Workload identity support in Kubernetes provider

[AbhiReen]

Is there a plan to support Workload identity for the kubernetes provider and do you have a timeline for it?

[zhenlan]

Yes, we do have a plan to support workload identity in the near future.

[RichardChen820]

Support workload identity is on our radar, we plan to support it at the controller pod level.

To support one-to-many serviceAccount-to-identity map, a new setting workloadIdentity would be added in API, sample yaml:

apiVersion: azconfig.io/v1beta1
kind: AzureAppConfigurationProvider
metadata:
  name: demo-provider
spec:
  endpoint: https://contoso.azconfig.io
  target:
    configMapName: configmap-demo
  auth: 
    workloadIdentity:
      managedIdentityClientId: <client id of managed identity>

I imagine using workload identity in App Configuration Kubernetes Provider should take following steps:

1. Enable cluster workload identity
2. Create a managed identity, and assign the appropriate role to it.
3. Create federated credential for managed identity.
4. Set the managed identity client ID to auth.workloadIdentity.ManagedIdentityClientId in yaml

[RichardChen820]

Workload identity support is available in preview4

See here for a detailed usage guide.