<p>I am experimenting in a small lab created with AutomatedLab that contains Windows Server 2022 machines running ActiveDirectory and SQLServer along with CentOS 8.5 machines running a Kubernetes cluster. My test application is a .Net 6 console application that simply connect to a SQLServer database running in the the lab over a trusted connection. It is containerized based on the official aspnet:6.0 image. The Kubernetes POD contains an InitContainer that executes kinit to generate a Kerberos token placed in a shared volume. I have made two versions of the test application: one that uses an OdbcConnection to connect to the database and the second one uses a SqlConnection. The version with the OdbcConnection successfully connects to the database but the one using the SqlConnection crashes when opening the connection to the database.</p>
<p>Here is the code of the application using the OdbcConnection:</p>
<pre><code>using (var connection =
               new OdbcConnection(
                   &quot;Driver={ODBC Driver 17 for SQL Server};Server=sql1.contoso.com,1433;Database=KubeDemo;Trusted_Connection=Yes;&quot;))
        {
            Log.Information(&quot;connection created&quot;);
            var command = new OdbcCommand
                (&quot;select * from KubeDemo.dbo.Test&quot;, connection);
            connection.Open();
            Log.Information(&quot;Connection opened&quot;);
            using (var reader = command.ExecuteReader())
            {
                Log.Information(&quot;Read&quot;);
                while (reader.Read())
                {
                    Console.WriteLine($&quot;{reader[0]}&quot;);
                }
            }
        }
</code></pre>
<p>The logs of the container show that it can connect to the database and read its content</p>
<pre><code>[16:24:35 INF] Starting the application
[16:24:35 INF] connection created
[16:24:35 INF] Connection opened
[16:24:35 INF] Read
1
</code></pre>
<p>Here is the code of the application using the SqlConnection:</p>
<pre><code>using (var connection =
               new SqlConnection(
                   &quot;Server=sql1.contoso.com,1433;Initial Catalog=KubeDemo;Integrated Security=True;&quot;))
        {
            Log.Information(&quot;connection created&quot;);
            var command = new SqlCommand
                (&quot;select * from KubeDemo.dbo.Test&quot;, connection);
            connection.Open();
            Log.Information(&quot;Connection opened&quot;);
            using (var reader = command.ExecuteReader())
            {
                Log.Information(&quot;Read&quot;);
                while (reader.Read())
                {
                    Console.WriteLine($&quot;{reader[0]}&quot;);
                }
            }
        }
</code></pre>
<p>The container crashes, based on the log when the connection is being opened:</p>
<pre><code>[16:29:58 INF] Starting the application
[16:29:58 INF] connection created
</code></pre>
<p>I have deployed the Kubernetes pod with a command &quot;tail -f /dev/null&quot; so that I could execute the application manually and I get an extra line:</p>
<pre><code>[16:29:58 INF] Starting the application
[16:29:58 INF] connection created
Segmentation fault (core dumped)
</code></pre>
<p>According to Google, this is C++ error message that indicates an attempt to access an unauthorized memory section. Unfortunately I have no idea how to work around that. Does anyone has an idea how to get it to work?</p>
<p>To be complete, here is the Dockerfile for the containerized application</p>
<pre><code>FROM mcr.microsoft.com/dotnet/aspnet:6.0 

ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update
RUN apt-get install curl gnupg2 -y
RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
RUN curl https://packages.microsoft.com/config/debian/11/prod.list &gt; /etc/apt/sources.list.d/mssql-release.list
RUN apt-get update
RUN ACCEPT_EULA=Y apt-get install --assume-yes --no-install-recommends --allow-unauthenticated unixodbc msodbcsql17 mssql-tools
RUN apt-get remove curl gnupg2 -y
RUN echo 'export PATH=&quot;$PATH:/opt/mssql-tools/bin&quot;' &gt;&gt; ~/.bash_profile 
RUN echo 'export PATH=&quot;$PATH:/opt/mssql-tools/bin&quot;' &gt;&gt; ~/.bashrc

WORKDIR /app
EXPOSE 80
COPY ./ .
ENTRYPOINT [&quot;dotnet&quot;, &quot;DbTest.dll&quot;]
</code></pre>
<p>And the POD Helm template:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: dbtest
  labels:
    app: test
spec:    
  restartPolicy: Never
  volumes:
    - name: kbr5-cache
      emptyDir:
        medium: Memory
    - name: keytab-dir
      secret:
        secretName: back01-keytab
        defaultMode: 0444
    - name: krb5-conf
      configMap:
        name: krb5-conf
        defaultMode: 0444
  initContainers:
    - name: kerberos-init
      image: gambyseb/private:kerberos-init-0.2.0
      imagePullPolicy: {{ .Values.image.pullPolicy }}
      securityContext:
        allowPrivilegeEscalation: false
        privileged: false
        readOnlyRootFilesystem: true
      env:
        - name: KRB5_CONFIG
          value: /krb5
      volumeMounts:
        - name: kbr5-cache
          mountPath: /dev/shm
        - name: keytab-dir
          mountPath: /keytab
        - name: krb5-conf
          mountPath: /krb5
  containers:
    - name: dbtest
      image: {{ .Values.image.repository }}:DbTest-{{ .Chart.AppVersion }}
      imagePullPolicy: {{ .Values.image.pullPolicy }}          
      env:
        - name: ASPNETCORE_ENVIRONMENT
          value: &quot;{{ .Values.environment.ASPNETCORE }}&quot;
        - name: KRB5_CONFIG
          value: /krb5
{{/*      command:*/}}
{{/*        - &quot;tail&quot;*/}}
{{/*        - &quot;-f&quot;*/}}
{{/*        - &quot;/dev/null&quot;*/}}
      securityContext:
        allowPrivilegeEscalation: true
        privileged: true
      ports:
        - containerPort: 80
      volumeMounts:
        - name: kbr5-cache
          mountPath: /dev/shm
        - name: krb5-conf
          mountPath: /krb5
        - name: keytab-dir
          mountPath: /keytab
{{/*    - name: kerberos-refresh*/}}
{{/*      image: gambyseb/private:kerberos-refresh-0.1.0*/}}
{{/*      imagePullPolicy: {{ .Values.image.pullPolicy }}*/}}
{{/*      env:*/}}
{{/*        - name: KRB5_CONFIG*/}}
{{/*          value: /krb5*/}}
{{/*      volumeMounts:*/}}
{{/*        - name: kbr5-cache*/}}
{{/*          mountPath: /dev/shm*/}}
{{/*        - name: keytab-dir*/}}
{{/*          mountPath: /keytab*/}}
{{/*        - name: krb5-conf*/}}
{{/*          mountPath: /krb5*/}}
  imagePullSecrets:
    - name: {{ .Values.image.pullSecret }}
</code></pre>

<p>This may not be Auth reated.</p>
<p>If you are deploying to a linux container you need to make sure you don't deploy System.Data.SqlClient as this is a Windows only library.  It will just blow up your container (as you are experiencing) when it first loads the library.</p>
<p>I found that if I added Microsoft.Data.SqlClient it didn't get added but I think I was leaving Dapper or EF to add the dependency and it went into the release as System.Data.SqlClient.  As the container blew up in AWS I had very little feedback as to the cause!</p>
<p>See <a href="https://devblogs.microsoft.com/dotnet/introducing-the-new-microsoftdatasqlclient/" rel="nofollow noreferrer">https://devblogs.microsoft.com/dotnet/introducing-the-new-microsoftdatasqlclient/</a></p>
