Authenticate the Azure Key Vault secret backend with Workload Identity Federation, removing the need to store a long-lived client secret.
New features
- Workload Identity Federation as an alternative to client_secret for the Azure Key Vault backend.
- Auto-detected on AKS via the workload-identity webhook (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE).
- Works on any OIDC-federated Kubernetes cluster (EKS, GKE, self-hosted).
- Sovereign-cloud override via AZURE_AUTHORITY_HOST.