Unable to Create Service Connector Between Azure Function App and MySQL Flexible Server in VNet

Ofek Waiz 0

Hello,

I'm trying to set up a service connector between an Azure Function App and a MySQL Flexible Server, but I’m encountering difficulties because the database server is within a Virtual Network (VNet).

Steps Tried:

Used the Azure CLI command:

bash

az extension add --name serviceconnector-passwordless --upgrade
az functionapp connection create mysql-flexible --connection <connection-name> --source-id <function-app-resource-id> --target-id <mysql-resource-id> --client-type nodejs --system-identity

However, I received this error:

"Service principal 'systemAssignedIdentity' doesn't exist"

Attempted to use a containerized app within the same VNet to execute the CLI command but encountered similar issues.

Tried creating the connector via the Azure Portal, but it reported:

"The database server is in Virtual Network and Cloud Shell can't connect to it."

Question:

How can I connect to the VNet from my local environment or any other environment and execute the Azure CLI command to set up the service connector? Is there an Azure API or a recommended method to achieve this without needing to use a containerized function app?

Any guidance would be greatly appreciated.

Environment Details:

Azure Function App: Non-containerized
MySQL Flexible Server: Within a VNet

Thank you!

1 answer

Pinaki Ghatak 5,230 Reputation points Microsoft Employee

2024-11-27T09:57:31.4333333+00:00

Hello @Ofek Waiz

Firstly, the error message you received indicates that the system-assigned identity for your Function App does not exist.

You can try enabling the system-assigned identity for your Function App by running the following Azure CLI command:

az functionapp identity assign --name --resource-group

Once you have enabled the system-assigned identity for your Function App, you can try creating the service connector again using the Azure CLI command you mentioned earlier. If you are still encountering issues, you can try connecting to the VNet from your local environment using a VPN or ExpressRoute connection.

Once you are connected to the VNet, you should be able to execute the Azure CLI command to create the service connector.

Alternatively, you can try using the Azure Portal to create the service connector. To do this, you will need to create a Virtual Network Service Endpoint for your MySQL Flexible Server and then create the service connector using the Azure Portal.

You can find more information on how to do this in the following article: Create and manage virtual networks for Azure Database for MySQL - Flexible Server using the Azure CLIL.

I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.
Please sign in to rate this answer.
Ofek Waiz 0 Reputation points

2024-11-27T12:50:03.1033333+00:00

Hey @Pinaki Ghatak
Thank you for your response and guidance!

I have already enabled the system-assigned identity for my Function App using the Azure Portal, and I confirmed it is active. I also verified that the Function App and MySQL Flexible Server are within the same Virtual Network.

However, when attempting to create the service connector via the Azure CLI, I still encounter the error: Service principal 'systemAssignedIdentity' doesn't exist.

Could you clarify what could be causing this issue despite the identity being enabled?

Additionally, while I understand connecting via VPN or ExpressRoute to execute commands locally, my preference is to handle everything programmatically or within Azure services. If there’s a way to create the service connector via the Azure SDK or another Azure API, could you please point me to the appropriate resources or examples?

I appreciate your suggestion about using Virtual Network Service Endpoints for the MySQL Flexible Server. Since the database is already in a VNet, do I still need to explicitly configure this, or is it automatically handled in this scenario?

Thanks in advance for your assistance!

Sai Raghunadh M 1,290 Reputation points Microsoft Vendor

2024-11-28T17:22:02.8466667+00:00

Hi @Ofek Waiz

Is your issue resolved?

Sai Raghunadh M 1,290 Reputation points Microsoft Vendor

2024-11-29T10:33:41.2833333+00:00

Hi @Ofek Waiz

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Sai Raghunadh M 1,290 Reputation points Microsoft Vendor

2024-12-02T17:35:57.3066667+00:00

Hi @Ofek Waiz

Thank you for the additional details. Based on the information you've provided, I understand you’ve already enabled the system-assigned identity for your Function App, and it’s within the same VNet as your MySQL Flexible Server.

Here are a few more things to check or try to resolve the issue:

The error you’re seeing, "Service principal 'systemAssignedIdentity' doesn't exist", typically occurs if the Azure CLI is unable to detect the system-assigned identity. Here are additional steps you can try:

Reassign the Identity: Try reassigning the identity using the following CLI command to ensure its linked correctly:

az functionapp identity assign --name <function-app-name> --resource-group <resource-group-name>

Since both the Function App and the MySQL Flexible Server are in the same VNet, it should generally allow connectivity. However, verify that the VNet Integration is configured for the Azure Function App:

In the Azure Portal, go to your Function App, and under Networking, check that VNet Integration is enabled for the correct VNet and subnet.

Since your MySQL Flexible Server is already within the VNet, you do not need to configure Virtual Network Service Endpoints separately unless you’re using a different subnet or there’s specific network isolation in place. However, if you're planning to extend your setup or if there are additional network security concerns, configuring the Service Endpoints may be beneficial for secure access to Azure services within the VNet.

I hope this information helps, please do let us know if you have any Queries.

Ofek Waiz 0 Reputation points

2024-12-03T08:53:39.87+00:00

Hi @Sai Raghunadh M ,

Thank you for your response and suggestions. Here's an update on what I have tried:

Reassigning the Identity: I ran the provided CLI command to reassign the system-assigned identity for my Function App. The command executed successfully, and I received the following response (with sensitive details omitted):
{ "principalId": "<principal-id>", "tenantId": "<tenant-id>", "type": "SystemAssigned, UserAssigned", "userAssignedIdentities": { "/subscriptions/<subscription-id>/resourcegroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name1>": { "clientId": "<client-id>", "principalId": "<principal-id>" }, "/subscriptions/<subscription-id>/resourcegroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name2>": { "clientId": "<client-id>", "principalId": "<principal-id>" } }
Does it confirm that the identity is successfully assigned?

Networking Configuration: I verified that both the Function App and the MySQL Flexible Server are within the same Virtual Network (ofek-function-app-group-vnet). However, they are on different subnets:

MySQL is on the default subnet.

The Function App is on the default3 subnet. Since the subnets are within the same Virtual Network, I believe this should not prevent connectivity.

Despite these steps, I am still encountering the error: "Service principal 'systemAssignedIdentity' doesn't exist."

Could the subnet configuration be affecting the service connector creation? If so, are there additional steps I need to take to ensure communication across subnets, such as explicit route configurations or other VNet-level settings?

Additionally, if there’s another potential root cause for this error, I’d appreciate any further insights or guidance.

Thank you for your support!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to Create Service Connector Between Azure Function App and MySQL Flexible Server in VNet

1 answer

Your answer