Skip to content

OIDC Issuer Mismatch

Symptom

Pods have the expected service account and projected token, but Azure token exchange fails and workloads cannot access Azure resources such as Key Vault or Storage.

Possible Causes

  • The federated identity credential trusts an old or wrong AKS OIDC issuer URL.
  • Workloads were moved to a different cluster and the new cluster has a different issuer URL.
  • The cluster never had OIDC issuer or workload identity enabled.
  • A copied automation template reused the wrong issuer value across environments.

Diagnosis Steps

flowchart TD
    A[Azure token exchange fails] --> B[Confirm workload identity and OIDC issuer are enabled]
    B --> C[Read actual cluster issuer URL]
    C --> D[Compare issuer with federated identity credential]
    D --> E{Issuer matches exactly?}
    E -->|No| F[Update federated identity credential]
    E -->|Yes| G[Continue with subject and audience checks]

  1. Confirm the cluster has workload identity and an OIDC issuer.

    az aks show \
    --resource-group "$RG" \
    --name "$CLUSTER_NAME" \
    --query "{issuer:oidcIssuerProfile.issuerUrl,workloadIdentity:securityProfile.workloadIdentity}" \
    --output yaml
    Command Purpose
    az aks show Show the OIDC issuer and workload identity state.
    --resource-group Resource group that contains the AKS cluster.
    --name Name of the AKS cluster.
    --query Selects the issuer URL and workload identity profile.
    --output Output format for the result.

  2. Confirm the workload runs as the intended service account.

    kubectl get deployment "$DEPLOYMENT_NAME" \
    --namespace "$NAMESPACE" \
    --output yaml

kubectl get serviceaccount "$SERVICE_ACCOUNT_NAME" \
    --namespace "$NAMESPACE" \
    --output yaml

  3. Compare the cluster issuer URL with the issuer trusted by the federated identity credential.

    az identity federated-credential list \
    --resource-group "$RG" \
    --identity-name "$USER_ASSIGNED_IDENTITY_NAME" \
    --output table
    Command Purpose
    az identity federated-credential list List federated credentials on the identity.
    --resource-group Resource group that contains the identity.
    --identity-name Managed identity to inspect.
    --output Output format for the result.

  4. Inspect pod logs for token exchange failures while keeping the issuer comparison as the primary hypothesis.

    kubectl logs "$POD_NAME" \
    --namespace "$NAMESPACE" \
    --since=30m

Resolution

  • Update or recreate the federated identity credential with the exact AKS OIDC issuer URL reported by the cluster.
  • If the workload was moved across clusters, create the new federated credential before cutting traffic to the new cluster.
  • Verify subject and audience after fixing the issuer so you do not stop at the first corrected mismatch.

Prevention

  • Always source the issuer URL from az aks show instead of copying it manually between environments.
  • Treat cluster migration as an issuer trust migration event.
  • Validate token exchange with a canary pod before removing an older federated identity credential.

See Also

Sources