Use Azure Workload Identity on AKS to access Azure Blob Storage as Restic Backend

[fbrnc]

Instead of using the Azure Account Key to access the Azure Blob storage (which works fine) I'd rather use a fine-grained role and attach a workload identity to the pods in order to have restic access the blob storage.
Adding labels and annotations via the PodConfig didn't work. Am I missing something?
And if this worked would restic fall back to using the identity or would it still expect the accountKeySecretRef to be set?