docs(proposal): workload identity #26174

blakepettersson · 2026-01-29T11:28:15Z

A proposal for acquiring temporary repository credentials using the tokenrequest api (or via spiffe if applicable).

Checklist:

bunnyshell · 2026-01-29T11:28:20Z

🔴 Preview Environment stopped on Bunnyshell

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

🔵 /bns:start to start the environment
🚀 /bns:deploy to redeploy the environment
❌ /bns:delete to remove the environment

docs/proposals/workload-identity-v2.md

A proposal for acquiring temporary repository credentials using the tokenrequest api. Signed-off-by: Blake Pettersson <[email protected]>

Signed-off-by: Blake Pettersson <[email protected]>

lieberlois · 2026-01-30T08:43:51Z

docs/proposals/workload-identity-v2.md

+  name: argocd-project-production
+  annotations:
+    azure.workload.identity/client-id: "client-id-uuid"
+    azure.workload.identity/tenant-id: "tenant-id-uuid"


I haven't read all of it yet, but this is exactly what I'm trying to fix in #26030

It's not enough to set the tenant id here, because Workload Identity can only get one Identity from Entra Id. To make this more broadly applicable, we need the feature to be able to overwrite the tenant id per repository - both for Helm/OCI (Azure Container Registry) and for Git (Azure DevOps).

Hi @lieberlois,

In this proposal you should be able to set a custom tenant id by setting a custom token url in the repo cred.

something like

apiVersion: v1 kind: Secret metadata: name: my-ecr-repo labels: argocd.argoproj.io/secret-type: repository stringData: type: oci url: oci://your-registry.azurecr.io/myrepository project: production workloadIdentityProvider: "azure" workloadIdentityTokenURL: "https://login.microsoftonline.com/your-custom-tenant-id/oauth2/v2.0/token"

But it seems AKS not expose the Token directly, the token exchanging is managed by AKS and AAD. User use label `azure.workload.identity/use=true' to let AKS to write the cred back to the pod.
ref: https://azure.github.io/azure-workload-identity/docs/topics/service-account-labels-and-annotations.html

I was wondering what @ninjadq is asking here too. I think what would happen is some argo process would:

Get a token for the service account/api/v1/namespaces/argocd/serviceaccounts/argocd-project-production/token

Exchange K8s JWT with Azure AD https://login.microsoftonline.com/{tenant}/oauth2/token

Get the ACR token (simile to here)

Agreed, it should be added to service account and be read from there for overide.

Here's how I've done this in my WIP:

The initial acquisition of the Azure token: https://github.com/blakepettersson/argo-cd/blob/feature/workload-identity-v2-wip/util/workloadidentity/v2/identity/azure.go

The token being exchanged for an ACR token: https://github.com/blakepettersson/argo-cd/blob/feature/workload-identity-v2-wip/util/workloadidentity/v2/repository/acr.go

The intermediary of this whole enchilada: https://github.com/blakepettersson/argo-cd/blob/feature/workload-identity-v2-wip/util/workloadidentity/v2/resolver.go

ninjadq

The proposal looks great! It’s more comprehensive and scalable than current implementation

ninjadq · 2026-01-31T14:25:04Z

docs/proposals/workload-identity-v2.md

+**Upgrade:**
+- The `workloadIdentityProvider` field defaults to empty, so existing repositories continue to work unchanged
+- Users opt-in to workload identity by setting `workloadIdentityProvider` to their desired provider
+- No migration required for existing deployments


Azure workload identity already used for some customer. It seems need some migration to the new proposal

Good point, I'll amend

ninjadq · 2026-01-31T14:43:59Z

docs/proposals/workload-identity-v2.md

+  name: argocd-project-production
+  annotations:
+    azure.workload.identity/client-id: "client-id-uuid"
+    azure.workload.identity/tenant-id: "tenant-id-uuid"


But it seems AKS not expose the Token directly, the token exchanging is managed by AKS and AAD. User use label `azure.workload.identity/use=true' to let AKS to write the cred back to the pod.
ref: https://azure.github.io/azure-workload-identity/docs/topics/service-account-labels-and-annotations.html

docs/proposals/workload-identity-v2.md

Signed-off-by: Blake Pettersson <[email protected]>

jagpreetstamber · 2026-02-02T15:45:22Z

docs/proposals/workload-identity-v2.md

+**Azure:**
+```yaml
+apiVersion: v1
+kind: ServiceAccount


@blakepettersson As this service account is not used as kubenetes object we are only using it to read the configurations for workload identity, these configurations can be added in the secrets for repo conffigurations?

@jagpreetstamber my concern is having to need to add a bunch of cloud-specific fields to the repository spec itself. IMO having e.g tenantId and clientId are Azure-specific options and should be kept somewhere where we have the options to have more flexibility (i.e annotations). TBF we could have this as annotations on the repository itself, but that would also mean needing to duplicate those settings for all repositories needing to make use of it.

rumstead · 2026-02-02T21:10:45Z

docs/proposals/workload-identity-v2.md

+- ArgoCD stores registry credentials (username/password, tokens) in Kubernetes secrets
+- These credentials are long-lived and must be manually rotated
+- Credential leakage poses significant security risks
+- The existing implementation of Workload Identity is in practice scoped on the whole repo-server, meaning that there


Should we document a migration path and how we would support any backwards compatibility?

Same comment @ninjadq left below but I didn't see theirs before I left mine. Feel free to resolve.

rumstead · 2026-02-02T21:14:52Z

docs/proposals/workload-identity-v2.md

+│
+▼
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                         Workload Identity Resolver                           │


What component would be responsible for the token exchange?

jagpreetstamber · 2026-02-02T21:24:08Z

docs/proposals/workload-identity-v2.md

+#### Example 1: AWS ECR with Multi-Project Setup
+
+```yaml
+# Service Account for production project


Pull request generator also needs to be added in the scope of workload identity

Yes good point, will check to see if this would require any changes (I don't think so, or it shouldn't be too extensive)

jagpreetstamber · 2026-02-02T21:24:42Z

docs/proposals/workload-identity-v2.md

+
+```yaml
+# Service Account for production project
+apiVersion: v1


Single Sign On Also needs to be added in the scope

Could you expand on why this would be needed?

blakepettersson · 2026-02-02T22:01:31Z

Here's the current WIP

olivergondza reviewed Jan 29, 2026

View reviewed changes

docs/proposals/workload-identity-v2.md Show resolved Hide resolved

blakepettersson force-pushed the docs/workload-identity-v2 branch from d454057 to f0cddfb Compare January 29, 2026 13:15

docs(proposal): workload identity

1e8955c

A proposal for acquiring temporary repository credentials using the tokenrequest api. Signed-off-by: Blake Pettersson <[email protected]>

blakepettersson force-pushed the docs/workload-identity-v2 branch from f0cddfb to 1e8955c Compare January 29, 2026 13:32

docs: correct links

eb6c0f0

Signed-off-by: Blake Pettersson <[email protected]>

blakepettersson mentioned this pull request Jan 29, 2026

feat(oci): fallback auth option for OCI repositories with docker config #25565

Open

14 tasks

docs: minor tweaks

2a1a9e6

Signed-off-by: Blake Pettersson <[email protected]>

lieberlois reviewed Jan 30, 2026

View reviewed changes

ninjadq reviewed Jan 31, 2026

View reviewed changes

docs: s/container/oci/

eab298a

Signed-off-by: Blake Pettersson <[email protected]>

jagpreetstamber reviewed Feb 2, 2026

View reviewed changes

rumstead reviewed Feb 2, 2026

View reviewed changes

jagpreetstamber reviewed Feb 2, 2026

View reviewed changes

docs(proposal): workload identity #26174

Are you sure you want to change the base?

docs(proposal): workload identity #26174

Conversation

blakepettersson commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bunnyshell bot commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Preview Environment stopped on Bunnyshell

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blakepettersson Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ninjadq left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blakepettersson commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

blakepettersson commented Jan 29, 2026 •

edited

Loading

bunnyshell bot commented Jan 29, 2026 •

edited

Loading

blakepettersson Jan 30, 2026 •

edited

Loading