AKS workload identity impersonation

📘

Note

The feature flag must be enabled before running terraform apply. terraform plan will succeed without it, but terraform apply will fail with a 403 error.

Cast AI supports Azure Workload Identity as an alternative to App Registration for AKS clusters onboarded with impersonation. Workload Identity uses federated credentials instead of client secrets, eliminating secret rotation and allowing Cast AI's permissions to be scoped to a specific resource group rather than the whole subscription.

The UI script method also supports it. castctl does not currently support it.

How it works

Instead of creating an Azure App Registration and client secret, Cast AI uses a User-Assigned Managed Identity with a federated credential. The federated credential allows Cast AI's own identity to impersonate the managed identity — no secrets are stored or rotated.

Terraform creates the following Azure resources:

• A User-Assigned Managed Identity in your cluster's resource group
• A federated identity credential on that managed identity
• A CastAKSRole custom role definition
• Role assignments scoped to both the cluster resource group and the node resource group (MC_*)

Terraform onboarding with workload identity

Use the aks_cluster_workload_identity example from the Cast AI Terraform provider repository. Copy it as your starting point — authentication_method = "workload_identity" is already set. The default is "client_secret" (App Registration); the module handles managed identity and federated credential creation automatically.

Migrating an existing cluster

Clusters already onboarded via App Registration (Terraform or UI script) can migrate to workload identity without disconnecting from Cast AI.

Via Terraform:

Follow the aks_cluster_workload_identity example in the Cast AI Terraform provider repository. Running terraform apply with workload identity configured destroys the App Registration, service principal, and application password, then creates the managed identity and federated credential as replacements. The role assignments are also replaced since they move from the service principal to the managed identity. Cast AI will be unable to authenticate during this window — this typically resolves within a few minutes once the new credentials propagate.

Via the UI script:

For clusters originally connected through the Cast AI console:

1. Go to the Cluster List in the Cast AI console.
2. Click the ⋯ (three-dot) menu on the cluster's row.
3. Select Cast AI features from the dropdown.
4. Copy and run the script shown in the modal.

castctl limitation

castctl does not currently support AKS onboarding with workload identity impersonation. Use Terraform or the UI script method instead.

See also