feat(openbao): add `auth.kubernetes` auth method (#6591)

apis/externalsecrets/v1/secretstore_openbao_types.go

@@ -80,15 +80,16 @@ type OpenBaoProvider struct {
 
 // OpenBaoAuth is the configuration used to authenticate with an OpenBao server.
 // Currently the following authentication methods are supported: [AppRole],
-// [Token] and [UserPass]
+// [Kubernetes], [Token] and [UserPass]
 //
 // Additional authentication methods are planned for future releases.
 //
-// +kubebuilder:validation:ExactlyOneOf=appRole;tokenSecretRef;userPass
+// +kubebuilder:validation:ExactlyOneOf=appRole;tokenSecretRef;userPass;kubernetes
 //
 // [AppRole]: https://openbao.org/docs/auth/approle/
 // [Token]: https://openbao.org/docs/auth/token/
 // [UserPass]: https://openbao.org/docs/auth/userpass/
+// [Kubernetes]: https://openbao.org/docs/auth/kubernetes/
 type OpenBaoAuth struct {
 	// AppRole authenticates with OpenBao using the [App Role auth mechanism],
 	// with the role and secret stored in a Kubernetes Secret resource.
@@ -98,6 +99,14 @@ type OpenBaoAuth struct {
 	// +optional
 	AppRole *OpenBaoAppRole `json:"appRole,omitempty"`
 
+	// Kubernetes authenticates with OpenBao by passing a ServiceAccount
+	// token to the [Kubernetes auth mechanism].
+	//
+	// +optional
+	//
+	// [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+	Kubernetes *OpenBaoKubernetesAuth `json:"kubernetes,omitempty"`
+
 	// Name of the [OpenBao Namespace] to authenticate to. This can be different
 	// than the namespace your secret is in. Namespaces is a set of features
 	// within OpenBao that allows OpenBao environments to support secure
@@ -182,3 +191,40 @@ type OpenBaoAppRole struct {
 	// resource is used as the app role secret.
 	SecretRef esmeta.SecretKeySelector `json:"secretRef"`
 }
+
+// OpenBaoKubernetesAuth authenticates with OpenBao using the [Kubernetes
+// auth mechanism] with a ServiceAccount token. The ServiceAccount token can be
+// sourced from a ServiceAccount via `ServiceAccountRef` or from a secret
+// via `SecretRef`.
+// Using the controller pod's ServiceAccount token is not supported.
+//
+// +kubebuilder:validation:ExactlyOneOf=serviceAccountRef;secretRef
+//
+// [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+type OpenBaoKubernetesAuth struct {
+	// Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+	// "kubernetes"
+	// +kubebuilder:default=kubernetes
+	Path string `json:"path"`
+
+	// Optional service account field containing the name of a Kubernetes ServiceAccount.
+	// If the service account is specified, a token will be requested from the Kubernetes
+	// TokenRequest API for authenticating with OpenBao.
+	// Any configured audiences will be passed to the TokenRequest as-is.
+	//
+	// +optional
+	ServiceAccountRef *esmeta.ServiceAccountSelector `json:"serviceAccountRef,omitempty"`
+
+	// Optional secret field containing a Kubernetes ServiceAccount JWT used
+	// for authenticating with OpenBao. If a name is specified without a key,
+	// `token` is the default.
+	//
+	// +optional
+	SecretRef *esmeta.SecretKeySelector `json:"secretRef,omitempty"`
+
+	// A required field containing the OpenBao Role to assume. A Role binds a
+	// Kubernetes ServiceAccount with a set of OpenBao policies.
+	//
+	// +kubebuilder:validation:MinLength=1
+	Role string `json:"role"`
+}

apis/externalsecrets/v1/zz_generated.deepcopy.go

@@ -3226,6 +3226,11 @@ func (in *OpenBaoAuth) DeepCopyInto(out *OpenBaoAuth) {
 		*out = new(OpenBaoAppRole)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Kubernetes != nil {
+		in, out := &in.Kubernetes, &out.Kubernetes
+		*out = new(OpenBaoKubernetesAuth)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Namespace != nil {
 		in, out := &in.Namespace, &out.Namespace
 		*out = new(string)
@@ -3253,6 +3258,31 @@ func (in *OpenBaoAuth) DeepCopy() *OpenBaoAuth {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OpenBaoKubernetesAuth) DeepCopyInto(out *OpenBaoKubernetesAuth) {
+	*out = *in
+	if in.ServiceAccountRef != nil {
+		in, out := &in.ServiceAccountRef, &out.ServiceAccountRef
+		*out = new(apismetav1.ServiceAccountSelector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SecretRef != nil {
+		in, out := &in.SecretRef, &out.SecretRef
+		*out = new(apismetav1.SecretKeySelector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenBaoKubernetesAuth.
+func (in *OpenBaoKubernetesAuth) DeepCopy() *OpenBaoKubernetesAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(OpenBaoKubernetesAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OpenBaoProvider) DeepCopyInto(out *OpenBaoProvider) {
 	*out = *in

apis/meta/v1/types.go

@@ -59,8 +59,8 @@ type ServiceAccountSelector struct {
 	Namespace *string `json:"namespace,omitempty"`
 
 	// Audience specifies the `aud` claim for the service account token
-	// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-	// then this audiences will be appended to the list
+	// Some providers automatically extend the audience field based on well-known annotations for workload
+	// identity (e.g. IRSA or GCP Workload Identity)
 	// +optional
 	Audiences []string `json:"audiences,omitempty"`
 }

config/crds/bases/external-secrets.io_clustersecretstores.yaml

@@ -203,8 +203,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -331,8 +331,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -436,8 +436,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -836,8 +836,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -1790,8 +1790,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -1958,8 +1958,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -2293,8 +2293,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -2619,8 +2619,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -2754,8 +2754,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -4035,8 +4035,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -4705,6 +4705,97 @@ spec:
                                 must be set
                               rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size()
                                 == 1'
+                          kubernetes:
+                            description: |-
+                              Kubernetes authenticates with OpenBao by passing a ServiceAccount
+                              token to the [Kubernetes auth mechanism].
+
+                              [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+                            properties:
+                              path:
+                                default: kubernetes
+                                description: |-
+                                  Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+                                  "kubernetes"
+                                type: string
+                              role:
+                                description: |-
+                                  A required field containing the OpenBao Role to assume. A Role binds a
+                                  Kubernetes ServiceAccount with a set of OpenBao policies.
+                                minLength: 1
+                                type: string
+                              secretRef:
+                                description: |-
+                                  Optional secret field containing a Kubernetes ServiceAccount JWT used
+                                  for authenticating with OpenBao. If a name is specified without a key,
+                                  `token` is the default.
+                                properties:
+                                  key:
+                                    description: |-
+                                      A key in the referenced Secret.
+                                      Some instances of this field may be defaulted, in others it may be required.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[-._a-zA-Z0-9]+$
+                                    type: string
+                                  name:
+                                    description: The name of the Secret resource being
+                                      referred to.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      The namespace of the Secret resource being referred to.
+                                      Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                type: object
+                              serviceAccountRef:
+                                description: |-
+                                  Optional service account field containing the name of a Kubernetes ServiceAccount.
+                                  If the service account is specified, a token will be requested from the Kubernetes
+                                  TokenRequest API for authenticating with OpenBao.
+                                  Any configured audiences will be passed to the TokenRequest as-is.
+                                properties:
+                                  audiences:
+                                    description: |-
+                                      Audience specifies the `aud` claim for the service account token
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
+                                    items:
+                                      type: string
+                                    type: array
+                                  name:
+                                    description: The name of the ServiceAccount resource
+                                      being referred to.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace of the resource being referred to.
+                                      Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                            required:
+                            - path
+                            - role
+                            type: object
+                            x-kubernetes-validations:
+                            - message: exactly one of the fields in [serviceAccountRef
+                                secretRef] must be set
+                              rule: '[has(self.serviceAccountRef),has(self.secretRef)].filter(x,x==true).size()
+                                == 1'
                           namespace:
                             description: |-
                               Name of the [OpenBao Namespace] to authenticate to. This can be different
@@ -4799,8 +4890,8 @@ spec:
                         type: object
                         x-kubernetes-validations:
                         - message: exactly one of the fields in [appRole tokenSecretRef
-                            userPass] must be set
-                          rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size()
+                            userPass kubernetes] must be set
+                          rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass),has(self.kubernetes)].filter(x,x==true).size()
                             == 1'
                       caBundle:
                         description: |-
@@ -5000,8 +5091,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -5532,8 +5623,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -6160,8 +6251,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -6209,8 +6300,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6256,8 +6347,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6431,8 +6522,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6557,8 +6648,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -7637,8 +7728,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -7927,8 +8018,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -8266,8 +8357,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -8901,8 +8992,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -9336,8 +9427,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -9860,8 +9951,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -10268,8 +10359,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -10950,8 +11041,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -11125,8 +11216,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -11251,8 +11342,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array

config/crds/bases/external-secrets.io_secretstores.yaml

@@ -203,8 +203,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -331,8 +331,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -436,8 +436,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -836,8 +836,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -1790,8 +1790,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -1958,8 +1958,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -2293,8 +2293,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -2619,8 +2619,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -2754,8 +2754,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -4035,8 +4035,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -4705,6 +4705,97 @@ spec:
                                 must be set
                               rule: '[has(self.roleId),has(self.roleRef)].filter(x,x==true).size()
                                 == 1'
+                          kubernetes:
+                            description: |-
+                              Kubernetes authenticates with OpenBao by passing a ServiceAccount
+                              token to the [Kubernetes auth mechanism].
+
+                              [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+                            properties:
+                              path:
+                                default: kubernetes
+                                description: |-
+                                  Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+                                  "kubernetes"
+                                type: string
+                              role:
+                                description: |-
+                                  A required field containing the OpenBao Role to assume. A Role binds a
+                                  Kubernetes ServiceAccount with a set of OpenBao policies.
+                                minLength: 1
+                                type: string
+                              secretRef:
+                                description: |-
+                                  Optional secret field containing a Kubernetes ServiceAccount JWT used
+                                  for authenticating with OpenBao. If a name is specified without a key,
+                                  `token` is the default.
+                                properties:
+                                  key:
+                                    description: |-
+                                      A key in the referenced Secret.
+                                      Some instances of this field may be defaulted, in others it may be required.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[-._a-zA-Z0-9]+$
+                                    type: string
+                                  name:
+                                    description: The name of the Secret resource being
+                                      referred to.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      The namespace of the Secret resource being referred to.
+                                      Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                type: object
+                              serviceAccountRef:
+                                description: |-
+                                  Optional service account field containing the name of a Kubernetes ServiceAccount.
+                                  If the service account is specified, a token will be requested from the Kubernetes
+                                  TokenRequest API for authenticating with OpenBao.
+                                  Any configured audiences will be passed to the TokenRequest as-is.
+                                properties:
+                                  audiences:
+                                    description: |-
+                                      Audience specifies the `aud` claim for the service account token
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
+                                    items:
+                                      type: string
+                                    type: array
+                                  name:
+                                    description: The name of the ServiceAccount resource
+                                      being referred to.
+                                    maxLength: 253
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace of the resource being referred to.
+                                      Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                            required:
+                            - path
+                            - role
+                            type: object
+                            x-kubernetes-validations:
+                            - message: exactly one of the fields in [serviceAccountRef
+                                secretRef] must be set
+                              rule: '[has(self.serviceAccountRef),has(self.secretRef)].filter(x,x==true).size()
+                                == 1'
                           namespace:
                             description: |-
                               Name of the [OpenBao Namespace] to authenticate to. This can be different
@@ -4799,8 +4890,8 @@ spec:
                         type: object
                         x-kubernetes-validations:
                         - message: exactly one of the fields in [appRole tokenSecretRef
-                            userPass] must be set
-                          rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass)].filter(x,x==true).size()
+                            userPass kubernetes] must be set
+                          rule: '[has(self.appRole),has(self.tokenSecretRef),has(self.userPass),has(self.kubernetes)].filter(x,x==true).size()
                             == 1'
                       caBundle:
                         description: |-
@@ -5000,8 +5091,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -5532,8 +5623,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -6160,8 +6251,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -6209,8 +6300,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6256,8 +6347,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6431,8 +6522,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -6557,8 +6648,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -7637,8 +7728,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -7927,8 +8018,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -8266,8 +8357,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -8901,8 +8992,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -9336,8 +9427,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -9860,8 +9951,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -10268,8 +10359,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -10950,8 +11041,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -11125,8 +11216,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -11251,8 +11342,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array

config/crds/bases/generators.external-secrets.io_acraccesstokens.yaml

@@ -148,8 +148,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array

config/crds/bases/generators.external-secrets.io_cloudsmithaccesstokens.yaml

@@ -58,8 +58,8 @@ spec:
                   audiences:
                     description: |-
                       Audience specifies the `aud` claim for the service account token
-                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                      then this audiences will be appended to the list
+                      Some providers automatically extend the audience field based on well-known annotations for workload
+                      identity (e.g. IRSA or GCP Workload Identity)
                     items:
                       type: string
                     type: array

config/crds/bases/generators.external-secrets.io_clustergenerators.yaml

@@ -150,8 +150,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -396,8 +396,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -446,8 +446,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -650,8 +650,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -787,8 +787,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -1227,8 +1227,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -1302,8 +1302,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -1710,8 +1710,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array
@@ -1759,8 +1759,8 @@ spec:
                                           audiences:
                                             description: |-
                                               Audience specifies the `aud` claim for the service account token
-                                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                              then this audiences will be appended to the list
+                                              Some providers automatically extend the audience field based on well-known annotations for workload
+                                              identity (e.g. IRSA or GCP Workload Identity)
                                             items:
                                               type: string
                                             type: array
@@ -1808,8 +1808,8 @@ spec:
                                           audiences:
                                             description: |-
                                               Audience specifies the `aud` claim for the service account token
-                                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                              then this audiences will be appended to the list
+                                              Some providers automatically extend the audience field based on well-known annotations for workload
+                                              identity (e.g. IRSA or GCP Workload Identity)
                                             items:
                                               type: string
                                             type: array
@@ -1984,8 +1984,8 @@ spec:
                                           audiences:
                                             description: |-
                                               Audience specifies the `aud` claim for the service account token
-                                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                              then this audiences will be appended to the list
+                                              Some providers automatically extend the audience field based on well-known annotations for workload
+                                              identity (e.g. IRSA or GCP Workload Identity)
                                             items:
                                               type: string
                                             type: array
@@ -2110,8 +2110,8 @@ spec:
                                       audiences:
                                         description: |-
                                           Audience specifies the `aud` claim for the service account token
-                                          If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                          then this audiences will be appended to the list
+                                          Some providers automatically extend the audience field based on well-known annotations for workload
+                                          identity (e.g. IRSA or GCP Workload Identity)
                                         items:
                                           type: string
                                         type: array

config/crds/bases/generators.external-secrets.io_ecrauthorizationtokens.yaml

@@ -63,8 +63,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array

config/crds/bases/generators.external-secrets.io_gcraccesstokens.yaml

@@ -98,8 +98,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array
@@ -233,8 +233,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array

config/crds/bases/generators.external-secrets.io_quayaccesstokens.yaml

@@ -54,8 +54,8 @@ spec:
                   audiences:
                     description: |-
                       Audience specifies the `aud` claim for the service account token
-                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                      then this audiences will be appended to the list
+                      Some providers automatically extend the audience field based on well-known annotations for workload
+                      identity (e.g. IRSA or GCP Workload Identity)
                     items:
                       type: string
                     type: array

config/crds/bases/generators.external-secrets.io_stssessiontokens.yaml

@@ -62,8 +62,8 @@ spec:
                           audiences:
                             description: |-
                               Audience specifies the `aud` claim for the service account token
-                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                              then this audiences will be appended to the list
+                              Some providers automatically extend the audience field based on well-known annotations for workload
+                              identity (e.g. IRSA or GCP Workload Identity)
                             items:
                               type: string
                             type: array

config/crds/bases/generators.external-secrets.io_vaultdynamicsecrets.yaml

@@ -296,8 +296,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array
@@ -344,8 +344,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -391,8 +391,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -565,8 +565,8 @@ spec:
                                   audiences:
                                     description: |-
                                       Audience specifies the `aud` claim for the service account token
-                                      If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                      then this audiences will be appended to the list
+                                      Some providers automatically extend the audience field based on well-known annotations for workload
+                                      identity (e.g. IRSA or GCP Workload Identity)
                                     items:
                                       type: string
                                     type: array
@@ -691,8 +691,8 @@ spec:
                               audiences:
                                 description: |-
                                   Audience specifies the `aud` claim for the service account token
-                                  If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-                                  then this audiences will be appended to the list
+                                  Some providers automatically extend the audience field based on well-known annotations for workload
+                                  identity (e.g. IRSA or GCP Workload Identity)
                                 items:
                                   type: string
                                 type: array

docs/api/spec.md

@@ -8976,7 +8976,7 @@ resource is used as the app role secret.</p>
 <p>
 <p>OpenBaoAuth is the configuration used to authenticate with an OpenBao server.
 Currently the following authentication methods are supported: <a href="https://openbao.org/docs/auth/approle/">AppRole</a>,
-<a href="https://openbao.org/docs/auth/token/">Token</a> and <a href="https://openbao.org/docs/auth/userpass/">UserPass</a></p>
+<a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes</a>, <a href="https://openbao.org/docs/auth/token/">Token</a> and <a href="https://openbao.org/docs/auth/userpass/">UserPass</a></p>
 <p>Additional authentication methods are planned for future releases.</p>
 </p>
 <table>
@@ -9004,6 +9004,21 @@ with the role and secret stored in a Kubernetes Secret resource.</p>
 </tr>
 <tr>
 <td>
+<code>kubernetes</code></br>
+<em>
+<a href="#external-secrets.io/v1.OpenBaoKubernetesAuth">
+OpenBaoKubernetesAuth
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Kubernetes authenticates with OpenBao by passing a ServiceAccount
+token to the <a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes auth mechanism</a>.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>namespace</code></br>
 <em>
 string
@@ -9070,6 +9085,86 @@ OpenBaoUserPassAuth
 <td></td>
 </tr></tbody>
 </table>
+<h3 id="external-secrets.io/v1.OpenBaoKubernetesAuth">OpenBaoKubernetesAuth
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#external-secrets.io/v1.OpenBaoAuth">OpenBaoAuth</a>)
+</p>
+<p>
+<p>OpenBaoKubernetesAuth authenticates with OpenBao using the <a href="https://openbao.org/docs/auth/kubernetes/">Kubernetes
+auth mechanism</a> with a ServiceAccount token. The ServiceAccount token can be
+sourced from a ServiceAccount via <code>ServiceAccountRef</code> or from a secret
+via <code>SecretRef</code>.
+Using the controller pod&rsquo;s ServiceAccount token is not supported.</p>
+</p>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>path</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+&ldquo;kubernetes&rdquo;</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>serviceAccountRef</code></br>
+<em>
+<a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#ServiceAccountSelector">
+External Secrets meta/v1.ServiceAccountSelector
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Optional service account field containing the name of a Kubernetes ServiceAccount.
+If the service account is specified, a token will be requested from the Kubernetes
+TokenRequest API for authenticating with OpenBao.
+Any configured audiences will be passed to the TokenRequest as-is.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>secretRef</code></br>
+<em>
+<a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">
+External Secrets meta/v1.SecretKeySelector
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Optional secret field containing a Kubernetes ServiceAccount JWT used
+for authenticating with OpenBao. If a name is specified without a key,
+<code>token</code> is the default.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>role</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>A required field containing the OpenBao Role to assume. A Role binds a
+Kubernetes ServiceAccount with a set of OpenBao policies.</p>
+</td>
+</tr>
+</tbody>
+</table>
 <h3 id="external-secrets.io/v1.OpenBaoProvider">OpenBaoProvider
 </h3>
 <p>

go.mod

@@ -299,6 +299,7 @@ require (
 	github.com/ngrok/ngrok-api-go/v9 v9.0.0 // indirect
 	github.com/oapi-codegen/runtime v1.1.2 // indirect
 	github.com/openbao/openbao/api/auth/approle/v2 v2.5.1 // indirect
+	github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1 // indirect
 	github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1 // indirect
 	github.com/openbao/openbao/api/v2 v2.5.1-0.20260603121413-a08669ff09ec // indirect
 	github.com/ovh/okms-sdk-go v0.5.1 // indirect

go.sum

@@ -854,6 +854,8 @@ github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/openbao/openbao/api/auth/approle/v2 v2.5.1 h1:lg6EFF3ToQMITV+Kko773JqOEut9tE+P21dP8pgPaTg=
 github.com/openbao/openbao/api/auth/approle/v2 v2.5.1/go.mod h1:MVa7te0xhx07dldhEvCBxr5GZUUKuDrer60EKHdTmtQ=
+github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1 h1:yaFaJh92q3uScugQVHDXr3kHYBfYoSkuRulNwHC8OzM=
+github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1/go.mod h1:nb+BmPlRpz8EBFF/TUiziZGNjqiyXVFvCet/BfqA1OA=
 github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1 h1:81YQNOT/0wZJtp6zka9KAdUSADShkhocgb35CJH7r28=
 github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1/go.mod h1:uOtBhWrhgDf++LLD+XtdxKzDFv8cHUurnFz6kRw0+nE=
 github.com/openbao/openbao/api/v2 v2.5.1-0.20260603121413-a08669ff09ec h1:Cka9sTUAqBQBtTYSsOvkG99ojxUp1nlhixAbYl1wRYA=

providers/v1/openbao/client.go

@@ -28,7 +28,9 @@ import (
 	"time"
 
 	"github.com/openbao/openbao/api/v2"
+	authv1 "k8s.io/api/authentication/v1"
 	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8sClient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
@@ -156,6 +158,19 @@ func (c *client) setupAuth(ctx context.Context, kube k8sClient.Client, namespace
 			return err
 		}
 
+	case c.store.Auth.Kubernetes != nil:
+		kubernetes := c.store.Auth.Kubernetes
+
+		jwt, err := c.getJwt(ctx, kube, namespace)
+		if err != nil {
+			return err
+		}
+
+		auth, err = provider.AuthMethodFactory.Kubernetes(kubernetes.Role, jwt, kubernetes.Path)
+		if err != nil {
+			return err
+		}
+
 	default:
 		return fmt.Errorf("unsupported auth method") // this should not happen, because of CRD validation (unless a case is missing above)
 	}
@@ -357,3 +372,52 @@ func (c *client) Validate() (esv1.ValidationResult, error) {
 
 	return esv1.ValidationResultReady, nil
 }
+
+// getJwt retrieves a JWT token from the given Kubernetes ServiceAccount (`serviceAccountRef`) or Kubernetes secret (`secretRef`).
+func (c *client) getJwt(ctx context.Context, kube k8sClient.Client, namespace string) (string, error) {
+	kubernetesAuth := c.store.Auth.Kubernetes
+
+	if kubernetesAuth.ServiceAccountRef != nil {
+		var expirationSeconds int64 = 600
+
+		saNamespace := namespace
+		if c.storeKind == esv1.ClusterSecretStoreKind && kubernetesAuth.ServiceAccountRef.Namespace != nil {
+			saNamespace = *kubernetesAuth.ServiceAccountRef.Namespace
+		}
+
+		sa := &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      kubernetesAuth.ServiceAccountRef.Name,
+				Namespace: saNamespace,
+			},
+		}
+
+		tokenRequest := &authv1.TokenRequest{
+			Spec: authv1.TokenRequestSpec{
+				Audiences:         kubernetesAuth.ServiceAccountRef.Audiences,
+				ExpirationSeconds: &expirationSeconds,
+			},
+		}
+
+		if err := kube.SubResource("token").Create(ctx, sa, tokenRequest); err != nil {
+			return "", fmt.Errorf("cannot request Kubernetes service account token for service account %q: %w", kubernetesAuth.ServiceAccountRef.Name, err)
+		}
+
+		return tokenRequest.Status.Token, nil
+	}
+
+	if kubernetesAuth.SecretRef != nil {
+		tokenRef := kubernetesAuth.SecretRef
+		if tokenRef.Key == "" {
+			tokenRef = kubernetesAuth.SecretRef.DeepCopy()
+			tokenRef.Key = "token"
+		}
+		jwt, err := resolvers.SecretKeyRef(ctx, kube, c.storeKind, namespace, tokenRef)
+		if err != nil {
+			return "", err
+		}
+		return jwt, nil
+	}
+
+	return "", fmt.Errorf("serviceAccountRef or secretRef was not set. Unable to get a jwt")
+}

providers/v1/openbao/go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/onsi/gomega v1.39.1
 	github.com/openbao/openbao/api/auth/approle/v2 v2.5.1
+	github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1
 	github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1
 	github.com/openbao/openbao/api/v2 v2.5.1-0.20260603121413-a08669ff09ec
 	gopkg.in/dnaeon/go-vcr.v4 v4.0.6

providers/v1/openbao/go.sum

@@ -162,6 +162,8 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
 github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/openbao/openbao/api/auth/approle/v2 v2.5.1 h1:lg6EFF3ToQMITV+Kko773JqOEut9tE+P21dP8pgPaTg=
 github.com/openbao/openbao/api/auth/approle/v2 v2.5.1/go.mod h1:MVa7te0xhx07dldhEvCBxr5GZUUKuDrer60EKHdTmtQ=
+github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1 h1:yaFaJh92q3uScugQVHDXr3kHYBfYoSkuRulNwHC8OzM=
+github.com/openbao/openbao/api/auth/kubernetes/v2 v2.5.1/go.mod h1:nb+BmPlRpz8EBFF/TUiziZGNjqiyXVFvCet/BfqA1OA=
 github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1 h1:81YQNOT/0wZJtp6zka9KAdUSADShkhocgb35CJH7r28=
 github.com/openbao/openbao/api/auth/userpass/v2 v2.5.1/go.mod h1:uOtBhWrhgDf++LLD+XtdxKzDFv8cHUurnFz6kRw0+nE=
 github.com/openbao/openbao/api/v2 v2.5.1-0.20260603121413-a08669ff09ec h1:Cka9sTUAqBQBtTYSsOvkG99ojxUp1nlhixAbYl1wRYA=

providers/v1/openbao/internal/auth/impl.go

@@ -18,6 +18,7 @@ package auth
 
 import (
 	"github.com/openbao/openbao/api/auth/approle/v2"
+	"github.com/openbao/openbao/api/auth/kubernetes/v2"
 	"github.com/openbao/openbao/api/auth/userpass/v2"
 	"github.com/openbao/openbao/api/v2"
 )
@@ -38,5 +39,10 @@ func (authMethodFactory) UserPass(username, password, mount string) (api.AuthMet
 	}, userpass.WithMountPath(mount))
 }
 
+// Kubernetes implements [Factory].
+func (authMethodFactory) Kubernetes(role, jwt, mount string) (api.AuthMethod, error) {
+	return kubernetes.NewKubernetesAuth(role, kubernetes.WithServiceAccountToken(jwt), kubernetes.WithMountPath(mount))
+}
+
 // DefaultAuthMethodFactory implements [Factory].
 var DefaultAuthMethodFactory Factory = authMethodFactory{}

providers/v1/openbao/internal/auth/interface.go

@@ -33,4 +33,5 @@ import (
 type Factory interface {
 	UserPass(username, password, mount string) (api.AuthMethod, error)
 	AppRole(id, secret, mount string) (api.AuthMethod, error)
+	Kubernetes(role, jwt, mount string) (api.AuthMethod, error)
 }

providers/v1/openbao/internal/auth/mock.go

@@ -51,6 +51,12 @@ func (a *MockFactory) UserPass(username, password, mount string) (api.AuthMethod
 	return mockAuth{}, nil
 }
 
+// Kubernetes implements [Factory].
+func (a *MockFactory) Kubernetes(role, jwt, mount string) (api.AuthMethod, error) {
+	a.callf("Kubernetes(%q, %q, %q)", role, jwt, mount)
+	return mockAuth{}, nil
+}
+
 // GetCalls returns a list of all calls made to the mock (serialized as string), e.g.:
 //
 //	UserPass("user", "password", "mount")

providers/v1/openbao/provider.go

@@ -88,6 +88,18 @@ func isReferentSpec(prov *esv1.OpenBaoProvider) bool {
 		if auth.UserPass != nil && auth.UserPass.SecretRef.Namespace == nil {
 			return true
 		}
+
+		if auth.Kubernetes != nil {
+			kubernetes := auth.Kubernetes
+
+			if kubernetes.SecretRef != nil && kubernetes.SecretRef.Namespace == nil {
+				return true
+			}
+
+			if kubernetes.ServiceAccountRef != nil && kubernetes.ServiceAccountRef.Namespace == nil {
+				return true
+			}
+		}
 	}
 
 	if prov.CAProvider != nil && prov.CAProvider.Namespace == nil {

providers/v1/openbao/provider_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package openbao_test
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
@@ -33,10 +34,12 @@ import (
 	"github.com/go-viper/mapstructure/v2"
 	"gopkg.in/dnaeon/go-vcr.v4/pkg/cassette"
 	"gopkg.in/dnaeon/go-vcr.v4/pkg/recorder"
+	authv1 "k8s.io/api/authentication/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	clientfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 
 	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
 	esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
@@ -361,23 +364,52 @@ func TestProvider_KVv1(t *testing.T) {
 func TestProvider_Auth(t *testing.T) {
 	RegisterTestingT(t)
 
+	var tokenRequests []string
+	targetNamespace := "the-namespace"
+
 	kube := clientfake.NewClientBuilder().WithObjects(&corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "shared-secret",
 			Namespace: "default",
 		},
 		Data: map[string][]byte{
-			"approle-id":        []byte("dynamic-roleid"),
-			"approle-secret":    []byte("the-secret"),
-			"userpass-password": []byte("the-password"),
+			"approle-id":           []byte("dynamic-roleid"),
+			"approle-secret":       []byte("the-secret"),
+			"userpass-password":    []byte("the-password"),
+			"serviceaccount-token": []byte("the-jwt"),
+		},
+	}, &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "the-serviceaccount",
+			Namespace: "default",
 		},
-	}).Build()
+	},
+		&corev1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "the-serviceaccount",
+				Namespace: "the-namespace",
+			},
+		}).
+		// clientfake won't create service account token on its own. We use an interceptor to fake
+		// the jwt creation.
+		WithInterceptorFuncs(interceptor.Funcs{
+			SubResourceCreate: func(ctx context.Context, c client.Client, subResourceName string,
+				obj client.Object, subResource client.Object, _ ...client.SubResourceCreateOption) error {
+				tokenRequests = append(tokenRequests, obj.GetNamespace()+"/"+obj.GetName())
+				tr := subResource.(*authv1.TokenRequest)
+				tr.Status.Token = "the-serviceaccount-jwt"
+				return nil
+			},
+		}).Build()
+
 	provider := openbao.NewProvider().(*openbao.Provider)
 
 	cases := []struct {
-		name          string
-		auth          *esv1.OpenBaoAuth
-		expectedCalls []string
+		name                  string
+		clusterStore          bool
+		auth                  *esv1.OpenBaoAuth
+		expectedCalls         []string
+		expectedTokenRequests []string
 	}{{
 		name: "userpass",
 		auth: &esv1.OpenBaoAuth{
@@ -420,7 +452,49 @@ func TestProvider_Auth(t *testing.T) {
 			},
 		},
 		expectedCalls: []string{`AppRole("dynamic-roleid", "the-secret", "approlepath")`},
-	}}
+	}, {
+		name: "kubernetes jwt from secret",
+		auth: &esv1.OpenBaoAuth{
+			Kubernetes: &esv1.OpenBaoKubernetesAuth{
+				Path: "kubernetespath",
+				SecretRef: &esmeta.SecretKeySelector{
+					Name: "shared-secret",
+					Key:  "serviceaccount-token",
+				},
+				Role: "kubernetesrole",
+			},
+		},
+		expectedCalls: []string{`Kubernetes("kubernetesrole", "the-jwt", "kubernetespath")`},
+	}, {
+		name: "kubernetes jwt from service account",
+		auth: &esv1.OpenBaoAuth{
+			Kubernetes: &esv1.OpenBaoKubernetesAuth{
+				Path: "kubernetespath",
+				ServiceAccountRef: &esmeta.ServiceAccountSelector{
+					Name: "the-serviceaccount",
+				},
+				Role: "kubernetesrole",
+			},
+		},
+		expectedTokenRequests: []string{"default/the-serviceaccount"},
+		expectedCalls:         []string{`Kubernetes("kubernetesrole", "the-serviceaccount-jwt", "kubernetespath")`},
+	}, {
+		name:         "kubernetes jwt from service account with clusterstore",
+		clusterStore: true,
+		auth: &esv1.OpenBaoAuth{
+			Kubernetes: &esv1.OpenBaoKubernetesAuth{
+				Path: "kubernetespath",
+				ServiceAccountRef: &esmeta.ServiceAccountSelector{
+					Name:      "the-serviceaccount",
+					Namespace: &targetNamespace,
+				},
+				Role: "kubernetesrole",
+			},
+		},
+		expectedTokenRequests: []string{"the-namespace/the-serviceaccount"},
+		expectedCalls:         []string{`Kubernetes("kubernetesrole", "the-serviceaccount-jwt", "kubernetespath")`},
+	},
+	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -428,8 +502,20 @@ func TestProvider_Auth(t *testing.T) {
 			factory := &auth.MockFactory{}
 			provider.AuthMethodFactory = factory
 
-			store := makeValidSecretStoreWithVersion(esv1.OpenBaoKVStoreV2)
-			store.Spec.Provider.OpenBao.Auth = tc.auth
+			var store esv1.GenericStore
+			s := makeValidSecretStoreWithVersion(esv1.OpenBaoKVStoreV2)
+			s.Spec.Provider.OpenBao.Auth = tc.auth
+
+			if tc.clusterStore {
+				store = &esv1.ClusterSecretStore{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "cluster-store",
+					},
+					Spec: s.Spec,
+				}
+			} else {
+				store = s
+			}
 
 			client, err := provider.NewClient(t.Context(), store, kube, "default")
 			Expect(err).NotTo(HaveOccurred())

providers/v1/openbao/validate.go

@@ -72,6 +72,18 @@ func (p *Provider) ValidateStore(store esv1.GenericStore) (admission.Warnings, e
 				return nil, fmt.Errorf(errInvalidRef, "Auth.UserPass.SecretRef", err)
 			}
 		}
+		if auth.Kubernetes != nil {
+			if auth.Kubernetes.SecretRef != nil {
+				if err := esutils.ValidateReferentSecretSelector(store, *auth.Kubernetes.SecretRef); err != nil {
+					return nil, fmt.Errorf(errInvalidRef, "Auth.Kubernetes.SecretRef", err)
+				}
+			}
+			if auth.Kubernetes.ServiceAccountRef != nil {
+				if err := esutils.ValidateReferentServiceAccountSelector(store, *auth.Kubernetes.ServiceAccountRef); err != nil {
+					return nil, fmt.Errorf(errInvalidRef, "Auth.Kubernetes.ServiceAccountRef", err)
+				}
+			}
+		}
 	}
 
 	return nil, nil

tests/__snapshot__/clustersecretstore-v1.yaml

@@ -690,6 +690,17 @@ spec:
             key: string
             name: string
             namespace: string
+        kubernetes:
+          path: "kubernetes"
+          role: string
+          secretRef:
+            key: string
+            name: string
+            namespace: string
+          serviceAccountRef:
+            audiences: [] # minItems 0 of type string
+            name: string
+            namespace: string
         namespace: string
         tokenSecretRef:
           key: string

tests/__snapshot__/secretstore-v1.yaml

@@ -690,6 +690,17 @@ spec:
             key: string
             name: string
             namespace: string
+        kubernetes:
+          path: "kubernetes"
+          role: string
+          secretRef:
+            key: string
+            name: string
+            namespace: string
+          serviceAccountRef:
+            audiences: [] # minItems 0 of type string
+            name: string
+            namespace: string
         namespace: string
         tokenSecretRef:
           key: string