Question

Can someone tell me which option is better to integrate Azure Key Vault with AKS Clusters?

Is it FlexVolume using Service Principal as Secret or FlexVolume using AAD Pod Identity?

Answer 1

I would say Flexvolume using aad pod identity is ok as long as you kerberized the azure active directory. That way no azure active directory password is being sent over ldaps or tls1.2

Comments

But can we use azure active directory pod Identity in production environment?

---

Yes you can, it's just not a standard yet. In other word you can implement it but with some acceptable risk. You can try this code as a trial: https://github.com/Azure/aad-pod-identity

---

And what are your views on FlexVolume using Service Principal??

---

Service principal is a proprietary Microsoft solution to use tokenized azure ad service principal to authorize pod. However it is not an open standard even though its might work great

---

Okay. Thanks!