Serviceaccount

1# =============================================================================
2# ServiceAccount Template — AKS Deploy Skill
3# =============================================================================
4# Kubernetes ServiceAccount with Azure Workload Identity annotation.
5# The annotation links this SA to an Azure Managed Identity via OIDC federation.
6#
7# Prerequisites:
8#   1. A User-Assigned Managed Identity exists in Azure
9#   2. A Federated Identity Credential is configured with:
10#      - Issuer:  <AKS cluster OIDC issuer URL>
11#      - Subject: system:serviceaccount:<namespace>:<app-name>
12#      - Audience: api://AzureADTokenExchange
13#
14# REPLACE: <app-name>          — your application name (e.g., order-api)
15# REPLACE: <namespace>         — target namespace (e.g., production)
16# REPLACE: <azure-client-id>   — client ID of the Managed Identity
17# =============================================================================
18apiVersion: v1
19kind: ServiceAccount
20metadata:
21  name: <app-name>
22  namespace: <namespace>
23  labels:
24    app: <app-name>
25  annotations:
26    # Workload Identity: maps this ServiceAccount to an Azure Managed Identity.
27    # The Workload Identity webhook reads this annotation and injects
28    # AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_FEDERATED_TOKEN_FILE
29    # into any pod that references this ServiceAccount AND has the label
30    # azure.workload.identity/use: "true".
31    azure.workload.identity/client-id: "<azure-client-id>"