Introduction

Workloads deployed in Kubernetes clusters require Azure AD application credentials or managed identities to access Azure AD protected resources, such as Azure Key Vault and Microsoft Graph. The Azure AD Pod Identity open-source project provided a way to avoid needing these secrets, by using Azure managed identities.

Azure AD Workload Identity for Kubernetes integrates with the capabilities native to Kubernetes to federate with external identity providers. This approach is simpler to use and deploy, and overcomes several limitations in Azure AD Pod Identity:

• Removes the scale and performance issues that existed for identity assignment
• Supports Kubernetes clusters hosted in any cloud or on-premises
• Supports both Linux and Windows workloads
• Removes the need for Custom Resource Definitions and pods that intercept Instance Metadata Service (IMDS) traffic
• Avoids the complication and error-prone installation steps such as cluster role assignment from the previous iteration.

Getting started

• Installation
  • Managed clusters or self-managed clusters
  • Mutating admission webhook
  • Azure AD Workload Identity CLI (azwi)
• Quick start
• Concepts

How it works

In this model, the Kubernetes cluster becomes a token issuer, issuing tokens to Kubernetes Service Accounts. These service account tokens can be configured to be trusted on Azure AD applications or user-assigned managed identities. Workload can exchange a service account token projected to its volume for an Azure AD access token using the Azure Identity SDKs or the Microsoft Authentication Library (MSAL).