From streamnative-agent-skills
Manage StreamNative Cloud identity and access control — users, service accounts, service-account bindings, roles, role bindings, API keys, secrets, OIDC providers, and identity pools. Use when the user asks about permissions, RBAC, credentials, `apikey`, "who can access what", or federated login. For activating an exported service-account key on a machine, use cloud-core.
How this skill is triggered — by the user, by Claude, or both
Slash command
/streamnative-agent-skills:identityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- User asks to create a user, service account, role, role binding, or API key.
assets/manifests/identitypool.yamlassets/manifests/oidcprovider.yamlassets/manifests/role.yamlassets/manifests/rolebinding.yamlassets/manifests/secret.yamlassets/manifests/serviceaccount-binding.yamlassets/manifests/serviceaccount.yamlassets/manifests/user.yamlreferences/api-keys.mdreferences/oidc-identity-pools.mdreferences/rbac-model.mdreferences/secrets.mdreferences/service-accounts.mdPrefer StreamNative Cloud remote MCP when available: use sncloud_identity_read / sncloud_identity_write for supported identity resources; use sncloud_resource_catalog / sncloud_resource_schema before writes. See ../cloud-core/references/remote-mcp.md. Use snctl fallback for APIKey, Secret, and service-account key export/activation because current remote MCP surface does not manage them.
Remote MCP route: start with sncloud_context_whoami, then catalog/schema for identity domain. snctl route: standard checks (see cloud-core). Identity mutations require admin-tier permissions in the target org — if calls 403, the acting principal itself needs a ServiceAccountBinding to an admin ClusterRole.
Two kinds of principals:
OIDCProvider + IdentityPool).APIKey.Authorization comes in two layers:
ServiceAccountBinding → ClusterRole (admin, editor, viewer). Governs what the SA can do via snctl (create clusters, etc.).Role + RoleBinding. Scoped to a Pulsar tenant/namespace; governs produce/consume/functions/sinks/sources.Secret is a separate kind (standard Kubernetes Secret) for storing credentials consumed by workspace functions and connectors.
For remote MCP writes, compose JSON-string manifests and call sncloud_identity_write with operation=apply, dry_run=true; only repeat with dry_run=false after validation. Use sncloud_identity_read for list/get. Do not use remote MCP for APIKey or Secret lifecycle; use snctl workflows below.
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/serviceaccount.yaml
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/serviceaccount-binding.yaml
# Export its private key (for activation elsewhere — see cloud-core)
snctl auth export-service-account my-sa -n my-org -O my-org --key-file ./my-sa.json
# Create SA first (W1), then:
snctl create apikey my-key --service-account-name my-sa --expiration-time 30d -O my-org
# Or with an absolute expiration
snctl create apikey my-key --service-account-name my-sa --expiration-time "2026-06-01T00:00:00Z" -O my-org
# Revoke
snctl revoke apikey my-key -O my-org
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/role.yaml
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/rolebinding.yaml
snctl get role,rolebinding -n my-org -o yaml
User.metadata.name must be the invite email address.
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/user.yaml
# An invite email is sent to spec.email; the user accepts via the Console
snctl get user [email protected] --organization my-org
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/oidcprovider.yaml
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/identitypool.yaml
# After this, users in the pool can log in via their corporate IdP
snctl apply -f ${CLAUDE_PLUGIN_ROOT}/skills/identity/assets/manifests/secret.yaml
snctl get secret my-secret -n my-org -o yaml
snctl get serviceaccount,user,role,rolebinding,apikey,secret -n my-org
snctl describe serviceaccount my-sa -n my-org
snctl delete apikey my-key -O my-org
snctl delete rolebinding my-rolebinding -n my-org
snctl delete role my-role -n my-org
snctl delete serviceaccountbinding my-sa-binding -n my-org
snctl delete serviceaccount my-sa -n my-org
APIKey or StreamNative Cloud Secret; keep those snctl-only.sncloud_identity_write manifest is JSON string, not YAML/object. Omit status and read-only metadata copied from read output.Secret objects are NOT encrypted at rest in the exported YAML; treat them as sensitive and NEVER commit real values.--expiration-time 0 means "never expires" — strongly discouraged; prefer a TTL like 30d or 90d.ServiceAccountBinding grants CONTROL-plane permissions (what the SA can do via snctl); RoleBinding grants DATA-plane permissions (what the SA can do on Pulsar topics). These are independent and both may be needed.User does NOT invalidate their active sessions immediately; use the Console to force-sign-out.IdentityPool claim mappings must match the upstream IdP's actual claims — verify by decoding a sample JWT from the IdP (jwt.io).ClusterRole is a pre-defined set (typically admin, editor, viewer); you do NOT create custom cluster roles via snctl.produce, consume, functions, sinks, sources. Anything else is rejected.npx claudepluginhub streamnative/streamnative-agent-skills --plugin streamnative-agent-skillsSearches MemPalace before answering questions about past work, people, projects, or prior decisions. Returns verbatim stored content instead of guessing from model memory.
Guides Payload CMS config (payload.config.ts), collections, fields, hooks, access control, APIs. Debugs validation errors, security, relationships, queries, transactions, hook behavior.
Implements vector databases with Pinecone, Weaviate, Qdrant, Milvus, pgvector for semantic search, RAG, recommendations, and similarity systems. Optimizes embeddings, indexing, and hybrid search.