Welcome to azure-workload-identity Discussions!

[aramase]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[mayankcpatel]

We are using POD User Assigned Managed Identity to access other supported Azure Resources through Azure Python SDK so that means do we need to change the Python code at application level too? Also, would Python 3.8 supported too by Azure Workload Identity?

[chewong]

You will need to upgrade your Azure Python SDK to 1.7.0 as per https://azure.github.io/azure-workload-identity/docs/topics/language-specific-examples/azure-identity-sdk.html. You won't need to change any code if you are using the default credential but you will have to set up your service account and federated identity credential as opposed of AzureIdentity and AzureIdentityBinding (see our quick start)

Azure Workload Identity is language-agnostic so you should be able to run any Kubernetes workload with it.

[lukerogers]

Hi, I'm Luke and I help multiple teams onboard to Azure keeping scalability, security, best practices, etc. in mind. I'm here since it's the replacement to AAD Pod Identity and I'm trying to keep up and try and get ahead of what is coming.

One problem we run into is the fact that we use Managed Identities in AKS and DefaultAzureCredentials when working locally in Visual Studio/VS Code. We want to start testing in a local Kubernetes instance (Docker Desktop, Minikube, K3s, whatever) but the identity piece is somewhat blocking that. We don't want to have to write extra code in IF blocks to use username/password in this scenario. Are there any plans to support this scenario with Service Principals or something similar?

[chewong]

Creating an AAD application (az ad app create) will create an underlying service principal, which you can use in your local environment.

[Xitric]

Hello, we currently use pod managed identities to manage access between our applications and Azure resources. We are really looking forward to workload identity federation, and we have some exciting designs on the drawing board utilizing some of the new features.

In the meantime however, we wonder if/when there will be support for workload identity federation via Azure Resource Manager (for managed identities at least), and in extension via ARM and Bicep templates. Or perhaps the current plan is to keep workload identity federation operations mostly to the Azure CLI (or the azwi CLI)? I am unaware if there are limitations in ARM that would prevent this sort of integration.

While waiting for workload identity federation, we try to keep up with the feature set to plan how best to utilize this new approach when it is released. Understanding how we can expect to interact with it will be valuable information, along with some best practices for use in fully automatic setups.

[stevenjiang-asb]

Hi, we're very interested in this new feature. Just want to know when it will be general available. Is there any ETA? Thanks.

[aramase]

GA is planned for March 2023.