Update README documentation

Author: irby

README.md

@@ -289,6 +289,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
     | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA`                                                              |
     | certificateAuthorityHostname   | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA.                                                                     |
     | certificateTemplate     | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs.                                                                        |
+    | scopes     | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable.   |
+    | audience     | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`.  |
 
     > If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration.
 
@@ -314,6 +316,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
           # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
           certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
           certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
+
+          # scopes: "openid email https://example.com/.default" # Uncomment if desired
+          # audience: "https://your-command-url.com" # Uncomment if desired
         EOF
 
         kubectl -n default apply -f issuer.yaml
@@ -338,6 +343,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
           # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
           certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
           certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
+
+          # scopes: "openid email https://example.com/.default" # Uncomment if desired
+          # audience: "https://your-command-url.com" # Uncomment if desired
         EOF
 
         kubectl apply -f clusterissuer.yaml
@@ -469,4 +477,4 @@ Apache License 2.0, see [LICENSE](LICENSE).
 
 ## Related Integrations
 
-See all [Keyfactor integrations](https://github.com/topics/keyfactor-integration).
+See all [Keyfactor integrations](https://github.com/topics/keyfactor-integration).