Documentation
¶
Overview ¶
Package workloadidentity implements OIDC workload identity tokens for sandbox containers, following the GitHub Actions OIDC pattern.
Trust Model ¶
Each cluster is its own OIDC issuer with an independent signing key and JWKS endpoint. New clusters sign with RS256 (RSA), the universally supported default; clusters provisioned before that default keep their EdDSA key advertised in JWKS for verification while new tokens are signed with a freshly generated RS256 key. Miren Cloud is not in the trust path — it only contributes organization_id and cluster_id as claim metadata during registration. This per-cluster model means external verifiers (e.g., AWS IAM OIDC) must configure trust per cluster rather than once for all of Miren. A future central issuer could reduce that to one trust config scoped by claims, but would introduce a single point of compromise for all clusters.
Issuer URL (iss claim) ¶
The issuer URL is the cluster's cryptographic identity anchor — it's baked into every token and pinned in external trust configurations. For cloud-registered clusters, this is the provisioned DNS hostname (e.g., https://cluster-abc.miren.systems). For bare-metal clusters without registration, it falls back to cfg.TLS.AdditionalNames[0], meaning the identity anchor is determined by config list order. This fallback is intentionally simple for v1; a more deliberate selection mechanism (e.g., explicit --issuer-url flag) may be warranted if bare-metal OIDC federation sees adoption.
Index ¶
- Constants
- type Issuer
- func (iss *Issuer) DiscoveryDocument() []byte
- func (iss *Issuer) Hostname() string
- func (iss *Issuer) IssueToken(app, sandboxID string) (string, error)
- func (iss *Issuer) IssueTokenWithOptions(app, sandboxID string, opts TokenOptions) (string, error)
- func (iss *Issuer) IssuerURL() string
- func (iss *Issuer) JWKSDocument() ([]byte, error)
- func (iss *Issuer) PublicKey() any
- type IssuerConfig
- type TokenIssuer
- type TokenOptions
- type WorkloadClaims
Constants ¶
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Issuer ¶
type Issuer struct {
// contains filtered or unexported fields
}
func NewIssuer ¶
func NewIssuer(cfg IssuerConfig) (*Issuer, error)
func (*Issuer) DiscoveryDocument ¶
func (*Issuer) IssueTokenWithOptions ¶
func (iss *Issuer) IssueTokenWithOptions(app, sandboxID string, opts TokenOptions) (string, error)
func (*Issuer) JWKSDocument ¶
type IssuerConfig ¶
type TokenIssuer ¶
type TokenIssuer interface {
IssueToken(app, sandboxID string) (string, error)
IssueTokenWithOptions(app, sandboxID string, opts TokenOptions) (string, error)
IssuerURL() string
}
TokenIssuer is the minting surface the sandbox controller depends on. The concrete *Issuer satisfies it directly (the coordinator holds the signing key). Distributed runners have no signing key, so they supply an implementation that proxies minting to the coordinator over RPC.
Source Files