docs: Add section for Kuberentes plugin Auth

Signed-off-by: Carlos Esteban Lopez <lcarlosesteb@vmware.com>

.changeset/few-nails-search.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes': patch
+---
+
+Add docs section for Kubernetes plugin Auth.

docs/features/kubernetes/authentication.md

@@ -0,0 +1,26 @@
+---
+id: kubernetes-auth
+title: Kubernetes Authentication
+description: Authentication in kubernetes plugin
+---
+
+The authentication process in kubernetes is basically separate from backstage auth, the
+providers are configured so your kubernetes plugin can locate and access the clusters you
+have access to, the providers currently available are categorized in server side auth and
+client side auth, here's the list:
+
+## Server Side Providers
+
+These providers authenticate your application with the clusters, meaning anyone that is
+logged in into your backstage app will be able to access the same clusters, the providers
+available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure`
+and `localKubectlProxy`.
+
+## Client Side Providers
+
+These providers authenticate your user with the cluster, each user will be requested for
+credentials and will have access to the clusters as long as the user has been authorized
+to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the
+config, but the user hasn't been authorized to access, the user will see the cluster
+listed but will not see any resources in the plugin page for that cluster, and the error
+will show as `401` or similar, current providers available are `google` and `oidc`.

docs/features/kubernetes/configuration.md

@@ -110,6 +110,8 @@ cluster. Valid values are:
 | `azure`                | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters                                                                   |
 | `oidc`                 | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. |
 
+Check the [Kubernetes Authentication][4] section for additional explanation.
+
 ##### `clusters.\*.skipTLSVerify`
 
 This determines whether the Kubernetes client verifies the TLS certificate
@@ -477,3 +479,4 @@ for more info.
 [1]: https://cloud.google.com/kubernetes-engine
 [2]: https://cloud.google.com/docs/authentication/production#linux-or-macos
 [3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
+[4]: https://https://backstage.io/docs/features/kubernetes/authentication

mkdocs.yml

@@ -55,6 +55,7 @@ nav:
           - Overview: 'features/kubernetes/index.md'
           - Installation: 'features/kubernetes/installation.md'
           - Configuration: 'features/kubernetes/configuration.md'
+          - Authentication: 'features/kubernetes/authentication.md'
           - Troubleshooting: 'features/kubernetes/troubleshooting.md'
       - Software Templates:
           - Overview: 'features/software-templates/index.md'