Azure Workload Identity Federation Authentication

​

Prerequisites

• A Microsoft Entra ID application registered in your Azure tenant
• Azure OpenAI or Azure AI Foundry resource deployed
• The TrueFoundry AI Gateway running on a Kubernetes cluster with a configured OIDC issuer URL, and the namespace and service account name used by the AI Gateway pod
• The Kubernetes service account used by the AI Gateway must have permission to issue TokenRequest resources for itself (the TrueFoundry-provided Helm chart configures this RBAC automatically)

​

Azure Configuration

1

Get Application Details from Entra ID

Navigate to Azure Portal > Microsoft Entra ID > App registrations and select your application.From the Overview page, note the following values:

• Application (client) ID
• Directory (tenant) ID

2

Add a Federated Identity Credential

In your app registration, navigate to Certificates & secrets > Federated credentials > Add credential.For the Federated credential scenario, select Kubernetes accessing Azure resources, then fill in:

Run these commands to look up the values before filling in the form:

# OIDC issuer URL
kubectl get --raw /.well-known/openid-configuration | jq -r .issuer

# Service account name: list pods to find the AI Gateway pod, then inspect it
kubectl get pods -n <namespace>
kubectl get pod <gateway-pod-name> -n <namespace> -o jsonpath='{.spec.serviceAccountName}'

Field	Description
Cluster issuer URL	The OIDC issuer URL of the cluster running the AI Gateway
Namespace	The Kubernetes namespace of the AI Gateway pod
Service account name	The Kubernetes service account name used by the AI Gateway pod
Name	A descriptive name for this federated credential

Azure automatically builds the Subject identifier as system:serviceaccount:<namespace>:<service-account-name> and uses the audience api://AzureADTokenExchange.

The namespace and service account name must match the AI Gateway pod’s service account (the K8S_SERVICE_ACCOUNT_NAME the AI Gateway is deployed with). If they don’t match, the token exchange will fail.

The Cluster issuer URL is your cluster’s OIDC issuer (on Amazon EKS it looks like https://oidc.eks.<region>.amazonaws.com/id/EXAMPLED0123456789ABCDEF0123456789). The Namespace is where the AI Gateway pod runs (commonly truefoundry) and the Service account name is the K8S_SERVICE_ACCOUNT_NAME it is deployed with (defaults to default).

3

Assign RBAC Role to App Registration

Navigate to your Azure resource > Access control (IAM) > Add role assignment.

• Azure OpenAI
• Azure AI Foundry

Assign Cognitive Services OpenAI User role to your app registration.Learn more about Azure OpenAI RBAC

Assign Azure AI User role to your app registration.Learn more about Azure AI Foundry RBAC

Role assignments may take a few minutes to propagate.

​

TrueFoundry Configuration

​

Reference Links

• Register an Entra ID application
• Workload identity federation overview
• Configure a federated identity credential on an app
• Azure OpenAI RBAC
• Azure AI Foundry RBAC