Introduce support for OIDC workload identity federation#3711
Merged
rchincha merged 6 commits intoproject-zot:mainfrom Jan 25, 2026
Merged
Introduce support for OIDC workload identity federation#3711rchincha merged 6 commits intoproject-zot:mainfrom
rchincha merged 6 commits intoproject-zot:mainfrom
Conversation
Contributor
|
Not sure why the complete ci/cd didn't run |
Contributor
Maybe amend and push again? |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
3d55cfb to
f1de3ac
Compare
Contributor
Author
done, also fixed linting and commit msg |
Contributor
Author
It's because most of the GH workflows run on PRs targeting the pull_request:
branches:
- mainI'd say, merge this and let's fix any issues in the main PR branch |
Contributor
|
@matheuscscp I suggest "adopting" the copilot PR and posting changes against |
matheuscscp
changed the title
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
f1de3ac to
b72f3c4
Compare
Contributor
Author
|
@rchincha Done, I just changed the target branch to |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #3711 +/- ##
==========================================
+ Coverage 91.57% 91.58% +0.01%
==========================================
Files 186 189 +3
Lines 26489 26846 +357
==========================================
+ Hits 24258 24588 +330
- Misses 1444 1459 +15
- Partials 787 799 +12 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
|
@matheuscscp pls take a look at the ci failures. Ideally, once your changes are done, a e2e test script should be added under |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
b72f3c4 to
386b836
Compare
Contributor
Author
|
@rchincha Can you pls approve the workflow runs? |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
386b836 to
7b0a7c4
Compare
Contributor
Author
|
@rchincha I think I fixed at least 3 of the red checks now, please reapprove the workflows 🙏 I'll continue tomorrow 👌 |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
7b0a7c4 to
6d65abd
Compare
Contributor
Author
|
@rchincha Pls approve one more time, I think now I fixed both coverage red checks |
Contributor
|
@matheuscscp pls also rebase, will re-run workflows |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
6d65abd to
c1120d8
Compare
Contributor
Author
|
@rchincha I fixed the golangci-lint errors again and rebased. One of the red checks seemed unrelated and the other was about the binary size growing 11%, which I can't do anything about 🤷 😁 Please re-approve 🙏 |
Contributor
|
@matheuscscp do you want to try this patch for your original issue and see if it fixes it? |
Contributor
|
| zot minimal binary increased by 12.71% comparing with main | PR binary size: 53870945 Bytes where is this size increase coming from? |
Contributor
Contributor
Author
Binary Size Increase AnalysisThe ~12.7% increase (from 47.8MB to 53.9MB) is expected and comes primarily from the new dependencies added to support OIDC workload identity federation with CEL expressions: Main contributors:
Why the minimal binary specifically?The minimal binary is built with Is there an alternative?The CEL dependency is intentional for the feature - it enables powerful claim mapping like:
Without CEL, users would have much more limited claim mapping options. CEL was specifically chosen to match the flexibility of GCP's workload identity federation and Flux Operator OIDC features. SummaryYes, this increase is expected. The feature adds a substantial capability (OIDC workload identity with CEL expressions) that requires the CEL library. Since this is core authentication code, it affects the minimal binary which previously didn't include CEL's transitive dependencies. |
Contributor
|
Here is an outline for adding a kind test And invoked as a nightly like so This PR should be complete after this (we are close) |
Contributor
Author
|
@rchincha Dex is not the right choice for this test. The main use case here is verifying OIDC tokens issued by Kubernetes itself. Kubernetes does this by default, no configuration is needed except for a few minor fine-tunings. Every single ServiceAccount token issued by Kubernetes is, by design, an OIDC token :) The only heavy lifting we need here is using the CA of the Leave this with me 👌 |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
9653126 to
ba46bff
Compare
andaaron
previously approved these changes
Jan 24, 2026
Contributor
Author
|
I'm fixing the linter errors |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
2 times, most recently
from
314ed33 to
5dae0fa
Compare
andaaron
reviewed
Jan 24, 2026
Contributor
Author
OIDC Workload Identity E2E Test ScriptThis commit adds a comprehensive e2e test script ( Features for Local IterationThe script supports fast iteration with these flags:
Test Cases
Key validations:
Raw Test Logs (click to expand) |
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
5dae0fa to
2c79741
Compare
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
d0bab10 to
bb4451f
Compare
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
matheuscscp
force-pushed
the
improve-oidc-wid
branch
from
bb4451f to
9e20672
Compare
Contributor
Author
|
@andaaron Hopefully this was the last push 🙏 |
Contributor
Author
|
@andaaron Can you please retrigger the 3 test jobs? I think they are unrelated since only the golangci-lint was red before my push and all I did was gofmt a file (included an empty line, see here: https://github.com/project-zot/zot/compare/bb4451ffa1edf4141a522dabbe796b9e6e732f17..9e2067295fd285c7e1438e2a171db6a70a5ecebe) |
andaaron
approved these changes
Jan 24, 2026
Contributor
Author
|
@andaaron Looks like everything except for binary size increase is green now 🙌 🟢 |
There was a problem hiding this comment.
Pull request overview
This pull request introduces support for OIDC (OpenID Connect) workload identity federation in Zot, enabling secret-less authentication for automated workflows such as Kubernetes pods and CI/CD pipelines. The implementation allows workloads to authenticate using OIDC ID tokens instead of static credentials.
Changes:
- Added CEL (Common Expression Language) support for flexible claim validation and mapping from OIDC tokens to Zot identities
- Implemented OIDC bearer authentication with lazy provider loading, multi-issuer support, and audience validation
- Integrated OIDC authentication into existing bearer auth flow with fallback to traditional bearer tokens
- Added comprehensive test coverage including unit tests, integration tests, and end-to-end Kind cluster tests
Reviewed changes
Copilot reviewed 24 out of 25 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/cel/expression.go | CEL expression parser and evaluator for claim processing |
| pkg/cel/expression_test.go | Comprehensive CEL expression tests |
| pkg/cel/claim_processor.go | OIDC claim processor with validation and mapping logic |
| pkg/cel/claim_processor_test.go | Extensive claim processor tests covering various scenarios |
| pkg/api/bearer_oidc.go | OIDC bearer authorizer implementation with lazy provider loading |
| pkg/api/bearer_oidc_test.go | Unit tests for OIDC bearer authentication |
| pkg/api/authn.go | Updated bearer auth handler to support both OIDC and traditional tokens |
| pkg/api/authn_test.go | Integration tests for OIDC workload identity |
| pkg/api/authz.go | Added BEARER_OIDC constant for authorization differentiation |
| pkg/api/bearer.go | Changed return type of NewBearerAuthorizer to pointer |
| pkg/api/config/config.go | New config structures for OIDC bearer authentication |
| pkg/api/config/config_test.go | Config validation tests |
| pkg/api/controller.go | Updated logging to distinguish JWT vs OIDC bearer auth |
| pkg/cli/server/root.go | Updated auth validation to include bearer auth |
| pkg/cli/server/root_test.go | Updated tests for split bearer auth logging |
| pkg/cli/server/config_reloader_test.go | Updated tests for split bearer auth logging |
| errors/errors.go | New error definitions for OIDC authentication |
| examples/config-bearer-oidc-workload.json | Example OIDC configuration |
| examples/README-OIDC-WORKLOAD-IDENTITY.md | Comprehensive documentation |
| examples/kind/kind-oidc-workload-identity.sh | End-to-end test script with Kind |
| go.mod/go.sum | Added CEL and OIDC dependencies |
| Makefile | Removed modcheck from build targets, added to CI workflow |
| .github/workflows/nightly.yaml | Added OIDC workload identity E2E test job |
| .github/workflows/golangci-lint.yaml | Added modcheck step to CI |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
@matheuscscp merged, we will cut a new release with this fix |
Contributor
Author
Well it's not a fix, it's a big new feature 😅 And you can count me to help maintain it moving forward 👍 Thank you both very much for all the guidance and patience here! @rchincha @andaaron |
Contributor
|
| Well it's not a fix, it's a big new feature 😅 Indeed! v2.1.14 has been released. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #3704
Builds on/Supersedes: #3705