-identity-for-postgresql-connections.adoc: Line 2: Missing context save on line 2
  • CQA-03: Verify content type metadata
  • CQA-04: Verify module templates
  • CQA-05: Verify required modular elements
  • CQA-06: Verify assemblies follow official template (one user story)
  • CQA-07: Verify TOC depth (max 3 levels)
  • CQA-08: Verify short description content quality
  • CQA-09: Verify short description format
  • CQA-10: Verify titles are brief, complete, and descriptive
  • CQA-11: Verify procedure prerequisites
  • CQA-12: Verify grammar and style (Vale)
  • CQA-13: Verify content matches declared type
  • CQA-14: Verify no broken links
  • CQA-14b: Inbound link stability (no ID changes for existing files)
  • CQA-15: Check redirects
  • CQA-16: Verify official product names
  • CQA-17: Verify legal disclaimers for preview features
  • CQA-jtbd-01: Verify navigation file structure
  • CQA-jtbd-02: Modules not yet in product_product (informational)

Summary

Checks: 22 total, 21 pass, 1 fail
Issues: 1 total (1 autofixable, 0 manual, 425 delegated)
Run node build/scripts/cqa/index.js --fix --all to auto-resolve 1 issue.

22 checks: 21 pass, 1 fail

Run node build/scripts/cqa/index.js --all --fix locally to review and auto-fix issues.


Updated 2026-09-02 16:10:54 UTC

Replace bare 'Azure' with {azure-short} attribute throughout all new
modules for brand name consistency. Fix 'using' to 'by using' where
it follows a noun.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…QL assembly

Replace the TIP cross-book link with direct include directives for the
concept and procedure modules. Remove the standalone assembly include
from master.adoc to avoid duplication — the JTBD secure nav retains its
own include path through the standalone assembly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Include the Azure MI assembly (not individual modules) in the
  external PostgreSQL assembly
- Remove standalone assembly include from master.adoc (content flows
  through external PostgreSQL assembly)
- Guard inner assembly parent-context with ifndef to prevent clobbering
  outer assembly's context restoration when nested
- JTBD secure nav includes modules directly to avoid duplicate IDs
  in product_product
- Remove spec.deployment.patch xref (cross-book link not needed)

CQA-02 flags the ifndef guard as non-standard (expects ifdef on line 2).
Build passes: 36/0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sonarqubecloud

sonarqubecloud Bot commented Sep 2, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants