Configure Azure passwordless authentication using Azure PostgreSQL as the Metastore

• Configure your Azure database for PostgreSQL to enable passwordless authentication.
• Export the environment variable SPRING_PROFILES_ACTIVE=AZURE_ENV in the owl-env.sh file.

• Configure your Azure database for PostgreSQL to enable passwordless authentication.
• Pass the following Helm Chart variables:
Copy

--set global.configMap.data.active_profile={AZURE_ENV} \
--set global.serviceAccount.annotations."azure\.workload\.identity/client-id"=<client-id> \

There are 3 methods you can use to authenticate Azure databases.

• Environmental credentials
• Managed identity credentials
• Azure CLI credentials

Environmental credentials

This method checks for credentials provided through environment variables. Export the following environment variables in the owl-env.sh file to enable this authentication method.

Variable	Description
AZURE_TENANT_ID	The Microsoft Entra tenant (directory) ID.
AZURE_CLIENT_ID	The client (application) ID of an App Registration in the tenant.
AZURE_CLIENT_SECRET	A client secret that was generated for the App Registration.

Managed identity credentials

Additional setup is not required to enable managed identity. For more information, see the official Azure documentation to configure managed identities to enable authentication for PostgreSQL Metastores .

Azure CLI credentials

Note While this authentication method is supported, we recommend the environmental credentials or managed identity credentials options instead.

This method requires the Azure CLI to be enabled on the Azure virtual machine and the principal authenticated with the PostgreSQL database. When this is set up, Collibra Data Quality & Observability executes the az account get-access-token --output json to retrieve the token to authenticate with PostgreSQL.

Workload identity credentials

1. Enable the Azure cluster for workload identity.
Copy

az aks update --resource-group "${RESOURCE_GROUP}" --name "${CLUSTER_NAME}" --enable-oidc-issuer --enable-workload-identity

2. Enable federation for the Spark service account used by Collibra Data Quality & Observability.
Copy

az identity federated-credential create --name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" --issuer "${AKS_OIDC_ISSUER}" --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" --audience api://AzureADTokenExchange

3. Deploy Collibra Data Quality & Observability with the following Helm variables where managed-identity-id is the name of the managed identity and client-id is the client ID of the managed identity.
Copy

--set global.configMap.data.metastore_user=<managed-identity-id> \
--set global.configMap.data.metastore_pass=blank \
--set global.configMap.data.active_profile={AZURE_ENV} \
--set global.serviceAccount.annotations."azure\.workload\.identity/client-id"=<client-id> \

4. Mount the Spark driver and executor pod templates with metadata enabled.

Copy

apiVersion: v1
Kind: Pod
metadata:
  labels:
    azure.workload.identity/use: "true"
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000

5. Add the following to the Freeform (Appended) field on the Agent Configuration template to use the custom executor and driver pod templates.

Copy

-conf spark.kubernetes.driver.podTemplateFile=local:///opt/owl/config/k8s-driver-template.yml,spark.kubernetes.executor.podTemplateFile=local:///opt/owl/config/k8s-executor-template.yml

For more information about configuring your Azure cluster with workload identity, see the official Azure documentation .