<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Pod Identity Management — API Reference

## kubectl Service Account Queries

```bash
# List all service accounts
kubectl get serviceaccount -A -o json

# Find pods using default SA
kubectl get pods -A -o json | \
  jq '.items[] | select(.spec.serviceAccountName == "default")'

# Check automount settings
kubectl get sa -A -o json | \
  jq '.items[] | select(.automountServiceAccountToken != false)'

# List projected token volumes
kubectl get pods -A -o json | \
  jq '.items[].spec.volumes[]? | select(.projected)'
```

## AWS IRSA API

| Field | Description |
|-------|-------------|
| `eks.amazonaws.com/role-arn` | SA annotation for IAM role binding |
| `sts:AssumeRoleWithWebIdentity` | Action for OIDC federation |
| `Condition.StringEquals` | Scope trust to specific SA |

## GCP Workload Identity API

| Field | Description |
|-------|-------------|
| `iam.gke.io/gcp-service-account` | SA annotation for GSA binding |
| `roles/iam.workloadIdentityUser` | Required IAM role for binding |
| `PROJECT.svc.id.goog[NS/KSA]` | Workload identity member format |

## Azure Workload Identity API

| Field | Description |
|-------|-------------|
| `azure.workload.identity/client-id` | SA annotation for managed identity |
| `azure.workload.identity/tenant-id` | AAD tenant identifier |
| `azure.workload.identity/use` | Pod label to enable token injection |
