docs: ldap auth in operator

docs/integrations/platforms/kubernetes/infisical-push-secret-crd.mdx

@@ -5,9 +5,9 @@ description: "Learn how to use the InfisicalPushSecret CRD to push and manage se
 ---
 
 
-## Overview 
+## Overview
 
-The **InfisicalPushSecret** CRD allows you to create secrets in your Kubernetes cluster and push them to Infisical. 
+The **InfisicalPushSecret** CRD allows you to create secrets in your Kubernetes cluster and push them to Infisical.
 
 
 This CRD offers the following features:
@@ -70,6 +70,11 @@ Before applying the InfisicalPushSecret CRD, you need to create a Kubernetes sec
         serviceAccountRef:
           name: <secret-name>
           namespace: <secret-namespace>
+      ldapAuth:
+        identityId: <machine-identity-id>
+        credentialsRef:
+          secretName: <secret-name> # ldap-auth-credentials
+          secretNamespace: <secret-namespace> # default
       universalAuth:
         credentialsRef:
           secretName: <secret-name> # universal-auth-credentials
@@ -104,15 +109,15 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
 ## InfisicalPushSecret CRD properties
 
 <Accordion title="hostAPI">
-  If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to 
+  If you are fetching secrets from a self-hosted instance of Infisical set the value of `hostAPI` to
   ` https://your-self-hosted-instace.com/api`
 
   When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud.
 
   <Accordion title="Advanced use case">
-    If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet. 
+    If you have installed your Infisical instance within the same cluster as the Infisical operator, you can optionally access the Infisical backend's service directly without having to route through the public internet.
     To achieve this, use the following address for the hostAPI field:
-    
+
     ``` bash
     http://<backend-svc-name>.<namespace>.svc.cluster.local:4000/api
     ```
@@ -187,7 +192,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
 
 <Accordion title="destination">
   The `destination` field is used to specify where you want to create the secrets in Infisical. The required fields are `projectId`, `environmentSlug`, and `secretsPath`.
-  
+
   ```yaml
   spec:
     destination:
@@ -212,7 +217,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
 
 <Accordion title="push">
   The `push` field is used to define what you want to push to Infisical. Currently the operator only supports pushing Kubernetes secrets to Infisical. An example of the `push` field is shown below.
-  
+
 
 
   <Accordion title="secret">
@@ -220,7 +225,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
 
 
 
-    Example usage of the `push.secret` field: 
+    Example usage of the `push.secret` field:
 
     ```yaml infisical-push-secret.yaml
       push:
@@ -282,7 +287,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
       spec:
         universalAuth:
           credentialsRef:
-            secretName: <secret-name> 
+            secretName: <secret-name>
             secretNamespace: <secret-namespace>
     ```
 
@@ -324,7 +329,39 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
             namespace: <secret-namespace>
     ```
   </Accordion>
+  <Accordion title="ldapAuth">
+     The ldap machine identity authentication method is used to authenticate with a configured LDAP directory. [Read more about LDAP Auth](/documentation/platform/identities/ldap-auth).
 
+     Valid fields:
+     - `identityId`: The identity ID of the machine identity you created.
+     - `credentialsRef`: The name and namespace of the Kubernetes secret that stores the ldap credentials.
+     - `credentialsRef.secretName`: The name of the Kubernetes secret.
+     - `credentialsRef.secretNamespace`: The namespace of the Kubernetes secret.
+
+     Example:
+
+     ```yaml
+       # infisical-push-secret.yaml
+       spec:
+         ldapAuth:
+           identityId: <machine-identity-id>
+           credentialsRef:
+             secretName: <secret-name>
+             secretNamespace: <secret-namespace>
+     ```
+
+     ```yaml
+       # machine-identity-credentials.yaml
+       apiVersion: v1
+       kind: Secret
+       metadata:
+         name: ldap-auth-credentials
+       type: Opaque
+       stringData:
+         username: <ldap-username>
+         password: <ldap-password>
+     ```
+  </Accordion>
   <Accordion title="awsIamAuth">
     The AWS IAM machine identity authentication method is used to authenticate with Infisical.
     [Read more about AWS IAM Auth](/documentation/platform/identities/aws-auth).
@@ -398,7 +435,7 @@ After applying the InfisicalPushSecret CRD, you should notice that the secrets y
 <Accordion title="tls">
   This block defines the TLS settings to use for connecting to the Infisical
   instance.
-  
+
   Fields:
   <Accordion title="caRef">
     This block defines the reference to the CA certificate to use for connecting to the Infisical instance with SSL/TLS.
@@ -438,7 +475,7 @@ Using Go templates, you can format, combine, and create new key-value pairs of s
   Use this option when you would like to push **only** a subset of secrets from the Kubernetes secret to Infisical.
 </Accordion>
 <Accordion title="push.secret.template.data">
-  Define secret keys and their corresponding templates. 
+  Define secret keys and their corresponding templates.
   Each data value uses a Golang template with access to all secrets defined in the `push.secret.secretName` Kubernetes secret.
 
   Secrets are structured as follows:
@@ -483,7 +520,7 @@ A generator is defined as a custom resource (`ClusterGenerator`) within the clus
 
 Because of this behavior, you may want to disable automatic syncing for the `InfisicalPushSecret` resource to avoid continuous regeneration of secrets. This can be done by omitting the `resyncInterval` field from the InfisicalPushSecret CRD.
 
-### Example usage 
+### Example usage
 ```yaml
   push:
     secret:
@@ -625,4 +662,4 @@ After applying, you should notice that the secrets have been pushed to Infisical
 ```bash
   kubectl apply -f source-push-secret.yaml # The secret that you're referencing in the InfisicalPushSecret CRD push.secret field
   kubectl apply -f example-infisical-push-secret-crd.yaml # The InfisicalPushSecret CRD itself
-```
+```