<p>For an application deployed in Kubernetes would there be any suggested guidance documentation for SAML integration? My search foo is deserting me.</p>
<p>Most documentation are for the Kubernetes itself and not the application. The application would not be aware of Kubernetes RBAC etc.</p>

<p>In the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies" rel="nofollow noreferrer">official documentation</a> you can find the following section:</p>
<blockquote>
<p>Kubernetes uses client certificates, bearer tokens, or an authenticating proxy to authenticate API requests through authentication plugins. As HTTP requests are made to the API server, plugins attempt to associate the following attributes with the request:</p>
<ul>
<li>Username: a string which identifies the end user. Common values might be  <code>kube-admin</code>  or  <code>jane@example.com</code>.</li>
<li>UID: a string which identifies the end user and attempts to be more consistent and unique than username.</li>
<li>Groups: a set of strings, each of which indicates the user's membership in a named logical collection of users. Common values might be  <code>system:masters</code>  or  <code>devops-team</code>.</li>
<li>Extra fields: a map of strings to list of strings which holds additional information authorizers may find useful.</li>
</ul>
<p>All values are opaque to the authentication system and only hold significance when interpreted by an  <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">authorizer</a>.</p>
<p>You can enable multiple authentication methods at once. You should usually use at least two methods:</p>
<ul>
<li>service account tokens for service accounts</li>
<li>at least one other method for user authentication.</li>
</ul>
<p>When multiple authenticator modules are enabled, the first module to successfully authenticate the request short-circuits evaluation. The API server does not guarantee the order authenticators run in.</p>
<p>The  <code>system:authenticated</code>  group is included in the list of groups for all authenticated users.</p>
<p><strong>Integrations with other authentication protocols (LDAP, SAML, Kerberos, alternate x509 schemes, etc) can be accomplished using an  <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy" rel="nofollow noreferrer">authenticating proxy</a>  or the  <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication" rel="nofollow noreferrer">authentication webhook</a>.</strong></p>
</blockquote>
<p>As you can see to add SAML to your configuration you can use  <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy" rel="nofollow noreferrer">authenticating proxy</a>  or the  <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication" rel="nofollow noreferrer">authentication webhook</a>.</p>
<p>If you search an example how to set SAML in Kubernetes, you can read <a href="https://goteleport.com/blog/kubernetes-sso-saml/" rel="nofollow noreferrer">this article</a>.</p>
<p>However, in the vast majority of cases, SAML will extend (rather than replace) the RBAC functionality. See also article <a href="https://goteleport.com/blog/how-saml-authentication-works/" rel="nofollow noreferrer">How SAML 2.0 Authentication Works?</a></p>
