DOCSP-47923: kubernetes oidc

source/security/enterprise-authentication.txt

@@ -390,6 +390,55 @@ see the corresponding syntax.
          :end-before: // end-gcp-oidc-mongocredential
          :language: java
 
+.. _java-rs-auth-kubernetes:
+
+Kubernetes
+++++++++++
+
+If your application runs on a Kubernetes cluster, you can authenticate
+to MongoDB by using the {+driver-short+}'s built-in Kubernetes support.
+
+Select from the :guilabel:`Connection String` or
+:guilabel:`MongoCredential` tabs to see the corresponding syntax.
+
+.. tabs::
+
+   .. tab:: Connection String
+      :tabid: mongodb-kubernetes-connection-string
+
+      To specify Kubernetes OIDC as the authentication mechanism, set the following 
+      options in your connection string:
+
+      - ``authMechanism``: Set to ``MONGODB-OIDC``.
+      - ``authMechanismProperties``: Set to ``ENVIRONMENT:k8s``. 
+
+      .. code-block:: java
+         :emphasize-lines: 4
+
+         MongoClient mongoClient = MongoClients.create(
+            "mongodb://<hostname>:<port>/" +
+            "?authMechanism=MONGODB-OIDC" +
+            "&authMechanismProperties=ENVIRONMENT:k8s");
+
+   .. tab:: MongoCredential
+      :tabid: mongodb-kubernetes-mongo-credential
+
+      Replace the ``hostname`` and ``port`` with the network address and port 
+      number of your MongoDB deployment.
+
+      .. code-block:: java
+         :emphasize-lines: 2
+
+         MongoCredential credential = MongoCredential.createOidcCredential(null)
+            .withMechanismProperty("ENVIRONMENT", "k8s");
+
+         MongoClient mongoClient = MongoClients.create(
+            MongoClientSettings.builder()
+               .applyToClusterSettings(builder ->
+                      builder.hosts(Arrays.asList(new ServerAddress("<hostname>", <port>))))
+               .credential(credential)
+               .build());
+
 Custom Callback
 +++++++++++++++
 

source/whats-new.txt

@@ -44,6 +44,11 @@ and features:
       :ref:`java-rs-client-bulk-write-replace` sections of the Bulk
       Write Operations guide
 
+   .. replacement:: k8s-link
+
+      the :ref:`MONGODB-OIDC: Kubernetes <java-rs-auth-kubernetes>`
+      section of the Enterprise Authentication Mechanisms guide
+
 .. _javars-version-5.3:
 
 What's New in 5.3