Learn: Identity & Access
Who — and what — is allowed to do things on this platform, and how that’s controlled from one git source of truth instead of a dozen consoles. The human and machine side of “least privilege, nothing standing.”
Written for platform engineers who operate access; developers get the short version at the end of the orientation. It covers the biggest pieces in one module — workload identity, temporary power, and the governance registry may split out later. Already fluent? Go straight to the Reference.
Read the domain model (Team / Product) first, and ideally the security model.
Read in this order
Section titled “Read in this order”- Orientation — the teaching path. The one idea (decide once in git, derive everywhere,
trust nothing permanently), the two subjects (humans via Keycloak, workloads via Pod Identity), the roster
and role catalog, and temporary power — dangerous roles you borrow, not hold. Real
Person,WorkforceRole, and Pod Identity examples. - Reference — look-up: the three planes, the role axes, projection targets, the temporary-power mechanism, workload identity, and the gotchas (declared ≠ effected).
To go deeper on the real system
Section titled “To go deeper on the real system”- The security framing: The Security Model.
- Architecture (north star): Identity & Access Strategy.