workload-identity-webhook

Azure Workload Identity Webhook

Chainguard's redistribution of the Azure Workload Identity workload-identity-webhook Helm chart, pre-configured with hardened Chainguard Images.

The webhook is a mutating admission webhook that projects a signed service account token into workload pods and injects the environment variables the Azure Identity SDKs need to federate that token for Microsoft Entra ID credentials.

Prerequisites

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace azure-workload-identity-system

The chart requires the tenant ID of the Microsoft Entra ID tenant that issues the federated credentials; azureTenantID has no default and the chart fails to render without it.

Installation

helm install workload-identity-webhook oci://cgr.dev/ORGANIZATION/charts/workload-identity-webhook \
  --namespace azure-workload-identity-system \
  --create-namespace \
  --set azureTenantID="${AZURE_TENANT_ID}" \
  --set imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream workload-identity-webhook Helm chart. All upstream configuration options apply.

For full documentation, see: https://azure.github.io/azure-workload-identity/docs/