feat(mssql): add Azure Workload Identity support by MO2k4 · Pull Request #7673 · kedacore/keda

MO2k4 · 2026-04-21T06:24:52Z

Summary

Add Azure Workload Identity (pod identity) support to the MSSQL scaler, allowing token-based authentication to Azure SQL via azure-workload pod identity provider
Use mssql.NewSecurityTokenConnector with Azure AD token acquisition for Workload Identity connections
Automatically refresh expired Azure access tokens before executing queries
Add nil check on token to prevent panic on first query before token acquisition

Changes

pkg/scalers/mssql_scaler.go: Add Workload Identity auth flow, token refresh logic, and newMSSQLWorkloadIdentityConnection
pkg/scalers/mssql_scaler_test.go: Add test cases for Workload Identity metadata parsing
pkg/scaling/scalers_builder.go: Pass ctx to NewMSSQLScaler
tests/scalers/mssql/azure_mssql_aad_wi/: New e2e test for MSSQL with Azure AD Workload Identity
CHANGELOG.md: Document the new feature

Test plan

Unit tests pass (go test ./pkg/scalers/...)
Unit tests pass with race detector (go test -race ./pkg/scalers/...)
go build ./... succeeds
go vet ./... passes
golangci-lint passes on changed packages
make verify-scalers-schema passes
E2e tests via /run-e2e (requires Azure infrastructure)

Fixes: #6104
Docs: kedacore/keda-docs#1753

github-actions · 2026-04-21T06:25:01Z

Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

snyk-io · 2026-04-21T06:25:15Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

rickbrouwer · 2026-04-21T07:22:19Z

/run-e2e mssql
Update: You can check the progress here

JorTurFer

The envs added with infra's PR are a bit different, I update them

JorTurFer · 2026-04-26T17:02:25Z

/run-e2e mssql
Update: You can check the progress here

JorTurFer · 2026-04-27T09:42:35Z

/run-e2e mssql
Update: You can check the progress here

Add Azure AD Workload Identity authentication for the MSSQL scaler, enabling passwordless connections to Azure SQL Database. This mirrors the existing PostgreSQL scaler's workload identity implementation. - Use go-mssqldb's NewSecurityTokenConnector for token-based auth - Add token refresh with automatic reconnection on expiry - Add unit tests for workload identity metadata parsing - Add E2E test for Azure SQL with workload identity Signed-off-by: Martin Oehlert <[email protected]>

Add nil check before accessing token.ExpiresOn to prevent panic on first query when token hasn't been acquired yet. Fix unchecked error return in e2e test cleanup. Signed-off-by: Martin Oehlert <[email protected]>

The Azure MSSQL AAD workload identity e2e test requires TF_AZURE_MSSQL_* secrets that are not yet provisioned in CI. Change from require.NotEmpty (hard fail) to t.Skip so the test is skipped gracefully until infrastructure is ready. Signed-off-by: Martin Oehlert <[email protected]>

Co-authored-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Martin Oehlert <[email protected]>

Signed-off-by: Martin Oehlert <[email protected]>

JorTurFer

LGTM, just small nitpick inline

Could you open another PR to docs repo documenting this?

Signed-off-by: Martin Oehlert <[email protected]>

MO2k4 · 2026-04-27T20:32:52Z

LGTM, just small nitpick inline

Could you open another PR to docs repo documenting this?

I've added the documentation, is the version reference correct?

Document the new `azure-workload` pod identity authentication path added by kedacore/keda#7673. The new subsection follows the postgresql scaler's pattern: prerequisites, parameters, remarks, and a complete TriggerAuthentication + ScaledObject example. Signed-off-by: Martin Oehlert <[email protected]>

rickbrouwer · 2026-04-28T16:02:21Z

/run-e2e mssql
Update: You can check the progress here

rickbrouwer · 2026-04-30T17:46:21Z

/run-e2e mssql*|azure*
Update: You can check the progress here

…1753) * docs(mssql): add Azure AD Workload Identity authentication section Document the new `azure-workload` pod identity authentication path added by kedacore/keda#7673. The new subsection follows the postgresql scaler's pattern: prerequisites, parameters, remarks, and a complete TriggerAuthentication + ScaledObject example. Signed-off-by: Martin Oehlert <[email protected]> * Update content/docs/2.20/scalers/mssql.md Signed-off-by: Jorge Turrado Ferrero <[email protected]> --------- Signed-off-by: Martin Oehlert <[email protected]> Signed-off-by: Jorge Turrado Ferrero <[email protected]> Co-authored-by: Martin Oehlert <[email protected]> Co-authored-by: Jorge Turrado Ferrero <[email protected]>

MO2k4 requested a review from a team as a code owner April 21, 2026 06:24

keda-automation requested a review from a team April 21, 2026 06:25

MO2k4 force-pushed the feature/mssql-workload-identity branch from 758a6c4 to cf6b498 Compare April 21, 2026 06:28

MO2k4 force-pushed the feature/mssql-workload-identity branch from ee575e3 to 5788c60 Compare April 21, 2026 13:11

JorTurFer reviewed Apr 26, 2026

View reviewed changes

keda-automation requested a review from a team April 26, 2026 17:01

JorTurFer reviewed Apr 26, 2026

View reviewed changes

Comment thread tests/scalers/mssql/azure_mssql_aad_wi/azure_mssql_aad_wi_test.go Outdated

keda-automation requested a review from a team April 27, 2026 09:29

MO2k4 force-pushed the feature/mssql-workload-identity branch from b40ec90 to 0299561 Compare April 27, 2026 09:40

MO2k4 and others added 5 commits April 27, 2026 16:11

fix(mssql): add nil check for token expiry and fix lint errors

6a52467

Add nil check before accessing token.ExpiresOn to prevent panic on first query when token hasn't been acquired yet. Fix unchecked error return in e2e test cleanup. Signed-off-by: Martin Oehlert <[email protected]>

Apply suggestions from code review

68ec9cd

Co-authored-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Martin Oehlert <[email protected]>

fix: edit the SQL_CONNECTION_STRING usage

4b5ba8f

Signed-off-by: Martin Oehlert <[email protected]>

MO2k4 force-pushed the feature/mssql-workload-identity branch from 0299561 to 4b5ba8f Compare April 27, 2026 14:12

JorTurFer reviewed Apr 27, 2026

View reviewed changes

Comment thread CHANGELOG.md Outdated

chore: adapt changelog to be more precise

792b7dd

Signed-off-by: Martin Oehlert <[email protected]>

keda-automation requested a review from a team April 27, 2026 20:00

MO2k4 mentioned this pull request Apr 27, 2026

docs(mssql): add Azure AD Workload Identity authentication section kedacore/keda-docs#1753

Merged

3 tasks

rickbrouwer approved these changes Apr 30, 2026

View reviewed changes

rickbrouwer added the Awaiting/2nd-approval This PR needs one more approval review label Apr 30, 2026

JorTurFer approved these changes May 3, 2026

View reviewed changes

JorTurFer merged commit 814beb8 into kedacore:main May 3, 2026
26 checks passed

MO2k4 deleted the feature/mssql-workload-identity branch May 3, 2026 17:20

rickbrouwer removed the Awaiting/2nd-approval This PR needs one more approval review label May 6, 2026

Uh oh!

Conversation

MO2k4 commented Apr 21, 2026 • edited by rickbrouwer Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

snyk-io Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

rickbrouwer commented Apr 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JorTurFer commented Apr 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

JorTurFer commented Apr 27, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JorTurFer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MO2k4 commented Apr 27, 2026

Uh oh!

rickbrouwer commented Apr 28, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rickbrouwer commented Apr 30, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MO2k4 commented Apr 21, 2026 •

edited by rickbrouwer

Loading

snyk-io Bot commented Apr 21, 2026 •

edited

Loading

rickbrouwer commented Apr 21, 2026 •

edited by github-actions Bot

Loading

JorTurFer commented Apr 26, 2026 •

edited by github-actions Bot

Loading

JorTurFer commented Apr 27, 2026 •

edited by github-actions Bot

Loading

rickbrouwer commented Apr 28, 2026 •

edited by github-actions Bot

Loading

rickbrouwer commented Apr 30, 2026 •

edited by github-actions Bot

Loading