Autoscaling Controller  ·  View 34 of 37  ·  6 · Assurance

Identity Separation

Three workload identities, federated, short-lived, and scoped to the capacity groups they manage.

Editable source SVG draw.io All views
Controller Pod K8s Service Account Entra ID Key Vault Signal Source Capacity API Audit Log 1. projected token 2. federated exchange 3. token · 1 h · scoped 4. read as signal-reader 5. no secret to fetch 6. actuate as capacity-writer 7. scoped to this group only 8. another group: denied 9. every exchange Three Identities, No Standing Credentials Reading signals, writing desired state and actuating capacity are three separate workload identities. None of them is a fleet-wide administrative role. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Separate identities for reading signals, writing desired state and actuating capacity.
  • No standing credentials: a projected service-account token is federated to Entra ID for a scoped one-hour token.
  • No fleet-wide administrative role exists. An actuation identity is scoped to named capacity groups and denied outside them.

Why three and not one

  • One identity would mean a compromise anywhere in the controller could change the fleet's size.
  • Three means the highest-volume, lowest-trust path — signal collection, talking to dozens of external exporters — carries the least authority in the system.

Evidence

  • Every token exchange is audited. Every configuration change and override carries actor, target, before/after and justification, retained 13 months.
◀  Trust Zones All views RBAC and Change Control  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 37 views · Azure and open source34-identity-separation