About authentication¶
Connection for Next-Gen Trust Security (Connection resource) authenticates to NGTS through a Built-in Account using a private key JSON Web Token (JWT) or Workload Identity Federation (WIF).
Private key JWT¶
With private key JWT, Connection resource reads a private key from a Kubernetes Secret, signs a short-lived JWT, and exchanges it for an Open Authorization (OAuth) bearer token. When you create a Built-in Account, NGTS generates the private key or you supply your own key pair.
Setup is once per cluster, per component. After that, Connection resource automatically generates and renews tokens.
Workload Identity Federation¶
With WIF, Connection resource requests a ServiceAccount token from the Kubernetes API and sends it to NGTS for validation. Kubernetes acts as the OIDC provider, so no secret material is stored in the cluster.
When you create the Built-in Account, you configure it to trust the cluster's OIDC issuer by providing the issuer URL, subject, and audience.
Built-in Accounts in workspaces
If the Built-in Account belongs to a workspace, set workspaceID in the Connection resource to the ID of that workspace. Without it, NGTS only looks for Built-in Accounts that don't belong to a workspace, and authentication fails with a Not found error. Private key JWT doesn't need a workspace ID, because NGTS finds the account by its Client ID.
What's next?¶
Configure Connection resource to authenticate with NGTS using either private key JWT or Workload Identity Federation.