Azure Workload Identity for AKS

Last updated: 2026-04-02

What Is Workload Identity?

Workload Identity lets pods in AKS authenticate to Azure services (Key Vault, Storage, PostgreSQL, etc.) without storing any secrets. Instead of injecting connection strings or passwords, your pod proves its identity through a short-lived token issued by the cluster's OIDC provider, which Microsoft Entra ID trusts because you've set up a federation between the cluster and a Managed Identity. The pod gets a token automatically — your app code just uses the standard Azure SDK credential chain.

---

Three Components

1. User-Assigned Managed Identity

A Managed Identity in Azure that has RBAC role assignments on the target resources (e.g., Key Vault Secrets User, Storage Blob Data Contributor).

Managed Identity
  ├── Client ID: <AZURE_CLIENT_ID>
  ├── Tenant ID: <AZURE_TENANT_ID>
  └── Role assignments:
       ├── Key Vault Secrets User  → /subscriptions/.../vaults/my-kv
       ├── Storage Blob Data Contributor → /subscriptions/.../storageAccounts/my-sa
       └── ...

2. Federated Identity Credential

A trust relationship that says: "When the AKS cluster's OIDC issuer presents a token