feat: add OIDC workload identity federation to secret provider plugins#636
Open
theoephraim wants to merge 2 commits intomainfrom
Open
feat: add OIDC workload identity federation to secret provider plugins#636theoephraim wants to merge 2 commits intomainfrom
theoephraim wants to merge 2 commits intomainfrom
Conversation
…r plugins Enable deployed environments (Vercel, GitHub Actions, Fly.io, GCP Cloud Run, GitLab CI) to authenticate with secret providers using short-lived OIDC tokens instead of long-lived credentials. Adds a shared OIDC token acquisition utility that auto-detects the deployment platform, and integrates OIDC as an auth option in 6 plugins: AWS (STS AssumeRoleWithWebIdentity), Azure (federated credential), GCP (Workload Identity Federation), HashiCorp Vault (JWT auth), Infisical (OIDC machine identity), and Akeyless (OIDC access type). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Add a shared OIDC guide at guides/oidc.mdx covering platform setup (Vercel, GitHub Actions, GitLab CI, Fly.io, GCP Cloud Run) and provider-specific configuration for all 6 supported plugins. Update each plugin README with OIDC auth section, updated auth priority order, and new parameter documentation. All READMEs link to the shared guide for platform-side setup details. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 346c87e | Commit Preview URL Branch Preview URL |
Apr 21 2026, 06:05 AM |
philmillman
reviewed
Apr 21, 2026
| # @initAws(region=us-east-1, oidcRoleArn="arn:aws:iam::123:role/my-role", oidcToken=$MY_OIDC_TOKEN) | ||
| ``` | ||
|
|
||
| ## Plugin-specific setup |
Member
There was a problem hiding this comment.
do we need this repetition from each of the plugins? Maybe we just have a rolled up list and link out the their respective OIDC sections?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/utils/src/oidc-tokens.ts) that auto-detects 5 deployment platforms (Vercel, GitHub Actions, GitLab CI, Fly.io, GCP Cloud Run)AssumeRoleWithWebIdentityvia newoidcRoleArnparamtenantId+clientIdprovided withoutclientSecretworkloadIdentityProviderparamjwtRoleparamidentityIdparam (alternative to Universal Auth)oidcAccessIdparamoidcTokenparam for custom OIDC providersThis enables deployed environments to authenticate with secret providers using short-lived OIDC tokens instead of long-lived credentials — no secrets needed to fetch secrets.
Test plan
bun run lint:fix)id-token: writepermission🤖 Generated with Claude Code