Your platform team wants to remove long-lived credentials for CI/CD and in-cluster access to Azure resources. GitHub Actions must deploy Bicep templates to Azure without a client secret, and AKS workloads must access Key Vault and Storage without storing service principal secrets. What should you configure? Each correct answer presents part of the solution.

The first correct option addresses GitHub Actions. Federated credentials in Entra ID allow GitHub Actions to authenticate to Azure using OpenID Connect (OIDC) without long-lived secrets. The azure/login action then leverages this OIDC token. The second correct option addresses AKS workloads. Azure AD Workload Identity for AKS enables pods to authenticate to Azure resources using managed identities, eliminating the need to store service principal secrets. It maps a Kubernetes service account to an Entra ID application, allowing the Azure Identity SDK to acquire tokens. Generating a GitHub PAT is a long-lived credential and defeats the purpose of removing them. The legacy AAD Pod Identity add-on is deprecated for new clusters in favor of Azure AD Workload Identity. Using service principals with certificates still involves managing secrets (certificates) within Kubernetes, which Workload Identity aims to avoid.