feat: add OIDC workload identity federation to secret provider plugins#636
Merged
Conversation
|
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | fe1ff22 | Commit Preview URL Branch Preview URL |
May 06 2026, 05:55 AM |
philmillman
reviewed
Apr 21, 2026
…r plugins Enable deployed environments (Vercel, GitHub Actions, Fly.io, GCP Cloud Run, GitLab CI) to authenticate with secret providers using short-lived OIDC tokens instead of long-lived credentials. Adds a shared OIDC token acquisition utility that auto-detects the deployment platform, and integrates OIDC as an auth option in 6 plugins: AWS (STS AssumeRoleWithWebIdentity), Azure (federated credential), GCP (Workload Identity Federation), HashiCorp Vault (JWT auth), Infisical (OIDC machine identity), and Akeyless (OIDC access type). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a shared OIDC guide at guides/oidc.mdx covering platform setup (Vercel, GitHub Actions, GitLab CI, Fly.io, GCP Cloud Run) and provider-specific configuration for all 6 supported plugins. Update each plugin README with OIDC auth section, updated auth priority order, and new parameter documentation. All READMEs link to the shared guide for platform-side setup details. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move provider-specific OIDC setup from the central guide into each plugin's doc page. The OIDC guide now links to plugin pages for setup details. Also adds OIDC to feature lists and auth priority docs for all affected plugins, and adds a bumpy changeset.
theoephraim
force-pushed
the
feat/oidc-workload-identity
branch
from
346c87e to
fe1ff22
Compare
Contributor
|
The changes in this PR will be included in the next version bump.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
@varlock/akeyless-plugin
@varlock/aws-secrets-plugin
@varlock/azure-key-vault-plugin
@varlock/google-secret-manager-plugin
@varlock/hashicorp-vault-plugin
@varlock/infisical-plugin
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/utils/src/oidc-tokens.ts) that auto-detects 5 deployment platforms (Vercel, GitHub Actions, GitLab CI, Fly.io, GCP Cloud Run)AssumeRoleWithWebIdentityvia newoidcRoleArnparamtenantId+clientIdprovided withoutclientSecretworkloadIdentityProviderparamjwtRoleparamidentityIdparam (alternative to Universal Auth)oidcAccessIdparamoidcTokenparam for custom OIDC providersThis enables deployed environments to authenticate with secret providers using short-lived OIDC tokens instead of long-lived credentials — no secrets needed to fetch secrets.
Test plan
bun run lint:fix)id-token: writepermission🤖 Generated with Claude Code