9. Azure Active Directory pod-managed identities in AKS

In the previous chapter, Chapter 8, Role-based access control in AKS, you integrated your AKS cluster with Azure Active Directory (Azure AD). You then assigned Kubernetes roles to users and groups in Azure AD. In this chapter, you will explore how you can integrate your applications running on AKS with Azure AD, and you will learn how you can give your pods an identity in Azure so they can interact with other Azure resources.

In Azure, application identities use a functionality called service principals. A service principal is the equivalent of a service account in the cloud. An application can use a service principal to authenticate to Azure AD and get access to resources. Those resources could be either Azure resources such as Azure Blob Storage or Azure Key Vault, or they could be applications that you developed that are integrated with Azure AD.

There are two ways to authenticate a service principal: you can...