Hashicorp Boundary with Azure SQL Server
Tags: boundary, azure, sqlserver, hashicorp
Published: 2024-03-29 12:10:56

In this post we're going to use Hashicorp Boundary to connect to azure SQL database

## How it works
Its very simple. Client connect to hashicorp boundary cluster which we have in cloud then connection goes through one of your worker nodes and then at the end worker connect to your final target. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ctujwhc4x8wqjgo8p44v.png)

## Pre-Requisites

- Hashicorp Boundary cloud cluster
- Azure Account 
- Sql Server Management Studio installed on your desktop 
- Hahsicorp boundary client 

## Steps

- Create Azure SQL Server 
- Create Azure VNET
- Create SQL Server private endpoint 
- Create Hashicorp Boundary worker node
- Create Hashicorp Boundary target 
- Test from Sql server management studio



**Create Azure SQL Server**

- Open azure portal 
- Search for SQL Server 
- Click on Create 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3e2lr5qcaerzsdnib5ai.png)
 Use SQL Authentication and add username and password, This will be your SQL admin. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hn6yz761opyc2gaph0gh.png)
- In Networking, Please don't use allow azure services to access this server 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1eitf769vmu4guonq9st.png)
- Keep rest of options as default and then review and create 

**Create Azure VNET**
Now after SQL Server creation we need to create Azure virtual network, so as we mentioned worker node can communicate with this database through this network.

- Open Azure VNET
- Just add name of vnet and the only thing you need to be aware of is address space which we will leave by default to 10.0.0.0/16
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mvr5p37icqaawi3z221v.png)


**Create SQL Server private endpoint**
Now we have created SQL Server and This is now still not accessible we need to confirm that public access is disabled and create private endpoint to be able to access this server on this private link. 

- Open created database server 
- Go to "Show Networking Settings"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ltp0w5nf5ro6i9dh7l43.png)
- Confirm that public access is disabled 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yghve51j3w35k7e8vwbt.png)
- Go to private Access and choose create private endpoint 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ieirce6ll6wm9lfj73vf.png)
- Add details to basics 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z54oiwmf4tneom9ppl9f.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pufontabw3j8580nix6w.png)

- Choose vnet which we created recently 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oafra2rfwan36cqyvp83.png)
- This is one of the most important steps is to integrate with private DNS Zone, Just leave it as default since we don't have created DNS Zone before. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rnddxblia9u6tbbu5t8p.png)
- Just review and create

After getting this created you will have vnet , SQL Server and private endpoint linked to this Server, The next step is to create a server which can connect to SQL Server. To do this we will need to create it part of created vnet. 

**Create Hashicorp Boundary worker node**
Now we need to create worker node which our cloud instance will communicate with in order to reach target database. In order to do this .. you just need to install boundary worker and start it but you will need also to have this worker node with public IP and whitelist its port to make it reachable by boundary cloud cluster. 

- Go to create vm , its better for testing purpose to make it with small size , The most important thing is to create it inside our recently created vnet. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lz3uzhsc4989ennppd7f.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dxkkqwaf90fw4u61ivig.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09u0u4lktzgymocv6ij3.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vyymlvhh490zrd79qwv5.png)

- After filling all details .. review and create 

- Now VM is created and we need to access it and confirm it can reach database without any issue, So we need to install SQL Server CLI in order to test with it
- You need also to Allow port 9202 which will be worker service port which boundary cluster will connect to worker through it. 

- Run the below code in order to confirm that you can connect to Created azure SQL database from this node. 

```
## nc database instance to confirm its port is reachable 
nc -zv  boundary-test-database.database.windows.net 1433
## This one should work if it didn't work please check previous steps or comment on the post 
## Please follow this post in order to install your CLI tools. In this post we will install on ubuntu 
curl https://packages.microsoft.com/keys/microsoft.asc | sudo tee /etc/apt/trusted.gpg.d/microsoft.asc
curl https://packages.microsoft.com/config/ubuntu/20.04/prod.list | sudo tee /etc/apt/sources.list.d/mssql-release.list
sudo apt-get update
sudo apt-get install mssql-tools18 unixodbc-dev -y 
echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bash_profile
echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bashrc
source ~/.bashrc
sqlcmd -S boundary-test-database.database.windows.net  -d master -U boundary -P "<put your created password>" -Q "SELECT COUNT(*)  FROM INFORMATION_SCHEMA.TABLES "
## This should return an output from database if it didn't, Please check above steps
```
- Now if the above commands worked fine, You will need to install worker software 
- Go to hashicorp boundary and choose open admin UI
  
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bj58xsxeogs8pzt6daso.png)
- After providing login details, Go to workers Then click on new 
- You need to add 
  - Public IP 
  - Config file path 
  - tags 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5gokxt8sbsrybzybs1jk.png)
- This will give you steps you need to do 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gxvph8agwr5cx4byad2k.png)

- Execute these steps on worker node

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ekymyaclg9534o38aop6.png)
- In my case I got this error , but fixed it with sudo ./boundary instead of ./boundary

```
Error initializing worker: Failed to lock memory: cannot allocate memory

This usually means that the mlock syscall is not available.
Boundary uses mlock to prevent memory from being swapped to
disk. This requires root privileges as well as a machine
that supports mlock. Please enable mlock on your system or
disable Boundary from using it. To disable Boundary from using it,
set the `disable_mlock` configuration option in your configuration
file.
```
- Boundary worker will start with a token and you will need to add it to New worker page in hashicorp boundary cloud cluster 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xy2yzkyrr8ujs5zsvyvf.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fg7wowdvlkdc8y65iy1a.png)
- You should see this 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2jk48ht3pbfegs2xqw7r.png)
- You will be able to see new worker part of your current workers 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nypakr5cnua71wzfrupn.png)


**Create Hashicorp Boundary target**
This is the last step is to create your database target 
- Go to targets , click on "New Target"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7fpsb0rtz1s47zsxpiex.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7b72g0tulxsu62fi5105.png)
- Choose name for the target
- Target Address ==> "boundary-test-database.database.windows.net"
- Default port and client port ==> 1433 
- ingress filter ==> "boundary" in "/tags/name" 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t21x4mj4xlqw0jq0kq4j.png)



Now we have created target the last step is to test target 

- Open boundary client and authenticate 
- You should see now the target which you created 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qptij99mxjtvy8x8fk92.png)
- Add to your hosts file this line 
127.0.0.1 boundary-test-database.database.windows.net
- 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yr0iz90tlxlymuj8iw76.png)