Request for feedback: Terraform AKS Workload Identity + Azure Key Vault reference implementation

Hi, I’m working on a Terraform implementation where an AKS workload uses Workload Identity to read from Azure Key Vault without a client secret.
The trust chain is:
Kubernetes service account → AKS OIDC issuer → Entra federated credential → user-assigned managed identity → Key Vault
I’m specifically trying to validate two design choices:

1. Binding the federated credential to a single namespace and service account
2. Applying the narrowest practical Key Vault data-plane RBAC scope For people who have implemented this in production: what security, operational, or Terraform-module pitfalls should I look out for? Repository: https://github.com/JbravoI/terraform-azurerm-aks-workload-identity This is based on and improves upon an earlier approach shared by Ned Bellavance https://bit.ly/3T3Aw9w , and I have credited that influence in the project post. Thanks in advance