[{"data":1,"prerenderedAt":879},["ShallowReactive",2],{"docs-navigation":3,"-docs-guides-security-workload-identities":410,"-docs-guides-security-workload-identities-surround":874},[4,19,166,319,333,397],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":18},"Overview","i-lucide-compass","\u002Fdocs\u002Foverview","docs\u002F1.overview",[10,14],{"title":11,"path":12,"stem":13},"Introduction","\u002Fdocs\u002Foverview\u002Fintroduction","docs\u002F1.overview\u002F1.introduction",{"title":15,"path":16,"stem":17},"JFrog compatibility","\u002Fdocs\u002Foverview\u002Fjfrog-compatibility","docs\u002F1.overview\u002F2.jfrog-compatibility",false,{"title":20,"icon":21,"path":22,"stem":23,"children":24,"page":18},"Installation","i-lucide-download","\u002Fdocs\u002Finstallation","docs\u002F2.installation",[25,29,43,68,108,112,116,162],{"title":26,"path":27,"stem":28},"Choosing a method","\u002Fdocs\u002Finstallation\u002Foverview","docs\u002F2.installation\u002F1.overview",{"title":30,"icon":31,"path":32,"stem":33,"children":34,"page":18},"Single binary","i-lucide-terminal","\u002Fdocs\u002Finstallation\u002Fsingle-binary","docs\u002F2.installation\u002F2.single-binary",[35,39],{"title":36,"path":37,"stem":38},"Quick start","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Fquick-start","docs\u002F2.installation\u002F2.single-binary\u002F1.quick-start",{"title":40,"path":41,"stem":42},"Limits and backups","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Foperations","docs\u002F2.installation\u002F2.single-binary\u002F2.operations",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":18},"Docker","i-simple-icons-docker","\u002Fdocs\u002Finstallation\u002Fdocker","docs\u002F2.installation\u002F3.docker",[49,52,56,60,64],{"title":36,"path":50,"stem":51},"\u002Fdocs\u002Finstallation\u002Fdocker\u002Fquick-start","docs\u002F2.installation\u002F3.docker\u002F1.quick-start",{"title":53,"path":54,"stem":55},"PostgreSQL and S3","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fpostgresql-and-s3","docs\u002F2.installation\u002F3.docker\u002F2.postgresql-and-s3",{"title":57,"path":58,"stem":59},"Docker Compose","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose","docs\u002F2.installation\u002F3.docker\u002F3.compose",{"title":61,"path":62,"stem":63},"Compose settings","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-settings","docs\u002F2.installation\u002F3.docker\u002F4.compose-settings",{"title":65,"path":66,"stem":67},"Compose with another object store","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-other-object-storage","docs\u002F2.installation\u002F3.docker\u002F5.compose-other-object-storage",{"title":69,"icon":70,"path":71,"stem":72,"children":73,"page":18},"Kubernetes","i-simple-icons-kubernetes","\u002Fdocs\u002Finstallation\u002Fkubernetes","docs\u002F2.installation\u002F4.kubernetes",[74,77,80,84,88,92,96,100,104],{"title":5,"path":75,"stem":76},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Foverview","docs\u002F2.installation\u002F4.kubernetes\u002F1.overview",{"title":36,"path":78,"stem":79},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fquick-start","docs\u002F2.installation\u002F4.kubernetes\u002F2.quick-start",{"title":81,"path":82,"stem":83},"External PostgreSQL","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-postgresql","docs\u002F2.installation\u002F4.kubernetes\u002F3.external-postgresql",{"title":85,"path":86,"stem":87},"External object storage","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-object-storage","docs\u002F2.installation\u002F4.kubernetes\u002F4.external-object-storage",{"title":89,"path":90,"stem":91},"Exposing Relic","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexposing","docs\u002F2.installation\u002F4.kubernetes\u002F5.exposing",{"title":93,"path":94,"stem":95},"Values","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fvalues","docs\u002F2.installation\u002F4.kubernetes\u002F6.values",{"title":97,"path":98,"stem":99},"Upgrades and removal","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fupgrades","docs\u002F2.installation\u002F4.kubernetes\u002F7.upgrades",{"title":101,"path":102,"stem":103},"Hardening and probes","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fhardening","docs\u002F2.installation\u002F4.kubernetes\u002F8.hardening",{"title":105,"path":106,"stem":107},"Monitoring","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fmonitoring","docs\u002F2.installation\u002F4.kubernetes\u002F9.monitoring",{"title":109,"path":110,"stem":111},"Cloudflare","\u002Fdocs\u002Finstallation\u002Fcloudflare","docs\u002F2.installation\u002F5.cloudflare",{"title":113,"path":114,"stem":115},"Configuration reference","\u002Fdocs\u002Finstallation\u002Fconfiguration","docs\u002F2.installation\u002F6.configuration",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":18},"Storage","i-lucide-hard-drive","\u002Fdocs\u002Finstallation\u002Fstorage","docs\u002F2.installation\u002F7.storage",[122,126,130,134,138,142,146,150,154,158],{"title":123,"path":124,"stem":125},"Storage overview","\u002Fdocs\u002Finstallation\u002Fstorage\u002Foverview","docs\u002F2.installation\u002F7.storage\u002F1.overview",{"title":127,"path":128,"stem":129},"Azure Blob Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fazure-blob-storage","docs\u002F2.installation\u002F7.storage\u002F10.azure-blob-storage",{"title":131,"path":132,"stem":133},"SeaweedFS","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fseaweedfs","docs\u002F2.installation\u002F7.storage\u002F2.seaweedfs",{"title":135,"path":136,"stem":137},"Amazon S3","\u002Fdocs\u002Finstallation\u002Fstorage\u002Famazon-s3","docs\u002F2.installation\u002F7.storage\u002F3.amazon-s3",{"title":139,"path":140,"stem":141},"Cloudflare R2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fcloudflare-r2","docs\u002F2.installation\u002F7.storage\u002F4.cloudflare-r2",{"title":143,"path":144,"stem":145},"MinIO","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fminio","docs\u002F2.installation\u002F7.storage\u002F5.minio",{"title":147,"path":148,"stem":149},"Google Cloud Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fgoogle-cloud-storage","docs\u002F2.installation\u002F7.storage\u002F6.google-cloud-storage",{"title":151,"path":152,"stem":153},"Backblaze B2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fbackblaze-b2","docs\u002F2.installation\u002F7.storage\u002F7.backblaze-b2",{"title":155,"path":156,"stem":157},"Other S3-compatible services","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fother","docs\u002F2.installation\u002F7.storage\u002F8.other",{"title":159,"path":160,"stem":161},"Filesystem","\u002Fdocs\u002Finstallation\u002Fstorage\u002Ffilesystem","docs\u002F2.installation\u002F7.storage\u002F9.filesystem",{"title":163,"path":164,"stem":165},"Development","\u002Fdocs\u002Finstallation\u002Fdevelopment","docs\u002F2.installation\u002F8.development",{"title":167,"icon":168,"path":169,"stem":170,"children":171,"page":18},"Guides","i-lucide-book-open","\u002Fdocs\u002Fguides","docs\u002F3.guides",[172,176,180,254,296,300,303,307,311,315],{"title":173,"path":174,"stem":175},"Repositories","\u002Fdocs\u002Fguides\u002Frepositories","docs\u002F3.guides\u002F1.repositories",{"title":177,"path":178,"stem":179},"Replication","\u002Fdocs\u002Fguides\u002Freplication","docs\u002F3.guides\u002F10.replication",{"title":181,"icon":182,"path":183,"stem":184,"children":185,"page":18},"Package types","i-lucide-package","\u002Fdocs\u002Fguides\u002Fpackage-types","docs\u002F3.guides\u002F2.package-types",[186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250],{"title":187,"path":188,"stem":189},"npm, yarn and pnpm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnpm","docs\u002F3.guides\u002F2.package-types\u002F01.npm",{"title":191,"path":192,"stem":193},"Maven and Gradle","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fmaven-gradle","docs\u002F3.guides\u002F2.package-types\u002F02.maven-gradle",{"title":195,"path":196,"stem":197},"Docker and OCI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdocker","docs\u002F3.guides\u002F2.package-types\u002F03.docker",{"title":199,"path":200,"stem":201},"Go","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgo","docs\u002F3.guides\u002F2.package-types\u002F04.go",{"title":203,"path":204,"stem":205},"PyPI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fpypi","docs\u002F3.guides\u002F2.package-types\u002F05.pypi",{"title":207,"path":208,"stem":209},"Helm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhelm","docs\u002F3.guides\u002F2.package-types\u002F06.helm",{"title":211,"path":212,"stem":213},"NuGet","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnuget","docs\u002F3.guides\u002F2.package-types\u002F07.nuget",{"title":215,"path":216,"stem":217},"RubyGems","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frubygems","docs\u002F3.guides\u002F2.package-types\u002F08.rubygems",{"title":219,"path":220,"stem":221},"Cargo","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fcargo","docs\u002F3.guides\u002F2.package-types\u002F09.cargo",{"title":223,"path":224,"stem":225},"Conan","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fconan","docs\u002F3.guides\u002F2.package-types\u002F10.conan",{"title":227,"path":228,"stem":229},"Terraform and OpenTofu","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fterraform","docs\u002F3.guides\u002F2.package-types\u002F11.terraform",{"title":231,"path":232,"stem":233},"Hugging Face","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhugging-face","docs\u002F3.guides\u002F2.package-types\u002F12.hugging-face",{"title":235,"path":236,"stem":237},"Generic files","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgeneric","docs\u002F3.guides\u002F2.package-types\u002F13.generic",{"title":239,"path":240,"stem":241},"RPM","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frpm","docs\u002F3.guides\u002F2.package-types\u002F14.rpm",{"title":243,"path":244,"stem":245},"Debian","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdebian","docs\u002F3.guides\u002F2.package-types\u002F15.debian",{"title":247,"path":248,"stem":249},"Alpine","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Falpine","docs\u002F3.guides\u002F2.package-types\u002F16.alpine",{"title":251,"path":252,"stem":253},"Nix","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnix","docs\u002F3.guides\u002F2.package-types\u002F17.nix",{"title":255,"icon":256,"path":257,"stem":258,"children":259,"page":18},"Security","i-lucide-shield","\u002Fdocs\u002Fguides\u002Fsecurity","docs\u002F3.guides\u002F3.security",[260,264,268,272,276,280,284,288,292],{"title":261,"path":262,"stem":263},"Permissions","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fpermissions","docs\u002F3.guides\u002F3.security\u002F1.permissions",{"title":265,"path":266,"stem":267},"LDAP","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fldap","docs\u002F3.guides\u002F3.security\u002F2.ldap",{"title":269,"path":270,"stem":271},"Access tokens","\u002Fdocs\u002Fguides\u002Fsecurity\u002Ftokens","docs\u002F3.guides\u002F3.security\u002F3.tokens",{"title":273,"path":274,"stem":275},"Relic Scan","\u002Fdocs\u002Fguides\u002Fsecurity\u002Frelic-scan","docs\u002F3.guides\u002F3.security\u002F4.relic-scan",{"title":277,"path":278,"stem":279},"CVE intelligence","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fcve-intelligence","docs\u002F3.guides\u002F3.security\u002F5.cve-intelligence",{"title":281,"path":282,"stem":283},"Audit log","\u002Fdocs\u002Fguides\u002Fsecurity\u002Faudit-log","docs\u002F3.guides\u002F3.security\u002F6.audit-log",{"title":285,"path":286,"stem":287},"Single sign-on","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fsingle-sign-on","docs\u002F3.guides\u002F3.security\u002F7.single-sign-on",{"title":289,"path":290,"stem":291},"SCIM provisioning","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fscim","docs\u002F3.guides\u002F3.security\u002F8.scim",{"title":293,"path":294,"stem":295},"Workload identities","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fworkload-identities","docs\u002F3.guides\u002F3.security\u002F9.workload-identities",{"title":297,"path":298,"stem":299},"Operations","\u002Fdocs\u002Fguides\u002Foperations","docs\u002F3.guides\u002F4.operations",{"title":105,"path":301,"stem":302},"\u002Fdocs\u002Fguides\u002Fmonitoring","docs\u002F3.guides\u002F5.monitoring",{"title":304,"path":305,"stem":306},"Metrics reference","\u002Fdocs\u002Fguides\u002Fmetrics-reference","docs\u002F3.guides\u002F6.metrics-reference",{"title":308,"path":309,"stem":310},"Webhooks","\u002Fdocs\u002Fguides\u002Fwebhooks","docs\u002F3.guides\u002F7.webhooks",{"title":312,"path":313,"stem":314},"Projects","\u002Fdocs\u002Fguides\u002Fprojects","docs\u002F3.guides\u002F8.projects",{"title":316,"path":317,"stem":318},"AI agents","\u002Fdocs\u002Fguides\u002Fai-agents","docs\u002F3.guides\u002F9.ai-agents",{"title":320,"icon":321,"path":322,"stem":323,"children":324,"page":18},"API","i-lucide-braces","\u002Fdocs\u002Fapi","docs\u002F4.api",[325,329],{"title":326,"path":327,"stem":328},"API usage","\u002Fdocs\u002Fapi\u002Foverview","docs\u002F4.api\u002F1.overview",{"title":330,"path":331,"stem":332},"Relic API","\u002Fdocs\u002Fapi\u002Frelic-api","docs\u002F4.api\u002F2.relic-api",{"title":334,"icon":31,"path":335,"stem":336,"children":337,"page":18},"CLI","\u002Fdocs\u002Fcli","docs\u002F5.cli",[338,341,345,349,353,357,361,365,369,373,377,381,385,389,393],{"title":5,"path":339,"stem":340},"\u002Fdocs\u002Fcli\u002Foverview","docs\u002F5.cli\u002F01.overview",{"title":342,"path":343,"stem":344},"Sign in and contexts","\u002Fdocs\u002Fcli\u002Fsign-in","docs\u002F5.cli\u002F02.sign-in",{"title":346,"path":347,"stem":348},"Resources","\u002Fdocs\u002Fcli\u002Fresources","docs\u002F5.cli\u002F03.resources",{"title":350,"path":351,"stem":352},"apply, diff and delete","\u002Fdocs\u002Fcli\u002Fapply","docs\u002F5.cli\u002F04.apply",{"title":354,"path":355,"stem":356},"Artifacts","\u002Fdocs\u002Fcli\u002Ffiles","docs\u002F5.cli\u002F05.files",{"title":358,"path":359,"stem":360},"Server, API and tokens","\u002Fdocs\u002Fcli\u002Fplatform","docs\u002F5.cli\u002F06.platform",{"title":362,"path":363,"stem":364},"Builds and images","\u002Fdocs\u002Fcli\u002Fbuilds","docs\u002F5.cli\u002F07.builds",{"title":366,"path":367,"stem":368},"Scanning and auditing","\u002Fdocs\u002Fcli\u002Fsecurity","docs\u002F5.cli\u002F08.security",{"title":370,"path":371,"stem":372},"Releases","\u002Fdocs\u002Fcli\u002Freleases","docs\u002F5.cli\u002F09.releases",{"title":374,"path":375,"stem":376},"Evidence","\u002Fdocs\u002Fcli\u002Fevidence","docs\u002F5.cli\u002F10.evidence",{"title":378,"path":379,"stem":380},"Package managers","\u002Fdocs\u002Fcli\u002Fpackage-managers","docs\u002F5.cli\u002F11.package-managers",{"title":382,"path":383,"stem":384},"Scan reports and VEX","\u002Fdocs\u002Fcli\u002Freports-and-vex","docs\u002F5.cli\u002F12.reports-and-vex",{"title":386,"path":387,"stem":388},"Migrating from Artifactory","\u002Fdocs\u002Fcli\u002Fimport","docs\u002F5.cli\u002F13.import",{"title":390,"path":391,"stem":392},"Database","\u002Fdocs\u002Fcli\u002Fdatabase","docs\u002F5.cli\u002F14.database",{"title":394,"path":395,"stem":396},"Machine setup","\u002Fdocs\u002Fcli\u002Fsetup","docs\u002F5.cli\u002F15.setup",{"title":398,"icon":399,"path":400,"stem":401,"children":402,"page":18},"SDK","i-lucide-boxes","\u002Fdocs\u002Fsdk","docs\u002F6.sdk",[403,406],{"title":5,"path":404,"stem":405},"\u002Fdocs\u002Fsdk\u002Foverview","docs\u002F6.sdk\u002F1.overview",{"title":407,"path":408,"stem":409},"Relic API clients","\u002Fdocs\u002Fsdk\u002Frelic-api-clients","docs\u002F6.sdk\u002F2.relic-api-clients",{"id":411,"title":293,"body":412,"description":867,"extension":868,"links":869,"meta":870,"navigation":871,"path":294,"seo":872,"stem":295,"__hash__":873},"docs\u002Fdocs\u002F3.guides\u002F3.security\u002F9.workload-identities.md",{"type":413,"value":414,"toc":863},"minimark",[415,419,424,436,632,635,658,678,682,689,752,755,804,811,844,859],[416,417,418],"p",{},"A workload identity lets a CI job exchange its platform's OIDC token for a Relic token that\nlives an hour at most.",[420,421,423],"h2",{"id":422},"create-a-workload-identity","Create a workload identity",[416,425,426,427,431,432,435],{},"Declare the issuer, the audience, and rules. The first rule whose claims all match (Ant-style:\n",[428,429,430],"code",{},"*"," within a segment, ",[428,433,434],{},"**"," across) decides the user. The users and groups the rules name must\nexist.",[437,438,443],"pre",{"className":439,"code":440,"language":441,"meta":442,"style":442},"language-yaml shiki shiki-themes material-theme-lighter github-light-default github-dark-default","apiVersion: relic.build\u002Fv1\nkind: WorkloadIdentity\nmetadata:\n  name: github\nspec:\n  enabled: true\n  issuer: https:\u002F\u002Ftoken.actions.githubusercontent.com\n  audience: relic\n  rules:\n    - claims:\n        repository: my-org\u002F*\n        ref: refs\u002Fheads\u002Fmain\n      user: ci-release\n    - claims:\n        repository: my-org\u002F*\n      user: ci-build\n      groups: [readers]\n","yaml","",[428,444,445,462,473,482,493,501,513,524,535,543,554,565,576,587,596,605,615],{"__ignoreMap":442},[446,447,450,454,458],"span",{"class":448,"line":449},"line",1,[446,451,453],{"class":452},"smKOL","apiVersion",[446,455,457],{"class":456},"sWneD",":",[446,459,461],{"class":460},"sasMN"," relic.build\u002Fv1\n",[446,463,465,468,470],{"class":448,"line":464},2,[446,466,467],{"class":452},"kind",[446,469,457],{"class":456},[446,471,472],{"class":460}," WorkloadIdentity\n",[446,474,476,479],{"class":448,"line":475},3,[446,477,478],{"class":452},"metadata",[446,480,481],{"class":456},":\n",[446,483,485,488,490],{"class":448,"line":484},4,[446,486,487],{"class":452},"  name",[446,489,457],{"class":456},[446,491,492],{"class":460}," github\n",[446,494,496,499],{"class":448,"line":495},5,[446,497,498],{"class":452},"spec",[446,500,481],{"class":456},[446,502,504,507,509],{"class":448,"line":503},6,[446,505,506],{"class":452},"  enabled",[446,508,457],{"class":456},[446,510,512],{"class":511},"sH4kE"," true\n",[446,514,516,519,521],{"class":448,"line":515},7,[446,517,518],{"class":452},"  issuer",[446,520,457],{"class":456},[446,522,523],{"class":460}," https:\u002F\u002Ftoken.actions.githubusercontent.com\n",[446,525,527,530,532],{"class":448,"line":526},8,[446,528,529],{"class":452},"  audience",[446,531,457],{"class":456},[446,533,534],{"class":460}," relic\n",[446,536,538,541],{"class":448,"line":537},9,[446,539,540],{"class":452},"  rules",[446,542,481],{"class":456},[446,544,546,549,552],{"class":448,"line":545},10,[446,547,548],{"class":456},"    -",[446,550,551],{"class":452}," claims",[446,553,481],{"class":456},[446,555,557,560,562],{"class":448,"line":556},11,[446,558,559],{"class":452},"        repository",[446,561,457],{"class":456},[446,563,564],{"class":460}," my-org\u002F*\n",[446,566,568,571,573],{"class":448,"line":567},12,[446,569,570],{"class":452},"        ref",[446,572,457],{"class":456},[446,574,575],{"class":460}," refs\u002Fheads\u002Fmain\n",[446,577,579,582,584],{"class":448,"line":578},13,[446,580,581],{"class":452},"      user",[446,583,457],{"class":456},[446,585,586],{"class":460}," ci-release\n",[446,588,590,592,594],{"class":448,"line":589},14,[446,591,548],{"class":456},[446,593,551],{"class":452},[446,595,481],{"class":456},[446,597,599,601,603],{"class":448,"line":598},15,[446,600,559],{"class":452},[446,602,457],{"class":456},[446,604,564],{"class":460},[446,606,608,610,612],{"class":448,"line":607},16,[446,609,581],{"class":452},[446,611,457],{"class":456},[446,613,614],{"class":460}," ci-build\n",[446,616,618,621,623,626,629],{"class":448,"line":617},17,[446,619,620],{"class":452},"      groups",[446,622,457],{"class":456},[446,624,625],{"class":456}," [",[446,627,628],{"class":460},"readers",[446,630,631],{"class":456},"]\n",[416,633,634],{},"Apply the file:",[437,636,640],{"className":637,"code":638,"language":639,"meta":442,"style":442},"language-bash shiki shiki-themes material-theme-lighter github-light-default github-dark-default","relic apply -f workload-identity.yaml\n","bash",[428,641,642],{"__ignoreMap":442},[446,643,644,648,651,655],{"class":448,"line":449},[446,645,647],{"class":646},"seIyd","relic",[446,649,650],{"class":460}," apply",[446,652,654],{"class":653},"smky3"," -f",[446,656,657],{"class":460}," workload-identity.yaml\n",[416,659,660,661,665,666,669,670,673,674,677],{},"Or use ",[662,663,664],"strong",{},"Administration → Workload identities",". A rule's ",[428,667,668],{},"groups"," narrow the token to those\ngroups. Tokens made with the job's token expire with it, cannot be refreshed and cannot approve\na CLI sign-in. Paste ",[428,671,672],{},"jwks"," for an issuer Relic cannot reach; ",[428,675,676],{},"tokenLifetimeMinutes"," shortens\nthe lifetime.",[420,679,681],{"id":680},"exchange-the-token-in-ci","Exchange the token in CI",[416,683,684,685,688],{},"In GitHub Actions, give the job ",[428,686,687],{},"id-token: write"," and sign in with the relic CLI:",[437,690,692],{"className":439,"code":691,"language":441,"meta":442,"style":442},"permissions:\n  id-token: write\nsteps:\n  - run: |\n      ID_TOKEN=$(curl -sH \"Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN\" \\\n        \"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=relic\" | jq -r .value)\n      relic auth login https:\u002F\u002Frelic.example.com --identity github --oidc-token \"$ID_TOKEN\"\n      relic artifact upload dist\u002Fapp.tar.gz libs-local\u002Fapp\u002F\n",[428,693,694,701,711,718,732,737,742,747],{"__ignoreMap":442},[446,695,696,699],{"class":448,"line":449},[446,697,698],{"class":452},"permissions",[446,700,481],{"class":456},[446,702,703,706,708],{"class":448,"line":464},[446,704,705],{"class":452},"  id-token",[446,707,457],{"class":456},[446,709,710],{"class":460}," write\n",[446,712,713,716],{"class":448,"line":475},[446,714,715],{"class":452},"steps",[446,717,481],{"class":456},[446,719,720,723,726,728],{"class":448,"line":484},[446,721,722],{"class":456},"  -",[446,724,725],{"class":452}," run",[446,727,457],{"class":456},[446,729,731],{"class":730},"sqgCv"," |\n",[446,733,734],{"class":448,"line":495},[446,735,736],{"class":460},"      ID_TOKEN=$(curl -sH \"Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN\" \\\n",[446,738,739],{"class":448,"line":503},[446,740,741],{"class":460},"        \"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=relic\" | jq -r .value)\n",[446,743,744],{"class":448,"line":515},[446,745,746],{"class":460},"      relic auth login https:\u002F\u002Frelic.example.com --identity github --oidc-token \"$ID_TOKEN\"\n",[446,748,749],{"class":448,"line":526},[446,750,751],{"class":460},"      relic artifact upload dist\u002Fapp.tar.gz libs-local\u002Fapp\u002F\n",[416,753,754],{},"In GitLab CI, request an ID token for the audience:",[437,756,758],{"className":439,"code":757,"language":441,"meta":442,"style":442},"release:\n  id_tokens:\n    RELIC_ID_TOKEN:\n      aud: relic\n  script:\n    - relic auth login https:\u002F\u002Frelic.example.com --identity gitlab --oidc-token \"$RELIC_ID_TOKEN\"\n",[428,759,760,767,774,781,790,797],{"__ignoreMap":442},[446,761,762,765],{"class":448,"line":449},[446,763,764],{"class":452},"release",[446,766,481],{"class":456},[446,768,769,772],{"class":448,"line":464},[446,770,771],{"class":452},"  id_tokens",[446,773,481],{"class":456},[446,775,776,779],{"class":448,"line":475},[446,777,778],{"class":452},"    RELIC_ID_TOKEN",[446,780,481],{"class":456},[446,782,783,786,788],{"class":448,"line":484},[446,784,785],{"class":452},"      aud",[446,787,457],{"class":456},[446,789,534],{"class":460},[446,791,792,795],{"class":448,"line":495},[446,793,794],{"class":452},"  script",[446,796,481],{"class":456},[446,798,799,801],{"class":448,"line":503},[446,800,548],{"class":456},[446,802,803],{"class":460}," relic auth login https:\u002F\u002Frelic.example.com --identity gitlab --oidc-token \"$RELIC_ID_TOKEN\"\n",[416,805,806,807,810],{},"The JFrog® CLI exchanges it with ",[428,808,809],{},"jf exchange-oidc-token",", the identity's name as provider:",[437,812,814],{"className":637,"code":813,"language":639,"meta":442,"style":442},"jf eot github \"$ID_TOKEN\" --url https:\u002F\u002Frelic.example.com\n",[428,815,816],{"__ignoreMap":442},[446,817,818,821,824,827,831,835,838,841],{"class":448,"line":449},[446,819,820],{"class":646},"jf",[446,822,823],{"class":460}," eot",[446,825,826],{"class":460}," github",[446,828,830],{"class":829},"sX5mu"," \"",[446,832,834],{"class":833},"saDVj","$ID_TOKEN",[446,836,837],{"class":829},"\"",[446,839,840],{"class":653}," --url",[446,842,843],{"class":460}," https:\u002F\u002Frelic.example.com\n",[416,845,846,847,850,851,854,855,858],{},"The Relic API method is ",[428,848,849],{},"SessionService.ExchangeWorkloadToken","\n(",[428,852,853],{},"POST \u002Fapi\u002Fv1\u002Fworkload-tokens","). Every exchange is audited as ",[428,856,857],{},"workload.exchange",".",[860,861,862],"style",{},"html pre.shiki code .smKOL, html code.shiki .smKOL{--shiki-light:#E53935;--shiki-default:#116329;--shiki-dark:#7EE787}html pre.shiki code .sWneD, html code.shiki .sWneD{--shiki-light:#39ADB5;--shiki-default:#1F2328;--shiki-dark:#E6EDF3}html pre.shiki code .sasMN, html code.shiki .sasMN{--shiki-light:#91B859;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html pre.shiki code .sH4kE, html code.shiki .sH4kE{--shiki-light:#FF5370;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .seIyd, html code.shiki .seIyd{--shiki-light:#E2931D;--shiki-default:#953800;--shiki-dark:#FFA657}html pre.shiki code .smky3, html code.shiki .smky3{--shiki-light:#91B859;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html pre.shiki code .sqgCv, html code.shiki .sqgCv{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#CF222E;--shiki-default-font-style:inherit;--shiki-dark:#FF7B72;--shiki-dark-font-style:inherit}html pre.shiki code .sX5mu, html code.shiki .sX5mu{--shiki-light:#39ADB5;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html pre.shiki code .saDVj, html code.shiki .saDVj{--shiki-light:#90A4AE;--shiki-default:#1F2328;--shiki-dark:#E6EDF3}",{"title":442,"searchDepth":464,"depth":464,"links":864},[865,866],{"id":422,"depth":464,"text":423},{"id":680,"depth":464,"text":681},"CI jobs exchange their platform's OIDC token for a short-lived Relic token.","md",null,{},true,{"title":293,"description":867},"-XS2BqGwrRuoQAwKhAo3bAgl74AB0DeRK1yVFMrGyj8",[875,877],{"title":289,"path":290,"stem":291,"description":876,"children":-1},"Let your identity provider manage Relic's single sign-on users and groups through SCIM 2.0.",{"title":297,"path":298,"stem":299,"description":878,"children":-1},"Back up, restore, upgrade and troubleshoot a running Relic installation.",1793857359157]