Azure sql CLI issue with Certificate

[ImtiazSiddiqui]

Azure az sql cli (specifically az sql mi-arc) commands fail even if CA Cert data is provided in the kubeconfig file, it seems az sql cli ignores this CA Certs data in kubeconfig file.

Below is one of the commands that works with 'in-secure' mode, but does not work with strict HTTPS mode
'az sql mi-arc list --k8s-namespace platform-azure-arc --use-k8s -o table'

Other az sql mi-arc create -n flab90sqlmi2 --use-k8s --k8s-namespace platform-azure-arc –debug also fails. I am attaching Debug output file for troubleshooting the issue.

Additional Details:
We were thinking the Azure control plane is being blocked by corporate proxy so Customer tried bypassing the corporate proxy by setting these variables AZURE_CLI_DISABLE_CONNECTION_VERIFICATION and REQUESTS_CA_BUNDLE but it didn't help here.

Attaching debug file here. I engaged Azure Arc for Data Services PG, but couldnt nail down the issue.

debug.txt

[yonzhan]

route to CXP team

[evelyn-ys]

SQL module in Azure CLI doesn't have az sql mi-arc command. Is it from service CLI not Azure CLI?

[dnethi]

hi @evelyn-ys mi-arc is under az > sql > mi-arc. Not sure what you mean by service CLI ..

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @azureSQLGitHub.

Issue Details

---

Azure az sql cli (specifically az sql mi-arc) commands fail even if CA Cert data is provided in the kubeconfig file, it seems az sql cli ignores this CA Certs data in kubeconfig file.

Below is one of the commands that works with 'in-secure' mode, but does not work with strict HTTPS mode
'az sql mi-arc list --k8s-namespace platform-azure-arc --use-k8s -o table'

Other az sql mi-arc create -n flab90sqlmi2 --use-k8s --k8s-namespace platform-azure-arc –debug also fails. I am attaching Debug output file for troubleshooting the issue.

Additional Details:
We were thinking the Azure control plane is being blocked by corporate proxy so Customer tried bypassing the corporate proxy by setting these variables AZURE_CLI_DISABLE_CONNECTION_VERIFICATION and REQUESTS_CA_BUNDLE but it didn't help here.

Attaching debug file here. I engaged Azure Arc for Data Services PG, but couldnt nail down the issue.

debug.txt

Author:	ImtiazSiddiqui
Assignees:	-
Labels:	SQL, Service Attention, Auto-Assign
Milestone:	-

[YurongHe]

@ImtiazSiddiqui,
I have some questions:

1. Look like your datacontroller is indirect mode, right?
2. Is kubectl cmd working on the same client machine?
3. Have to set NO_PROXY=<> on your client machine? if not, could you follow the steps in this link: https://docs.microsoft.com/en-us/azure/azure-arc/kubernetes/quickstart-connect-cluster?tabs=azure-cli#connect-using-an-outbound-proxy-server could help.