A practical guide to reviewing workload identity after replacing long-lived cloud credentials.
Map the new boundary
A federated workload still presents evidence to obtain a cloud identity. Review who controls the issuer, how subjects are named, which audiences are accepted, and where the identity can be attached at runtime.
- Pin the intended issuer.
- Constrain subject patterns.
- Use a dedicated audience.
- Bind runtime identities to the smallest deployable unit.
Prove the migration
Inventory active keys before cutover, watch both authentication paths during a bounded overlap, then revoke the legacy credentials. A successful deployment is not proof that the old path is gone.
Test failure modes
Attempt tokens with the wrong repository, namespace, service account, branch, and audience. The useful evidence is not only that the intended workload succeeds, but that adjacent workloads fail predictably.