Azure Red Hat OpenShift introduces managed identity and workload identity in public preview as a secure alternative to Service Principals. This feature offers short-term credentials with minimal permissions, reducing operational burden and enhancing security with granular access control.
The April 2025 update includes: cluster-wide proxy support for restricted environments, expansion to Spain Central region, and OpenShift 4.16 availability. We're preparing customers for SDN to OVN-Kubernetes migration before OpenShift 4.17 and supporting Ddsv5 instances with NVMe storage.
FAQs:
Managed Identity vs Service Principal? Managed Identity uses short-lived tokens instead of long-term credentials, eliminating rotation needs and reducing risks.
Can I upgrade existing clusters? Managed Identity is for new ARO clusters only. Existing Service Principal clusters remain supported.
Application changes needed? No changes for managed identity, but apps need updates to use Workload Identity for Azure service access.
Which Azure services work with this? Any Azure service supporting Azure AD authentication, like Storage, Key Vault, and SQL.
Security benefits?Eliminates credential leak risks, provides automatic token rotation, enforces precise permissions, and aligns with zero-trust models.