Detailed documentation on requesting AAD tokens for Service account tokens.

This is more of a request for documentation to explain the internal flow for service account tokens exchange for AAD tokens.

Referring to below link[1] to understand the  "Azure AD Workload Identity" to retrieve AAD tokens for an Kubernetes pod workload, where its mentioned as Kubernetes workload would be sending projected, signed service account token to Azure Active Directory to request access token to access cloud resources. And Azure Active Directory will communicate with OIDC endpoint to validate service account JWT. But How does Kubernetes workload(pod) be sending service account token to Azure AD and how does Azure AD understand the service account JWT. I feel, this information is not clear and upon researching over the internet, I haven't found much details.

[1] https://azure.github.io/azure-workload-identity/docs/

For example, the link below[2] is related to the same user case and it has explained how the Pod Service account token has been passed to Vault and how Vault is able to communicate with the OIDC endpoint and how vault token has been provided to Pod. Can we get this level of detailed information over any sources or in Azure AD Workload Identity documentation.

[2] https://banzaicloud.com/blog/kubernetes-oidc/

Start with the Azure Workload Identity documentation at https://azure.github.io/azure-workload-identity/docs/ and compare it with the Kubernetes OIDC example at https://banzaicloud.com/blog/kubernetes-oidc/. Trace how a pod presents its projected service account JWT, how Azure AD validates it through the OIDC endpoint, and how the access token is returned. Done means the documentation explains this exchange at the requested level of detail.

Written by the indexing model from the issue text.