feat(mssql): add Azure Workload Identity support by MO2k4 · Pull Request #7673 · kedacore/keda

MO2k4 · 2026-04-21T06:24:52Z

Summary

Add Azure Workload Identity (pod identity) support to the MSSQL scaler, allowing token-based authentication to Azure SQL via azure-workload pod identity provider
Use mssql.NewSecurityTokenConnector with Azure AD token acquisition for Workload Identity connections
Automatically refresh expired Azure access tokens before executing queries
Add nil check on token to prevent panic on first query before token acquisition

Changes

pkg/scalers/mssql_scaler.go: Add Workload Identity auth flow, token refresh logic, and newMSSQLWorkloadIdentityConnection
pkg/scalers/mssql_scaler_test.go: Add test cases for Workload Identity metadata parsing
pkg/scaling/scalers_builder.go: Pass ctx to NewMSSQLScaler
tests/scalers/mssql/azure_mssql_aad_wi/: New e2e test for MSSQL with Azure AD Workload Identity
CHANGELOG.md: Document the new feature

Test plan

Unit tests pass (go test ./pkg/scalers/...)
Unit tests pass with race detector (go test -race ./pkg/scalers/...)
go build ./... succeeds
go vet ./... passes
golangci-lint passes on changed packages
make verify-scalers-schema passes
E2e tests via /run-e2e (requires Azure infrastructure)

github-actions · 2026-04-21T06:25:01Z

Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

snyk-io · 2026-04-21T06:25:15Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

rickbrouwer · 2026-04-21T07:22:19Z

/run-e2e mssql
Update: You can check the progress here

JorTurFer

The envs added with infra's PR are a bit different, I update them

JorTurFer · 2026-04-26T17:02:25Z

/run-e2e mssql
Update: You can check the progress here

JorTurFer · 2026-04-26T17:35:41Z

+	deploymentTemplate = `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: mssql-consumer-worker
+  name: {{.DeploymentName}}
+  namespace: {{.TestNamespace}}
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app: mssql-consumer-worker
+  template:
+    metadata:
+      labels:
+        app: mssql-consumer-worker
+    spec:
+      containers:
+      - image: ghcr.io/kedacore/tests-mssql:latest
+        imagePullPolicy: Always
+        name: mssql-consumer-worker
+        command: ["sleep"]
+        args: ["infinity"]


KEDA¡s code is working, but e2e is failing because this consumer doesn't start. It needs to recieve the connection string via env SQL_CONNECTION_STRING. Please include it to fix the tests 🙏

@JorTurFer thanks for pointing this out, i adapted this.

JorTurFer · 2026-04-27T09:42:35Z

/run-e2e mssql
Update: You can check the progress here

Add Azure AD Workload Identity authentication for the MSSQL scaler, enabling passwordless connections to Azure SQL Database. This mirrors the existing PostgreSQL scaler's workload identity implementation. - Use go-mssqldb's NewSecurityTokenConnector for token-based auth - Add token refresh with automatic reconnection on expiry - Add unit tests for workload identity metadata parsing - Add E2E test for Azure SQL with workload identity Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

Add nil check before accessing token.ExpiresOn to prevent panic on first query when token hasn't been acquired yet. Fix unchecked error return in e2e test cleanup. Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

The Azure MSSQL AAD workload identity e2e test requires TF_AZURE_MSSQL_* secrets that are not yet provisioned in CI. Change from require.NotEmpty (hard fail) to t.Skip so the test is skipped gracefully until infrastructure is ready. Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

Co-authored-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es> Signed-off-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es> Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

JorTurFer

LGTM, just small nitpick inline

Could you open another PR to docs repo documenting this?

JorTurFer · 2026-04-27T19:02:44Z

 ### New

- TODO ([#XXX](https://github.com/kedacore/keda/issues/XXX))
+- **MSSQL Scaler**: Add Azure Workload Identity support for Azure SQL authentication ([#6104](https://github.com/kedacore/keda/issues/6104))


I'd add this as improvement, because it's not new the scaler

Moved the entry

Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

MO2k4 · 2026-04-27T20:32:52Z

LGTM, just small nitpick inline

Could you open another PR to docs repo documenting this?

I've added the documentation, is the version reference correct?

Document the new `azure-workload` pod identity authentication path added by kedacore/keda#7673. The new subsection follows the postgresql scaler's pattern: prerequisites, parameters, remarks, and a complete TriggerAuthentication + ScaledObject example. Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

rickbrouwer · 2026-04-28T16:02:21Z

/run-e2e mssql
Update: You can check the progress here

MO2k4 requested a review from a team as a code owner April 21, 2026 06:24

keda-automation requested a review from a team April 21, 2026 06:25

MO2k4 force-pushed the feature/mssql-workload-identity branch from 758a6c4 to cf6b498 Compare April 21, 2026 06:28

MO2k4 force-pushed the feature/mssql-workload-identity branch from ee575e3 to 5788c60 Compare April 21, 2026 13:11

JorTurFer reviewed Apr 26, 2026

View reviewed changes

keda-automation requested a review from a team April 26, 2026 17:01

JorTurFer reviewed Apr 26, 2026

View reviewed changes

keda-automation requested a review from a team April 27, 2026 09:29

MO2k4 force-pushed the feature/mssql-workload-identity branch from b40ec90 to 0299561 Compare April 27, 2026 09:40

MO2k4 and others added 5 commits April 27, 2026 16:11

Apply suggestions from code review

68ec9cd

Co-authored-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es> Signed-off-by: Jorge Turrado Ferrero <Jorge_turrado@hotmail.es> Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

fix: edit the SQL_CONNECTION_STRING usage

4b5ba8f

Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

MO2k4 force-pushed the feature/mssql-workload-identity branch from 0299561 to 4b5ba8f Compare April 27, 2026 14:12

JorTurFer reviewed Apr 27, 2026

View reviewed changes

chore: adapt changelog to be more precise

792b7dd

Signed-off-by: Martin Oehlert <453360+MO2k4@users.noreply.github.com>

keda-automation requested a review from a team April 27, 2026 20:00

MO2k4 mentioned this pull request Apr 27, 2026

docs(mssql): add Azure AD Workload Identity authentication section kedacore/keda-docs#1753

Open

3 tasks

Conversation

MO2k4 commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

snyk-io Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

rickbrouwer commented Apr 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JorTurFer commented Apr 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

MO2k4 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

JorTurFer commented Apr 27, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer left a comment

Choose a reason for hiding this comment

Uh oh!

JorTurFer Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

MO2k4 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

MO2k4 commented Apr 27, 2026

Uh oh!

rickbrouwer commented Apr 28, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MO2k4 commented Apr 21, 2026 •

edited

Loading

snyk-io Bot commented Apr 21, 2026 •

edited

Loading

rickbrouwer commented Apr 21, 2026 •

edited by github-actions Bot

Loading

JorTurFer commented Apr 26, 2026 •

edited by github-actions Bot

Loading

JorTurFer commented Apr 27, 2026 •

edited by github-actions Bot

Loading

rickbrouwer commented Apr 28, 2026 •

edited by github-actions Bot

Loading