Skip to content

feat: Support workload identity federation flow #4074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
JorTurFer wants to merge 22 commits into
base: main
Choose a base branch
from
Open

feat: Support workload identity federation flow #4074

JorTurFer wants to merge 22 commits into from
+1,086 −574

Conversation

@JorTurFer
Copy link

@JorTurFer JorTurFer commented Dec 10, 2025 •
edited
Loading

Description

This PR supports incoming Workload Identity Federation flow. New environment variables have been added to allow default configuration:

  • "STACKIT_SERVICE_ACCOUNT_EMAIL" -> Service account email (this isn't new but it was deprecated and deprecation has been removed)
  • "STACKIT_FEDERATED_TOKEN_FILE" -> Directory where the assertion token is placed
  • "STACKIT_IDP_ENDPOINT" -> IDP endpoint to exchange the token
  • "STACKIT_IDP_EXPIRATION_SECONDS" -> Sets token duration. Not used yet but added for SDK downstream proposes.

Except STACKIT_SERVICE_ACCOUNT_EMAIL, all of them have default values (prod values)

This is a new auth method that will be publicly shipped during next weeks

Checklist

  • No generated code was adjusted manually (check comments in file header)
  • Changelogs
    • Changelog in the root directory was adjusted (see here)
    • Changelog(s) of the service(s) were adjusted (see e.g. here)
  • VERSION file(s) of the service(s) were adjusted
  • Code format was applied: make fmt
  • Examples were added / adjusted (see examples/ directory)
  • Unit tests got implemented or updated
  • Unit tests are passing: make test (will be checked by CI)
  • No linter issues: make lint (will be checked by CI)

@JorTurFer JorTurFer requested a review from a team as a code owner December 10, 2025 11:02
marceljk
marceljk reviewed Dec 15, 2025
View reviewed changes
@JorTurFer JorTurFer mentioned this pull request Jan 7, 2026
Draft
8 tasks
marceljk
marceljk reviewed Jan 7, 2026
View reviewed changes
marceljk
marceljk reviewed Jan 7, 2026
View reviewed changes
JorTurFer and others added 16 commits January 7, 2026 16:03
@JorTurFer
feat: Remove refresh_token grant type
91fc4a8 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
Update changelogs
3a0b673 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
update exp time of assertion as access token CAN'T be longer that it
60a09f7 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
Update changelogs
f8da09d 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
feat: Support Workload Identity Federation flow
85275f2 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
update changelog
711502e 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
apply feedback
7dd73c1 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
apply feedback
ed9d1b4 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
apply feedback
796fb6d 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
apply feedback
dc427ec 
Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>
@JorTurFer
remove docs from PR
6e3169f 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
remove docs from PR
28d4a02 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
remove docs from PR
61b2cd4 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
remove docs from PR
76a1610 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
add static token
845a48f 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
fix linting issues
f540b0b 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
marceljk
marceljk previously approved these changes Jan 7, 2026
View reviewed changes
@JorTurFer
fix panic
675a8b5 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
marceljk
marceljk previously approved these changes Jan 7, 2026
View reviewed changes
@JorTurFer
replace wif assertion options with a func
5e41dc3 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
marceljk
marceljk reviewed Jan 8, 2026
View reviewed changes
core/clients/workload_identity_flow.go Outdated
Comment on lines 33 to 38
func getEnvOrDefault(envVar, defaultValue string) string {
if value := os.Getenv(envVar); value != "" {
return value
}
return defaultValue
}
Copy link
Contributor

@marceljk marceljk Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could be moved to utils pkg. This can be useful in some other places as well and you also added a similar function in your terraform pr, which can be probably replaced by this one as well

Copy link
Author

@JorTurFer JorTurFer Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll move it but it can be replaced on terraform because the terraform one is coupled to terraform types

@JorTurFer JorTurFer mentioned this pull request Jan 8, 2026
Draft
Fyusel
Fyusel reviewed Jan 12, 2026
View reviewed changes
@JorTurFer
apply feedback
027987b 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
apply feedback
60c10fb 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
move GH requester to SDK
265f147 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
move GH requester to SDK
1da4767 
Signed-off-by: Jorge Turrado <jorge_turrado@hotmail.es>
@JorTurFer
Copy link
Author

JorTurFer commented Jan 12, 2026

Updated comments 😄

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marceljk marceljk marceljk left review comments

@Fyusel Fyusel Fyusel approved these changes

Assignees

No one assigned

Labels

ignore-stale

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@JorTurFer @Fyusel @marceljk