Securing OIDC Federation in CI/CD Workflows
summary
Explains how OIDC tokens from GitHub Actions, GitLab and Kubernetes are exchanged via an STS-style federation to get short-lived cloud credentials, and shows a working Chainguard setup plus an open tool Octos that does this for GitHub-to-Google flows. Demonstrates concrete failures found in the wild—audience-only policies, loose regexes, PR/presubmit token abuse (Tinder incident cited)—and recommends one-to-one CI identities, short-lived tokens, and precise issuer/subject policies.
AI-written summary · about
chapters (6)
- 0:00OIDC Federation in CI/CD
- 7:25OIDC Federation basics
- 9:33Practical OIDC workflows
- 12:21Federated identity security
- 15:50Policy pitfalls and gotchas
- 18:57Best practices
related talks
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
29mI Can OIDC You Clearly Now: How We Made Static Credentials a...
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
57mGitHub Actions: A Cloudy Day for Security
08mLightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar...
28mFederation and Zero Trust CI in