You're looking at an AKS cluster for a client.

Somewhere in it, a pod is authenticating to Azure using AAD Pod Identity. It relies on AzureIdentity and AzureIdentityBinding custom resources. It depends on the Node Managed Identity (NMI) pods intercepting metadata requests on port 2579.

It is deprecated. Microsoft pulled the plug a year ago. The NMI intercept is a tax on the cluster's CPU and a liability in the threat model.

You need to move it to Entra Workload ID. It uses OIDC federation. It is cleaner. But cleaner does not mean easy.

Inventory the plumbing

Do not just generate new manifests and hope for the best.

Inventory what you actually have. Every AzureIdentityBinding is a dependency. Every AzureIdentity is a managed identity mapped to a specific set of pod labels.

Map each workload to its intended federated Kubernetes Service Account.…