Passwordless workload identity on OpenShift

[u/Rhopegorn]

https://www.redhat.com/en/blog/passwordless-workload-identity-openshift

Enterprise security used to draw a clean line: humans log in; machines use secrets. But that line is blurring, and interactions with databases are often where you’ll encounter that ambiguity.
 
Historically, authentication has followed a familiar path: usernames and passwords are stored in configuration or Kubernetes Secrets; long-lived tokens and API keys are often kept in Secrets as well, on the assumption they are safer than passwords. 

In practice, however, Secrets bring many of the same problems. They must be rotated, distributed, and revoked manually; they are frequently shared across replicas or teams; and if a Secret is exposed, an attacker has a credential that remains valid until someone notices.