WorkloadIdentityCredentialBuilder Class
- java.
lang. Object - com.
azure. identity. CredentialBuilderBase<T> - com.
azure. identity. AadCredentialBuilderBase<T> - com.
azure. identity. WorkloadIdentityCredentialBuilder
- com.
- com.
- com.
public class WorkloadIdentityCredentialBuilder
extends AadCredentialBuilderBase<WorkloadIdentityCredentialBuilder>
Fluent credential builder for instantiating a WorkloadIdentityCredential.
Workload identity authentication exchanges a projected Kubernetes service account token for a Microsoft Entra access token, without requiring an application secret or certificate. The credential reads its tenant ID, client ID, and token file path from the workload identity environment variables unless they are configured on this builder. Refer to Microsoft Entra Workload ID for more information. To use Azure Kubernetes Service identity bindings, opt in with enableAzureProxy().
Sample: Construct WorkloadIdentityCredential
The following code sample demonstrates the creation of a WorkloadIdentityCredential, using the WorkloadIdentityCredentialBuilder to configure it. The clientId, is required to create WorkloadIdentityCredential. Once this credential is created, it may be passed into the builder of many of the Azure SDK for Java client builders as the 'credential' parameter.
TokenCredential workloadIdentityCredential = new WorkloadIdentityCredentialBuilder().clientId("<clientID>")
.tenantId("<tenantID>")
.tokenFilePath("<token-file-path>")
.build();
Constructor Summary
| Constructor | Description |
|---|---|
| WorkloadIdentityCredentialBuilder() |
Creates an instance of a Workload |
Method Summary
| Modifier and Type | Method and Description |
|---|---|
|
Workload |
build()
Creates new WorkloadIdentityCredential with the configured options set. |
|
Workload |
enableAzureProxy()
Enables Azure Kubernetes Service (AKS) identity bindings. |
|
Workload |
tokenFilePath(String tokenFilePath)
Configure the path to a file containing a Kubernetes service account token that authenticates the identity. |
Methods inherited from AadCredentialBuilderBase
Methods inherited from CredentialBuilderBase
Methods inherited from java.lang.Object
Constructor Details
WorkloadIdentityCredentialBuilder
public WorkloadIdentityCredentialBuilder()
Creates an instance of a WorkloadIdentityCredentialBuilder.
Method Details
build
public WorkloadIdentityCredential build()
Creates new WorkloadIdentityCredential with the configured options set.
Returns:
enableAzureProxy
public WorkloadIdentityCredentialBuilder enableAzureProxy()
Enables Azure Kubernetes Service (AKS) identity bindings. When proxy configuration is present, authentication requests are sent through the AKS token proxy instead of directly to Microsoft Entra ID.
This feature is disabled by default and requires using WorkloadIdentityCredential directly. It is not supported by DefaultAzureCredential or ManagedIdentityCredential. The AKS identity binding and Kubernetes permissions must be configured separately. See AKS identity bindings.
The AKS webhook supplies AZURE_KUBERNETES_TOKEN_PROXY, AZURE_KUBERNETES_SNI_NAME, and either AZURE_KUBERNETES_CA_FILE or AZURE_KUBERNETES_CA_DATA. Inline CA data must be PEM encoded, not Base64 encoded. If neither CA setting is provided, the platform trust store is used. Changes to a CA file are reloaded on subsequent network requests. Missing or empty files during rotation retain the previously loaded CA; invalid nonempty certificate bundles fail authentication.
If no proxy settings are present, the credential uses direct authentication. Incomplete or invalid proxy configuration fails rather than falling back to direct authentication. When a proxy is configured, its dedicated transport is set on a copy of the credential options, replacing any client set with #httpClient(com.azure.core.http.HttpClient). A custom HTTP pipeline retains its usual precedence over HTTP client settings. Keep the authority host set to the Microsoft Entra authority, not the proxy URL.
Sample: Enable AKS identity bindings
WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()
.enableAzureProxy()
.build();
Returns:
tokenFilePath
public WorkloadIdentityCredentialBuilder tokenFilePath(String tokenFilePath)
Configure the path to a file containing a Kubernetes service account token that authenticates the identity. The file path is required to authenticate.
Parameters:
Returns:
