dapr Component authentication via Workload Identity in AKS

[gloomy jasper]

I would like to use Workload Identity for Component authentication in AKS. In my AKS cluster, the Workload Identity is enabled and I was checking the part here but couldn’t find which metadata fields should be set in Component definition:

https://docs.dapr.io/developing-applications/integrations/azure/azure-authentication/authenticating-azure/#authenticating-with-workload-identity-on-aks

Is there any pointer how to enable Workload Identity auth in Component definition?

[proper oxide]

I implemented workload identity in Dapr 1.11 - so it should be available

Dapr will automatically try workload identity as an authentication mechanism. All you need to do is configure workload identity as per the AKS docs.. and then you need to correctly annotate your Dapr deployment with the annotations / labels that are required for workload identity. That should be all that is needed

The Dapr component itself should not need anything (no connection string, nor credential etc).. other than specifying the azureClientID to match the Identity that you created for Workload Identity. That is all!

So in Dapr docs essentially follow the user-assigned managed identity instructions!

[shy sage]

Thanks for the info! It worked like a charm. Initially, I made a mistake in my configuration but then found out the problem in the daprd sidecar logs. The error logs are descriptive. Thanks for doing that!