aks-workload-identity

To configure workload identity on AKS, you need to enable OIDC on your cluster, create managed identities or app registrations, establish federated credentials, and assign Azure RBAC roles. This allows pods to authenticate to Azure services without storing secrets.

AKS workload identity token exchange failures often stem from misconfigured federated credentials or webhook mutation issues. Diagnosing these AADSTS token exchange errors involves verifying your service account annotations and ensuring the mutating admission webhook correctly injects environment variables.

You can use either managed identities or Microsoft Entra app registrations to use Entra Workload ID on AKS. Both methods facilitate secure passwordless authentication by establishing federated trust between your Kubernetes service accounts and Azure Active Directory.

Yes, AKS pods can securely access Azure Key Vault secrets without storing credentials by leveraging workload identity. This method enables direct authentication to Azure services by injecting federated tokens, eliminating the need for inline API keys or passwords.

Workload identity is the mechanism enabling pods to authenticate to Azure services, while managed identities represent the actual Azure AD identity used. Workload identity uses federated credentials to map Kubernetes service accounts to these managed identities for secure access.