Hi all, We are using SAS Viya and following the stable release process and currently looking into deploy SAS Viya 2025.10 in December. The whole setup is on Microsoft Azure and we are using Azure Database for PostgreSQL – Flexible Server as our main database for SAS Viya. We would really like to request that the DataServer Custom Resource be enhanced to support Microsoft Entra ID (Azure AD) token-based authentication as a built-in alternative to using Kubernetes Secrets with static passwords. Summary: We need the DataServer to be able to authenticate using Microsoft Entra access tokens obtained securely at runtime, ideally using Azure Workload Identity (federated OIDC), without relying on any long-lived credentials. The access token should be refreshed automatically before it expires and exposed to dependent workloads in the same way as the current mechanism (for example via environment variables or temporary files). Problem: Today, the DataServer requires credentials to be provided via Kubernetes Secrets, which means a long-lived username and password must be stored in the cluster. This is no longer acceptable in environments that follow zero-trust or passwordless authentication standards. Azure Database for PostgreSQL Flexible Server supports Azure AD authentication using short-lived access tokens instead of static passwords, and our organization is required to use this method. In practical terms, we are asking for a native input mode, such as “azureAdToken” or “workloadIdentity”, instead of only supporting static Secret-based credentials. This would eliminate the need for manual credential rotation, align with Azure’s passwordless identity approach, and meet our mandatory security and compliance requirements. This feature is important as the current static credential approach will soon become a blocker for production deployment in regulated enterprise environments. I hope this makes sense and I do know that is a big ask, but this would be a really important feature for us and many other organizations that are moving towards zero-trust and passwordless authentication models. Regards and thanks
... View more