<p>I have been looking into managed identity and AKS cluster and this is my understanding:</p>
<ul>
<li>I can assign only a single user managed identity to the AKS cluster.</li>
<li>I have to do the relevant role assignments to the identity for getting access.</li>
</ul>
<p>Now my question is, let's say I have two different pods. One pods want
to access keyvault and the other pods wants to access Azure DNS. The
only way of making this work is modifying the user managed identity to
give access to both the resources. But now it seems both the pods can
access both the resources.</p>
<p>Now my question:</p>
<ul>
<li>Is my above understanding right and is this the usual way of doing things using AAD Pod Identity ?</li>
<li>Is there a better way to do this to avoid the above security concern ?</li>
</ul>

<p>Regarding the managed identities in AKS there are two things they are uses for. The AKS cluster itself and its pods.</p>
<p>Regarding the managed identity for the cluster, that one is used to access several azure resources as described in <a href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity" rel="nofollow noreferrer">the docs</a>:</p>
<blockquote>
<p>Currently, an Azure Kubernetes Service (AKS) cluster (specifically, the Kubernetes cloud provider) requires an identity to create additional resources like load balancers and managed disks in Azure. This identity can be either <strong>a managed identity</strong> or a service principal.</p>
</blockquote>
<p>Then you have <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity" rel="nofollow noreferrer">managed identities for Pods</a>. <em>This is currently in preview and available on linux nodes only!</em>
You can <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity#create-an-identity" rel="nofollow noreferrer">create</a> more than one of them and <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity#assign-permissions-for-the-managed-identity" rel="nofollow noreferrer">assign permissions</a> per identity. Then you need to add a <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity#create-a-pod-identity" rel="nofollow noreferrer">pod identity</a> that refers to the managed identity and use it when you deploy the pod.</p>
<p>You can have up to 200 pod identities this way.</p>
<p>So, back to this question</p>
<blockquote>
<p>Now my question is, let's say I have two different pods. One pods want to access keyvault and the other pods wants to access Azure DNS. <strong>The only way of making this work is modifying the user managed identity to give access to both the resources</strong>. But now it seems both the pods can access both the resources.</p>
</blockquote>
<p>That is not correct, as stated you can have multiple pod identities each with their own access permissions.</p>
