ghost
commented
2 years ago Hi CocoWang-wql, AKS bot here :wave: Thank you for posting on the AKS Repo, I'll do my best to get a kind human from the AKS team to assist you.
I might be just a bot, but I'm told my suggestions are normally quite good, as such: 1) If this case is urgent, please open a Support Request so that our 24/7 support team may help you faster. 2) Please abide by the AKS repo Guidelines and Code of Conduct. 3) If you're having an issue, could it be described on the AKS Troubleshooting guides or AKS Diagnostics? 4) Make sure your subscribed to the AKS Release Notes to keep up to date with all that's new on AKS. 5) Make sure there isn't a duplicate of this issue already reported. If there is, feel free to close this one and '+1' the existing issue. 6) If you have a question, do take a look at our AKS FAQ. We place the most common ones there!
EppO
aglees
microsoft-github-policy-service[bot]
charleswool
Federated Identity is a new version of Identity, which is used by Workload Identity as well.
With Federated identity, the pod requests projected service account token from API Sever firstly. Then it requests AAD token from Azure AD directly. And the federated identity is not stored on the node. The short-lived AAD token will be used to authenticate to other Azure Resources/Services. The requests are not sent to IMDS (Instance Metadata Service) any more.
Once Federated Identity is GA, we will migrate AKS addons from Managed Identity to Federated Identity.