How to Use AKS Pod Identity with Vault
summary
Demo deploys Vault on AKS with the aad-pod-identity helm chart, installing the MIC controller and NMI daemonset, creating AzureIdentity and AzureIdentityBinding CRs, and labeling pods so nodes receive user-assigned MSIs. A pod can curl 169.254.169.254 via NMI and get an Azure access token, and Vault uses a user-assigned MSI for its Azure auth config. Critical gap: Vault’s Azure auth only accepts system-assigned MSIs, so pod-to-Vault Azure auth with user-assigned identities does not yet work; scripts and repo are available but not fully vetted.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:30What is AKS Pod Identity
- 5:20Deploying Vault with AKS Pod Identity
- 9:56Components of Pod Identity
- 14:57Configuring Vault for Azure Auth
- 17:47Limitations with Pod Authentication
- 23:51Setup Steps Summary
- 26:18Closing and Resources
related talks
20mAzure Authentication With Vault
33mIdentity and Access Management in Kubernetes
32mMastering Cloud Kubernetes: Navigating Azure's Kubernetes Service Maze
13mKubernetes Ecosystem in Azure
23mUsing Hashicorp Vault in Kubernetes Clusters
49mUsing HashiCorp Vault with Kubernetes
51mService Principals and Managed Identities - the Identity tools every Azure developer should know
31mVault and Secret Management in Kubernetes