Notes from the Field

Managed Kubernetes hands you workload identity. AKS runs an OIDC issuer for the cluster, publishes its discovery documents, and Entra already trusts them — a pod gets an Azure token and nobody thinks about it.

On plain VMs, none of that exists. The nodes have no Azure identity to assume, and the workloads still need Key Vault and Blob Storage. The default answer at that point is a service principal secret in a Kubernetes Secret: a static cloud credential, sitting on a node, rotated by nobody.

There is a better answer, and the cluster already does most of it. Every Kubernetes cluster signs service-account tokens with a private key. Those tokens are already OIDC-shaped JWTs. Publish the public half over HTTPS, point Entra at it, and the cluster becomes an identity provider it always was.

This is what that took on a production RKE2 cluster running on bare VMs.

Long-lived cloud credentials in CI are the most reliably exploited secret in any organisation. They are copied into a settings page once, they never expire, and nothing tells you when one leaks. Federated identity — OIDC — removes them: the pipeline presents a short-lived token that the cloud verifies against your CI provider, and no static key exists to steal.

The migration is genuinely worth doing. It also fails, almost always, at exactly one step.

A comprehensive learning resource for DevOps professionals, security teams, and developers new to automated security scanning

A cluster that costs three times what it should is rarely running three times the workload. It is usually running the right workload, badly sized, on the wrong pricing model, with a layer of things nobody is willing to delete.

Orchestration Made Easy with Kubernetes

Horizontal Pod Autoscaler is table stakes. But HPA only knows what it observes — CPU, memory, or a custom metric — and it has no opinion about whether a pod was the right size to begin with. That is a different question, answered by a different controller, and the two can be made to work against each other.

Most sessions that start with "the container can't reach the database" end at one of four or five misunderstandings. Docker networking is not magic — it is Linux bridges, veth pairs and iptables with a convenient API on top. Once you can see those three things directly, the guessing stops.

Ingress controllers got most of us started, and Ingress is not deprecated. But on a multi-tenant platform it fails in a specific, predictable way: one object ends up owning TLS, routing and rate limits, which means three teams edit the same YAML and none of them owns it.