You are deploying Kubernetes resources/objects as Conjur identities. In addition to Namespace and Deployment, from which options can you choose?…

CyberArk Conjur's Kubernetes Authenticator allows mapping Kubernetes service identities to Conjur host identities. This identity is derived from the pod's metadata. Besides the high-level Deployment controller, Conjur also supports other primary workload controllers like StatefulSet, which is used for stateful applications.

Alternatively, the identity can be based on the pod's ServiceAccount. Using a ServiceAccount provides a flexible identity that is independent of the specific controller managing the pod, allowing multiple workloads to share the same Conjur identity and permissions. Both StatefulSet and ServiceAccount are officially supported and commonly used resources for defining Conjur identities.

B. Replica sets: While technically supported, a ReplicaSet is a lower-level controller typically managed by a Deployment. Defining identity at this level is less common and less robust for stable identity management.

C. Secrets: Kubernetes Secrets are objects used to store and manage sensitive information. They are consumed by applications, not used as an application's identity for authentication purposes.

D. Tokenreviews: TokenReview is a Kubernetes API object used by the API server to validate a service account token. It is part of the authentication mechanism, not the identity itself.

1. CyberArk Conjur Documentation

"Application identity in Kubernetes": This official document explicitly lists the supported Kubernetes resources for defining an application's identity. It states

"By default

the identity is based on the pod's controller. The supported controllers are: Deployment

StatefulSet

Job

CronJob

ReplicaSet... Alternatively

you can base the identity on the pod's service account." This directly supports StatefulSet (E) and ServiceAccount (A) as correct answers.

2. CyberArk Conjur Documentation

"Define a Kubernetes Authenticator policy (follower)": This guide on policy definition shows how host IDs are constructed from Kubernetes resources. It provides examples like host/my-app-namespace/deployment/my-app

illustrating the pattern where deployment can be replaced by other supported resource types

such as statefulset or serviceaccount

as specified in the identity documentation.