Deployed c727bf697 to main with MkDocs 1.6.1 and mike 2.2.0

main/api/spec/index.html

@@ -13181,6 +13181,20 @@ External Secrets meta/v1.SecretKeySelector
 <p>Token authenticates with Nebius Mysterybox by presenting a token.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>workloadIdentity</code></br>
+<em>
+<a href="#external-secrets.io/v1.NebiusWorkloadIdentity">
+NebiusWorkloadIdentity
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="external-secrets.io/v1.NebiusCAProvider">NebiusCAProvider
@@ -13272,6 +13286,52 @@ NebiusCAProvider
 </tr>
 </tbody>
 </table>
+<h3 id="external-secrets.io/v1.NebiusWorkloadIdentity">NebiusWorkloadIdentity
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#external-secrets.io/v1.NebiusAuth">NebiusAuth</a>)
+</p>
+<p>
+<p>NebiusWorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.</p>
+</p>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>serviceAccountRef</code></br>
+<em>
+<a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
+External Secrets meta/v1.ServiceAccountSelector
+</a>
+</em>
+</td>
+<td>
+<p>ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+Nebius IAM token using workload federation.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>iamServiceAccountID</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>IAMServiceAccountID is the Nebius IAM service account identifier that the
+federated Kubernetes service account should impersonate during token exchange.</p>
+</td>
+</tr>
+</tbody>
+</table>
 <h3 id="external-secrets.io/v1.NgrokAuth">NgrokAuth
 </h3>
 <p>

main/provider/nebius-mysterybox/index.html

@@ -4277,6 +4277,34 @@
     </span>
   </a>
   
+    <nav class="md-nav" aria-label="Authentication">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#service-account-credentials" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Service Account credentials
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#workload-identity" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Workload Identity
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
         <li class="md-nav__item">
@@ -5121,6 +5149,34 @@
     </span>
   </a>
   
+    <nav class="md-nav" aria-label="Authentication">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#service-account-credentials" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Service Account credentials
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#workload-identity" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Workload Identity
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
       
         <li class="md-nav__item">
@@ -5207,7 +5263,14 @@
 <h1 id="nebius-mysterybox">Nebius MysteryBox</h1>
 <p>External Secrets Operator integrates with <a href="https://docs.nebius.com/mysterybox/overview">Nebius MysteryBox</a>.</p>
 <h3 id="authentication">Authentication</h3>
-<p>Currently, only <a href="https://docs.nebius.com/grpc-api/auth">Service Account credentials</a> authorization is supported.</p>
+<p>Nebius Mysterybox supports the following authentication methods:</p>
+<ul>
+<li><code>auth.workloadIdentity</code>: request a Kubernetes service account token via the <code>TokenRequest</code> API and exchange it for a Nebius IAM token using workload federation.</li>
+<li><code>auth.serviceAccountCredsSecretRef</code>: read Nebius service account credentials JSON from a Kubernetes <code>Secret</code> and exchange it for a Nebius IAM token.</li>
+<li><code>auth.tokenSecretRef</code>: read an already issued Nebius IAM token from a Kubernetes <code>Secret</code>.</li>
+</ul>
+<h4 id="service-account-credentials">Service Account credentials</h4>
+<p><em>Find more about the authorization option following the <a href="https://docs.nebius.com/grpc-api/auth">official documentation</a>.</em></p>
 <p>Before you start, create a service account and grant it permission to read desired secrets in MysteryBox.
 For details on required roles and permissions, see <a href="https://docs.nebius.com/mysterybox/secrets/get">MysteryBox get method</a>.</p>
 <p>You will need to create a Kubernetes Secret with desired auth parameters and structure.
@@ -5222,7 +5285,31 @@ The Kubernetes secret must be in a Subject Credentials format:</p>
 <span class="w">  </span><span class="p">}</span>
 <span class="p">}</span>
 </code></pre></div>
-<p>Follow the <a href="https://docs.nebius.com/iam/service-accounts/authorized-keys#create">instruction</a> to generate the secret.</p>
+<p>Follow the <a href="https://docs.nebius.com/iam/service-accounts/authorized-keys#create">instruction</a> to generate the secret.
+The SecretStore example below uses this authentication method.</p>
+<h4 id="workload-identity">Workload Identity</h4>
+<p><strong>ESO assumes that this Nebius-side federation setup already exists and only performs runtime token exchange.</strong></p>
+<p>To use Workload Identity:</p>
+<ol>
+<li>Create a Kubernetes <code>ServiceAccount</code>.</li>
+<li>Create a Nebius IAM service account and grant it permission to read the required MysteryBox secrets. See the permissions for the <a href="https://docs.nebius.com/mysterybox/secrets/get">MysteryBox get method</a>.</li>
+<li>Configure Nebius federated credentials for the Kubernetes service account:<ul>
+<li>use the Kubernetes cluster's service account issuer URL as the OIDC issuer;</li>
+<li>use <code>system:serviceaccount:&lt;namespace&gt;:&lt;service-account-name&gt;</code> as the federated subject;</li>
+<li>use the Nebius IAM service account ID as the subject to impersonate.</li>
+</ul>
+</li>
+<li>Make sure Nebius can access the issuer's OIDC discovery and JWKS endpoints.</li>
+<li>Make sure the ESO controller can create tokens for the referenced service account (<code>create</code> on <code>serviceaccounts/token</code>).</li>
+</ol>
+<p>Reference both service accounts in the store:</p>
+<div class="highlight"><pre><span></span><code><span class="nt">auth</span><span class="p">:</span>
+<span class="w">  </span><span class="nt">workloadIdentity</span><span class="p">:</span>
+<span class="w">    </span><span class="nt">serviceAccountRef</span><span class="p">:</span>
+<span class="w">      </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;kubernetes-service-account-name&gt;</span>
+<span class="w">    </span><span class="nt">iamServiceAccountID</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;nebius-iam-service-account-id&gt;</span>
+</code></pre></div>
+<p>For a <code>SecretStore</code>, the Kubernetes service account must be in the same namespace as the store. For a <code>ClusterSecretStore</code>, set <code>serviceAccountRef.namespace</code> explicitly.</p>
 <h3 id="examples">Examples</h3>
 <h4 id="secretstore">SecretStore</h4>
 <p>First, create a SecretStore with a Nebius MysteryBox backend.</p>