Advancements in Kubernetes Workload Identity for Azure

1. Azure Workload Identity
Anish Ramasekar, Ernest Wong
Azure ContainerUpstream

2. Agenda
• AAD Pod Identity
• Overview
• Limitations
• Azure Workload Identity
• Motivations
• Architecture
• Demo
• Integrations
• Roadmap
• Resources

3. Accessing Azure Resources

4. Accessing Azure Resources From Kubernetes

5. AAD Pod
Identity
Architecture

6. Limitations
• Assigning managed identities to underlying K8s nodes (VMSS) takes 10-40s
• Only supports K8s clusters on Azure
• Only supports Linux nodes
• Dependency on IMDS

7. Motivations
• Azure Workload Identity eliminates the following:
• Identity assignment wait time
• K8s CRDs
• IMDS
• Cloud-agnosticand OS-agnostic

8. How to Achieve?
Federated
Identity
Credential
Service
Accounts
Mutating
Webhook

9. Azure Workload
Identity
Architecture

10. Demo

11. Integrations
Workload Identity has been integrated in
• Azure Key Vault Provider for Secrets Store CSI Driver
• Enables getting secrets storedin Azure Key Vault and uses the Secrets StoreCSI
Driver interface to mount them into Kubernetes pods.
• Ratify
• Enables validation of supply chain artifacts, such as image signatures, and SBOMs

12. Roadmap
✓ Open-Source ProjectLaunch
✓ AKS OIDC Issuer support
✓ AKS Workload Identity Preview withAzure AD Apps
❑ Workload Identity FederationwithManaged Identity
❑ AKS Workload Identity Public Preview
❑ AKS Workload Identity GA

13. Resources
• AAD Pod Identity
• Azure Workload Identity
• Federation With Azure AD