November 2, 2025

Verify AKS Workload Identity From Container Shell

Assuming that AKS workload identity as been set up according to documentation, how can this be verified from a container shell?

Make sure that the Azure CLI az has been installed in the container and that the container’s resources cpu and memory are sized appropriately.

All ids have been redacted, and input and output formatted for better readability.

The Azure Workload Identity mutating webhook creates AZURE_* environment variables:

printenv | grep AZURE
AZURE_TENANT_ID=00000000-0000-0000-0000-000000000000
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token
AZURE_AUTHORITY_HOST=https://login.microsoftonline.com/
AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000000

Based on these, az can be set up to log in using the federated credentials:

az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" \
  --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID

Add an environment variable for the subscription where the managed identity projected to the container’s service account has appropriate access.

export AZURE_SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000

In this example, the managed identity has access to containers in specific storage accounts.

Get info about a container in a storage account:

az storage container show --name container-1 --account-name stexample01 --auth-mode login

Upload a file to the container:

az storage blob upload --file blob-file.txt --name first-upload \
  --container-name container-1 --account-name stexample01 -auth-mode login

Finally, list the contents of the container:

az storage blob list --container-name container-1 --account-name stexample01 \
  --auth-mode login --output table

Name          Blob Type    Blob Tier    Length    Content Type    Last Modified              Snapshot
------------  -----------  -----------  --------  --------------  -------------------------  ----------
first-upload  BlockBlob    Hot          26        text/plain      2025-11-02T11:54:02+00:00

If all this works, the workload identity has been set up correctly.

Happy platforming!

Tags: AKS Azure Kubernetes Platform Engineering