feat: updated doc for k8s policy

This commit is contained in:
=
2025-06-06 23:43:15 +05:30
parent 82c2be64a1
commit 6c2c2b319b
2 changed files with 17 additions and 5 deletions
@@ -1,5 +1,5 @@
--- ---
title: "Machine identities" title: "Machine identities"
description: "Learn how to set metadata and leverage authentication attributes for machine identities." description: "Learn how to set metadata and leverage authentication attributes for machine identities."
--- ---
@@ -25,7 +25,7 @@ Machine identities can have metadata set manually, just like users. In addition,
#### Accessing Attributes From Machine Identity Login #### Accessing Attributes From Machine Identity Login
When machine identities authenticate, they may receive additional payloads/attributes from the service provider. When machine identities authenticate, they may receive additional payloads/attributes from the service provider.
For methods like OIDC, these come as claims in the token and can be made available in your policies. For methods like OIDC, these come as claims in the token and can be made available in your policies.
<Tabs> <Tabs>
@@ -50,17 +50,29 @@ For methods like OIDC, these come as claims in the token and can be made availab
``` ```
You might map: You might map:
- **department:** to `user.department` - **department:** to `user.department`
- **role:** to `user.role` - **role:** to `user.role`
Once configured, these attributes become available in your policies using the following format: Once configured, these attributes become available in your policies using the following format:
``` ```
{{ identity.auth.oidc.claims.<permission claim name> }} {{ identity.auth.oidc.claims.<permission claim name> }}
``` ```
<img src="/images/platform/access-controls/abac-policy-oidc-format.png" /> <img src="/images/platform/access-controls/abac-policy-oidc-format.png" />
</Tab>
<Tab title="Kubernetes Login Attributes">
For identities authenticated using Kubernetes, the service account's namespace and name are available in their policy and can be accessed as follows:
```
{{ identity.auth.kubernetes.namespace }}
{{ identity.auth.kubernetes.name}}
```
<img src="/images/platform/access-controls/abac-policy-k8s-format.png" />
</Tab> </Tab>
<Tab title="Other Authentication Method Attributes"> <Tab title="Other Authentication Method Attributes">
At the moment we only support OIDC claims. Payloads on other authentication methods are not yet accessible. At the moment we only support OIDC claims. Payloads on other authentication methods are not yet accessible.
Binary file not shown.

After

Width:  |  Height:  |  Size: 538 KiB