IBM Sterling


This portal is to open public enhancement requests for IBM Sterling products and services. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Not under consideration
Workspace Intelligent Promising
Created by Guest
Created on May 22, 2026

RELATED IDEAS

Support for Azure managed identities.

Idea Proposal: Support for Workload Managed Identities & Kubelet Identity in IBM SIP

🧩 Problem Statement

Currently, IBM SIP does not support workload managed identities or kubelet identity integration, which introduces operational and security constraints:

  • Kubernetes manifests must include imagePullSecrets

  • Secrets need to be manually created, distributed, and rotated

  • Increased dependency on static credentials

  • Risk of credential leakage and mismanagement

  • Adds friction to GitOps, CI/CD, and platform standardization

This diverges from modern cloud-native security patterns where identity-based authentication replaces static secrets.

🎯 Proposed Enhancement

Introduce support for:

1. ✅ Workload Managed Identities (Pod Identity)

Enable pods to authenticate dynamically with registries and other services using federated identity instead of secrets.

Expected capabilities:

  • Bind Kubernetes Service Accounts to IBM Cloud identities

  • Support OIDC federation for token exchange

  • Automatic token injection into pods

  • Fine-grained IAM role assignment per workload

2. ✅ Kubelet Identity for Image Pulls

Allow nodes (kubelets) to use a managed identity to pull images from registries.

Expected capabilities:

  • Kubelet fetches images using platform-provided identity

  • Remove need for imagePullSecrets in pod specs

  • Node-level authentication to container registry

  • Seamless integration with IBM Container Registry (ICR) or external registries

🚀 Benefits

🔐 Security Improvements

  • Eliminates static credentials in manifests

  • Reduces secret sprawl and exposure risk

  • Enables short-lived token-based authentication

  • Aligns with Zero Trust principles

⚙️ Operational Efficiency

  • Removes manual secret management

  • Simplifies onboarding for developers

  • Improves GitOps workflows (no secrets in Git)

  • Reduces support overhead for credential issues

🌍 Cloud-Native Alignment

  • Aligns IBM SIP with:

    • Azure (Managed Identity, AKS pod identity/kubelet identity)

    • AWS (IAM Roles for Service Accounts – IRSA)

    • Google Cloud (Workload Identity)

What is your industry? Retail
How will this idea be used?

our organization is moving towards cloud managed entities from user managed entities like username/password, service principles etc for one cloud service to talk to another cloud service for example AKS to gain access to container registry or storage account. Since the SIP manifests are orchestrated by operators, we would like to have flexibility to add additional annotations, labels and have some of the fields optional (eg image pull secrets in deployments/pod manifests generated by Operator)
  • Admin
    Sampson Wong
    May 27, 2026

    This enhancement is currently considered a non-critical roadmap item and is not planned for support at this time. However, we will log the request into the IBM backlog for future evaluation and roadmap prioritization.

    Reply

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.