Identity binding (previously called trust domain) - workload identity federation #4658
Description
Identity binding feature allows users to map an Entra user-assigned managed identity to any number of cluster or subject (namespace, service account) combinations to address the current 20 FIC limitation per identity. For each binding, user provides the cluster ARM Id to specify which managed identities are usable via workload identity on any cluster. Post that, they’d then create a ClusterRole and ClusterRoleBinding within the cluster specifying the service accounts that are allowed to use the managed identity.
Tentative UX:
- Cluster operator creates identity binding resource
az aks identity-binding create \
--name <binding-name> \
--resource-group <group-name> \
--managed-identity-resource-id <identity-resource-id> \
--cluster-name <cluster name>
This step sets up an issuer per each identity binding and the output of the above step surfaces the identity-binding-issuer needed for step 3. AKS maintains a unique identity binding issuer per each managed identity. So even if identity binding is created for same managed identity mapped to a different cluster, the same identity binding issuer is used for the same allowing for the same issuer value under FIC (from step 3) to be used across multiple clusters
- User creates a cluster role and role binding identifying the namespace and service account that can use the managed identity
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: allow-clientid-1
rules:
- verbs: ["use-managed-identity"]
apiGroups: ["cid.wi.aks.azure.com"]
resources: ["<client-id-1>"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: allow-clientid-1-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: allow-clientid-1
subjects:
- kind: ServiceAccount
name: mysa
namespace: ns - User creates FIC mapping the managed identity and identity binding.
az identity federated-credential create \
--name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} \
--identity-name "${USER_ASSIGNED_IDENTITY_NAME}" \
--resource-group "${RESOURCE_GROUP}" \
--issuer "<identity_binding_issuer>" \
--subject "<ARM-ID-managed-identity>"\
--audience api://AzureADTokenExchange
Tentative ETA for preview June 2025