Workload identities
A workload identity lets a CI job exchange its platform's OIDC token for a Relic token that lives an hour at most.
Create a workload identity
Declare the issuer, the audience, and rules. The first rule whose claims all match (Ant-style:
* within a segment, ** across) decides the user. The users and groups the rules name must
exist.
apiVersion: relic.build/v1
kind: WorkloadIdentity
metadata:
name: github
spec:
enabled: true
issuer: https://token.actions.githubusercontent.com
audience: relic
rules:
- claims:
repository: my-org/*
ref: refs/heads/main
user: ci-release
- claims:
repository: my-org/*
user: ci-build
groups: [readers]
Apply the file:
relic apply -f workload-identity.yaml
Or use Administration → Workload identities. A rule's groups narrow the token to those
groups. Tokens made with the job's token expire with it, cannot be refreshed and cannot approve
a CLI sign-in. Paste jwks for an issuer Relic cannot reach; tokenLifetimeMinutes shortens
the lifetime.
Exchange the token in CI
In GitHub Actions, give the job id-token: write and sign in with the relic CLI:
permissions:
id-token: write
steps:
- run: |
ID_TOKEN=$(curl -sH "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=relic" | jq -r .value)
relic auth login https://relic.example.com --identity github --oidc-token "$ID_TOKEN"
relic artifact upload dist/app.tar.gz libs-local/app/
In GitLab CI, request an ID token for the audience:
release:
id_tokens:
RELIC_ID_TOKEN:
aud: relic
script:
- relic auth login https://relic.example.com --identity gitlab --oidc-token "$RELIC_ID_TOKEN"
The JFrog® CLI exchanges it with jf exchange-oidc-token, the identity's name as provider:
jf eot github "$ID_TOKEN" --url https://relic.example.com
The Relic API method is SessionService.ExchangeWorkloadToken
(POST /api/v1/workload-tokens). Every exchange is audited as workload.exchange.