<p>We are planning to deploy multiple applications on our single Azure kubernetes cluster, each application will have its own set of Azure resources - eg: Key vault, Storage.</p>
<p>I am planning to provision individual managed identities per application and provide access to the relevant resources.</p>
<p>I know that AZURE AAD POD identify is the way to configure the pod to make use of the managed identity to access the Azure resources.</p>
<p>However how do I add multiple managed identity into the Azure kubernetes cluster? and is this the right of implementing?</p>

<p>As I mentioned before, I don't think you can add multiple MSIs to the cluster, you can just  use a system-assigned MSI or user-assigned MSI for it.</p>
<p>Reference - <a href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity" rel="nofollow noreferrer">Use managed identities in Azure Kubernetes Service</a></p>
<p>In your case, if you want to use different service principals to authenticate(essentially MSI is also a service principal managed by Azure), you can create multiple AD Apps along with the service principals.</p>
<p>Reference - <a href="https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal" rel="nofollow noreferrer">How to: Use the portal to create an Azure AD application and service principal that can access resources</a></p>
<p>Then in the code of every application, use <a href="https://learn.microsoft.com/en-us/java/api/com.azure.identity.clientsecretcredential?view=azure-java-stable" rel="nofollow noreferrer"><code>ClientSecretCredential</code></a> to authenticate.</p>
<pre><code>ClientSecretCredential credential1 = new ClientSecretCredentialBuilder()
     .tenantId(tenantId)
     .clientId(clientId)
     .clientSecret(clientSecret)
     .build();
</code></pre>
<p>Then use the credential to create a client e.g. SecretClient .</p>
<pre><code>SecretClient secretClient = new SecretClientBuilder()
    .vaultUrl(&quot;&lt;your-key-vault-url&gt;&quot;)
    .credential(credential1)
    .buildClient();
</code></pre>
