rage.fail

azure-aks-ksa-maps-to-mi

explicit azure emits ExternalIdentityMapsTo

match (record)

{ "field": "metadata.annotations[\u0027azure.workload.identity/client-id\u0027]", "resource_type": "k8s/ServiceAccount" }

where

annotation azure.workload.identity/client-id is set and non-empty

emit

source type	`WorkloadIdentity`
target type	`ManagedIdentity`
source	`<Kubernetes ServiceAccount (WorkloadIdentity)>`
target	`<Azure Managed Identity matching the client-id annotation>`

Narrative

KSA {ksa.name} (namespace {namespace.name}) is annotated with azure.workload.identity/client-id={clientId}; pods running as this KSA receive a projected token they can exchange for MI {mi.name}'s access token.

Raw rule rules/explicit/azure-aks.yaml

id: azure-aks-ksa-maps-to-mi
emits: ExternalIdentityMapsTo
applies_to:
- azure
match_record:
  resource_type: k8s/ServiceAccount
  field: metadata.annotations['azure.workload.identity/client-id']
where:
- annotation azure.workload.identity/client-id is set and non-empty
emit:
  source_type: WorkloadIdentity
  target_type: ManagedIdentity
  source: <Kubernetes ServiceAccount (WorkloadIdentity)>
  target: <Azure Managed Identity matching the client-id annotation>
  api_source: kubectl get serviceaccount -n <namespace> <name> -o yaml
  evidence_field: metadata.annotations['azure.workload.identity/client-id']
  narrative: KSA {ksa.name} (namespace {namespace.name}) is annotated with azure.workload.identity/client-id={clientId};
    pods running as this KSA receive a projected token they can exchange for MI {mi.name}'s access token.