Nano-Core · vivet · Sep 2, 2026 · Aug 29, 2026 · Aug 29, 2026 · Aug 31, 2026
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
@@ -7,7 +7,7 @@ on:
     branches:
       - master 
 env:
-  VERSION: 10.0.3
+  VERSION: 10.0.4
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest

diff --git a/Api.Data.Audit/.github/workflows/build-and-deploy.yml b/Api.Data.Audit/.github/workflows/build-and-deploy.yml
@@ -37,10 +37,8 @@ env:
   KUBERNETES_CPU_LIMIT: 600m
   KUBERNETES_CPU_SCALING: 180
   ASPNETCORE_ENVIRONMENT: ${{ github.ref == 'refs/heads/main' && 'Production' || 'Staging' }}
+  SQL_AUTH_TYPE: Azure
   SQL_NAME: nanoDb
-  SQL_USER: api-data-mysql-user
-  SQL_PASSWORD: ${{ github.ref == 'refs/heads/main' && secrets.PRODUCTION_SQL_NANO_DB_PASSWORD || secrets.STAGING_SQL_NANO_DB_PASSWORD }}
-  SQL_ADMIN_PASSWORD: ${{ github.ref == 'refs/heads/main' && secrets.PRODUCTION_SQL_ADMIN_PASSWORD || secrets.STAGING_SQL_ADMIN_PASSWORD }}
 concurrency:
   group: ${{ github.workflow }}-${{ github.repository }}
   cancel-in-progress: true
@@ -124,59 +122,96 @@ jobs:
 
           echo "CONTAINER_REGISTRY_HOST=$env:CONTAINER_REGISTRY_HOST" >> $env:GITHUB_ENV;
 
-      - name: Database Migration & User
+      - name: Managed Identity
+        shell: pwsh
+        run: |
+          $env:IDENTITY_NAME = $env:SERVICE_NAME + "-identity";
+          $env:IDENTITY_PRINCIPAL_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query principalId -o tsv;
+          $env:KUBERNETES_ISSUER_URL = az aks list -g $env:AZURE_GROUP_KUBERNETES --query [0].['oidcIssuerProfile.issuerUrl'] -o tsv;
+
+          if (-not $env:IDENTITY_PRINCIPAL_ID)
+          {
+              az identity create `
+                  -g $env:AZURE_GROUP_KUBERNETES `
+                  -n $env:IDENTITY_NAME;
+
+              if ($LastExitCode -ne 0)
+              {
+                  throw "error";
+              };
+
+              $env:IDENTITY_PRINCIPAL_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query principalId -o tsv;
+          }
+
+          $env:IDENTITY_CLIENT_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query clientId -o tsv;
+
+          az identity federated-credential create `
+              --name $env:SERVICE_NAME-credentials `
+              --resource-group $env:AZURE_GROUP_KUBERNETES `
+              --identity-name $env:IDENTITY_NAME `
+              --issuer $env:KUBERNETES_ISSUER_URL `
+              --subject "system:serviceaccount:${env:KUBERNETES_NAMESPACE}:${env:SERVICE_NAME}-service-account" `
+              --audience api://AzureADTokenExchange;
+
+          if ($LastExitCode -ne 0)
+          {
+              throw "error";
+          };
+
+          echo "IDENTITY_NAME=$env:IDENTITY_NAME" >> $env:GITHUB_ENV;
+          echo "IDENTITY_CLIENT_ID=$env:IDENTITY_CLIENT_ID" >> $env:GITHUB_ENV; 
+          echo "IDENTITY_PRINCIPAL_ID=$env:IDENTITY_PRINCIPAL_ID" >> $env:GITHUB_ENV; 
+
+      - name: MySQL Database Migration
         shell: pwsh
         run: |
           $env:SQL_HOST = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].fullyQualifiedDomainName -o tsv;
           $env:SQL_PORT = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].databasePort -o tsv;
-          $env:SQL_ADMIN_USER = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].administratorLogin -o tsv;
+          $env:SQL_SERVER = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].name -o tsv;
+          $env:SQL_USER = az mysql flexible-server ad-admin list -g $env:AZURE_GROUP_DATABASE -s $env:SQL_SERVER --query "[0].login" -o tsv;
+          $env:SQL_TOKEN = az account get-access-token --resource-type oss-rdbms --query accessToken -o tsv;
 
-          $env:DATA__CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_ADMIN_USER;Pwd=$env:SQL_ADMIN_PASSWORD;SslMode=Required";
+          $env:DATA__CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_USER;Pwd=$env:SQL_TOKEN;SslMode=Required";
 
           & "/opt/ef-tools/$env:DOTNET_EF_TOOLS_VERSION/dotnet-ef" database update `
-            --no-build `
-            --configuration Release `
-            --startup-project $env:APP_NAME `
-            -- `
-            --environment $env:ASPNETCORE_ENVIRONMENT;
+              --no-build `
+              --configuration Release `
+              --startup-project $env:APP_NAME `
+              -- `
+              --environment $env:ASPNETCORE_ENVIRONMENT;
 
           if ($LastExitCode -ne 0)
           { 
               throw "error";
           };
-
-          $env:MYSQL_PWD = $env:SQL_ADMIN_PASSWORD
 
-          $userExists = mysql `
-              --host $env:SQL_HOST `
-              --port $env:SQL_PORT `
-              --user $env:SQL_ADMIN_USER `
-              --ssl-mode=REQUIRED `
-              -e "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = '$env:SQL_USER');";
+          $env:APP_USER_SQL_PATH = "app-database-user.sql";
 
-          if ($userExists -eq 0) 
-          {
-             mysql `
-                 --host $env:SQL_HOST `
-                 --port $env:SQL_PORT `
-                 --user $env:SQL_ADMIN_USER `
-                 --ssl-mode=REQUIRED `
-                 -e "CREATE USER '$env:SQL_USER'@'%' IDENTIFIED BY '$env:SQL_PASSWORD'; GRANT SELECT, INSERT, UPDATE, DELETE ON $env:SQL_NAME.* TO '$env:SQL_USER'@'%'; FLUSH PRIVILEGES;";
+          $sql = @"
+            CREATE AADUSER IF NOT EXISTS '$env:IDENTITY_NAME' IDENTIFIED BY '$env:IDENTITY_CLIENT_ID';
+            GRANT SELECT, INSERT, UPDATE, DELETE ON $env:SQL_NAME.* TO '$env:IDENTITY_NAME'@'%';
+            FLUSH PRIVILEGES;
+          "@;
 
-              if ($LastExitCode -ne 0)
-              { 
-                  throw "error";
-              };
-          }
+          $sql | Set-Content $env:APP_USER_SQL_PATH;
+
+          az mysql flexible-server execute `
+              -n $env:SQL_SERVER `
+              -u $env:SQL_USER `
+              -p $env:SQL_TOKEN `
+              --file-path $env:APP_USER_SQL_PATH;
+
+          if ($LastExitCode -ne 0)
+          {
+              throw "error";
+          };
 
-          echo "SQL_HOST=$env:SQL_HOST" >> $env:GITHUB_ENV;
-          echo "SQL_PORT=$env:SQL_PORT" >> $env:GITHUB_ENV;
+          $env:SQL_CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:IDENTITY_NAME;SslMode=Required";
+          echo "SQL_CONNECTIONSTRING=$env:SQL_CONNECTIONSTRING" >> $env:GITHUB_ENV;
 
       - name: Kubernetes Deploy
         shell: pwsh
         run: |
-          $env:SQL_CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_USER;Pwd=$env:SQL_PASSWORD;SslMode=Required";
-
           Get-Content .kubernetes/auth-sql-secret.yaml | foreach { [Environment]::ExpandEnvironmentVariables($_) } | Set-Content .kubernetes/auth-sql-secret.tmp.yaml;
           kubectl apply -f .kubernetes/auth-sql-secret.tmp.yaml;
           if ($LastExitCode -ne 0)

diff --git a/Api.Data.Audit/.kubernetes/configmap.yaml b/Api.Data.Audit/.kubernetes/configmap.yaml
@@ -5,4 +5,5 @@ metadata:
   namespace: %KUBERNETES_NAMESPACE%
 data:
   App__Version: %VERSION%
+  Data__AuthenticationType: %SQL_AUTH_TYPE%
   ASPNETCORE_ENVIRONMENT: %ASPNETCORE_ENVIRONMENT%
diff --git a/Api.Data.EntityEvents/.github/workflows/build-and-deploy.yml b/Api.Data.EntityEvents/.github/workflows/build-and-deploy.yml
@@ -37,10 +37,8 @@ env:
   KUBERNETES_CPU_LIMIT: 600m
   KUBERNETES_CPU_SCALING: 180
   ASPNETCORE_ENVIRONMENT: ${{ github.ref == 'refs/heads/main' && 'Production' || 'Staging' }}
+  SQL_AUTH_TYPE: Azure
   SQL_NAME: nanoDb
-  SQL_USER: api-data-mysql-user
-  SQL_PASSWORD: ${{ github.ref == 'refs/heads/main' && secrets.PRODUCTION_SQL_NANO_DB_PASSWORD || secrets.STAGING_SQL_NANO_DB_PASSWORD }}
-  SQL_ADMIN_PASSWORD: ${{ github.ref == 'refs/heads/main' && secrets.PRODUCTION_SQL_ADMIN_PASSWORD || secrets.STAGING_SQL_ADMIN_PASSWORD }}
 concurrency:
   group: ${{ github.workflow }}-${{ github.repository }}
   cancel-in-progress: true
@@ -124,59 +122,96 @@ jobs:
 
           echo "CONTAINER_REGISTRY_HOST=$env:CONTAINER_REGISTRY_HOST" >> $env:GITHUB_ENV;
 
-      - name: Database Migration & User
+      - name: Managed Identity
+        shell: pwsh
+        run: |
+          $env:IDENTITY_NAME = $env:SERVICE_NAME + "-identity";
+          $env:IDENTITY_PRINCIPAL_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query principalId -o tsv;
+          $env:KUBERNETES_ISSUER_URL = az aks list -g $env:AZURE_GROUP_KUBERNETES --query [0].['oidcIssuerProfile.issuerUrl'] -o tsv;
+
+          if (-not $env:IDENTITY_PRINCIPAL_ID)
+          {
+              az identity create `
+                  -g $env:AZURE_GROUP_KUBERNETES `
+                  -n $env:IDENTITY_NAME;
+
+              if ($LastExitCode -ne 0)
+              {
+                  throw "error";
+              };
+
+              $env:IDENTITY_PRINCIPAL_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query principalId -o tsv;
+          }
+
+          $env:IDENTITY_CLIENT_ID = az identity show -g $env:AZURE_GROUP_KUBERNETES -n $env:IDENTITY_NAME --query clientId -o tsv;
+
+          az identity federated-credential create `
+              --name $env:SERVICE_NAME-credentials `
+              --resource-group $env:AZURE_GROUP_KUBERNETES `
+              --identity-name $env:IDENTITY_NAME `
+              --issuer $env:KUBERNETES_ISSUER_URL `
+              --subject "system:serviceaccount:${env:KUBERNETES_NAMESPACE}:${env:SERVICE_NAME}-service-account" `
+              --audience api://AzureADTokenExchange;
+
+          if ($LastExitCode -ne 0)
+          {
+              throw "error";
+          };
+
+          echo "IDENTITY_NAME=$env:IDENTITY_NAME" >> $env:GITHUB_ENV;
+          echo "IDENTITY_CLIENT_ID=$env:IDENTITY_CLIENT_ID" >> $env:GITHUB_ENV; 
+          echo "IDENTITY_PRINCIPAL_ID=$env:IDENTITY_PRINCIPAL_ID" >> $env:GITHUB_ENV; 
+
+      - name: MySQL Database Migration
         shell: pwsh
         run: |
           $env:SQL_HOST = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].fullyQualifiedDomainName -o tsv;
           $env:SQL_PORT = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].databasePort -o tsv;
-          $env:SQL_ADMIN_USER = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].administratorLogin -o tsv;
+          $env:SQL_SERVER = az mysql flexible-server list -g $env:AZURE_GROUP_DATABASE --query [0].name -o tsv;
+          $env:SQL_USER = az mysql flexible-server ad-admin list -g $env:AZURE_GROUP_DATABASE -s $env:SQL_SERVER --query "[0].login" -o tsv;
+          $env:SQL_TOKEN = az account get-access-token --resource-type oss-rdbms --query accessToken -o tsv;
 
-          $env:DATA__CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_ADMIN_USER;Pwd=$env:SQL_ADMIN_PASSWORD;SslMode=Required";
+          $env:DATA__CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_USER;Pwd=$env:SQL_TOKEN;SslMode=Required";
 
           & "/opt/ef-tools/$env:DOTNET_EF_TOOLS_VERSION/dotnet-ef" database update `
-            --no-build `
-            --configuration Release `
-            --startup-project $env:APP_NAME `
-            -- `
-            --environment $env:ASPNETCORE_ENVIRONMENT;
+              --no-build `
+              --configuration Release `
+              --startup-project $env:APP_NAME `
+              -- `
+              --environment $env:ASPNETCORE_ENVIRONMENT;
 
           if ($LastExitCode -ne 0)
           { 
               throw "error";
           };
-
-          $env:MYSQL_PWD = $env:SQL_ADMIN_PASSWORD
 
-          $userExists = mysql `
-              --host $env:SQL_HOST `
-              --port $env:SQL_PORT `
-              --user $env:SQL_ADMIN_USER `
-              --ssl-mode=REQUIRED `
-              -e "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = '$env:SQL_USER');";
+          $env:APP_USER_SQL_PATH = "app-database-user.sql";
 
-          if ($userExists -eq 0) 
-          {
-             mysql `
-                 --host $env:SQL_HOST `
-                 --port $env:SQL_PORT `
-                 --user $env:SQL_ADMIN_USER `
-                 --ssl-mode=REQUIRED `
-                 -e "CREATE USER '$env:SQL_USER'@'%' IDENTIFIED BY '$env:SQL_PASSWORD'; GRANT SELECT, INSERT, UPDATE, DELETE ON $env:SQL_NAME.* TO '$env:SQL_USER'@'%'; FLUSH PRIVILEGES;";
+          $sql = @"
+            CREATE AADUSER IF NOT EXISTS '$env:IDENTITY_NAME' IDENTIFIED BY '$env:IDENTITY_CLIENT_ID';
+            GRANT SELECT, INSERT, UPDATE, DELETE ON $env:SQL_NAME.* TO '$env:IDENTITY_NAME'@'%';
+            FLUSH PRIVILEGES;
+          "@;
 
-              if ($LastExitCode -ne 0)
-              { 
-                  throw "error";
-              };
-          }
+          $sql | Set-Content $env:APP_USER_SQL_PATH;
+
+          az mysql flexible-server execute `
+              -n $env:SQL_SERVER `
+              -u $env:SQL_USER `
+              -p $env:SQL_TOKEN `
+              --file-path $env:APP_USER_SQL_PATH;
+
+          if ($LastExitCode -ne 0)
+          {
+              throw "error";
+          };
 
-          echo "SQL_HOST=$env:SQL_HOST" >> $env:GITHUB_ENV;
-          echo "SQL_PORT=$env:SQL_PORT" >> $env:GITHUB_ENV;
+          $env:SQL_CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:IDENTITY_NAME;SslMode=Required";
+          echo "SQL_CONNECTIONSTRING=$env:SQL_CONNECTIONSTRING" >> $env:GITHUB_ENV;
 
       - name: Kubernetes Deploy
         shell: pwsh
         run: |
-          $env:SQL_CONNECTIONSTRING = "Server=$env:SQL_HOST;Port=$env:SQL_PORT;Database=$env:SQL_NAME;Uid=$env:SQL_USER;Pwd=$env:SQL_PASSWORD;SslMode=Required";
-
           Get-Content .kubernetes/auth-sql-secret.yaml | foreach { [Environment]::ExpandEnvironmentVariables($_) } | Set-Content .kubernetes/auth-sql-secret.tmp.yaml;
           kubectl apply -f .kubernetes/auth-sql-secret.tmp.yaml;
           if ($LastExitCode -ne 0)

diff --git a/Api.Data.EntityEvents/.kubernetes/configmap.yaml b/Api.Data.EntityEvents/.kubernetes/configmap.yaml
@@ -5,4 +5,5 @@ metadata:
   namespace: %KUBERNETES_NAMESPACE%
 data:
   App__Version: %VERSION%
+  Data__AuthenticationType: %SQL_AUTH_TYPE%
   ASPNETCORE_ENVIRONMENT: %ASPNETCORE_ENVIRONMENT%