# AUTHORED ONLY — not run from this repo.
# Validate with: kubectl --dry-run=client, kubeval, yamllint.
# Apply to your own AKS cluster per the AKS primer instructions.
---
id: cloud-native-aks-workload-identity
name: "AKS Workload Identity"
description: "ServiceAccount with azure.workload.identity/client-id annotation; pod authenticates to Azure AD via federated credential and calls Azure Key Vault."
labels:
  customer: any
  profile: aks
  chart-test-swarm/target-k8s-version: aks-1.30
cluster:
  provider: aks
  k8s_version: "1.30"
  preinstall:
    - kind: raw_manifest
      path: chart-test/fixtures/cloud-native/aks/workload-identity-sa.yaml
      namespace: sample
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    aks.workloadIdentity.enabled: "true"
    aks.workloadIdentity.clientId: "<REPLACE_WITH_AZURE_CLIENT_ID>"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: sample
  - type: smoke-script
    path: chart-test/assertions/cloud-native/aks/workload-identity.sh
tags: [cloud-native]
mechanisms: ['cloud:aks', 'addon:workload-identity']
category: cloud-native
tier: authored-only
integration: aks-workload-identity