AAD Pod identity support for AKS

[mickledur]

Hi,
According to this announcement, AAD Pod Identity has been deprecated and now replaced with Azure Workload Identity. But in the lastest release of AKS(Release 2024-01-23), i saw that there are patches still on going on AAD pod Identity. This is exactly what i read on the release notes:
Upgraded aad-pod-identity/nmi image from v1.8.17-1 to v1.8.18 to address golang.org/x/net CVEs - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325), [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978), and [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)

Based on that, i have two questions:

• Is there an internal maintenance/upgrade activities from AKS on AAD Pod Identity?
• We are still using AAD Pod identity on AKS 1.26.10 and we would like to Migrate to Workload Identity as we will perform some AKS upgrade soon (1.27.x then 1.28.x). Until which version/release of AKS, AAD Pod Identity will be supported? When should AAD Pod Identity be not anymore supported on AKS clusters on totally replaced by Workload Identity?

Thanks in advance for your answers

[philwelz]

Since February 2023 :) AAD Pod Identity normally received CVE support until September 2023, so maybe your are lucky that they are still doing CVE support. I guess you know this but you should not run deprecated software.

I found this here:

The open source Microsoft Entra pod-managed identity (preview) in Azure Kubernetes Service was deprecated on 10/24/2022, and the project archived in Sept. 2023. For more information, see the deprecation notice. The AKS Managed add-on begins deprecation in Sept. 2024.

So September 2024 is the answer i guess. Nevertheless, you should migrate to workload identity very soon as you can enable it on your cluster and start migrating the apps. Now 😄