Container Registry and Software Supply Chain Platform  ·  View 29 of 33  ·  6 · Assurance

Workload Identity and Credentials

How a build proves what it is, and how short-lived every credential it receives actually is.

Editable source SVG draw.io All views
Build Pod SPIRE Agent SPIRE Server Keycloak Harbor Fulcio 1. workload API 2. node attestation 3. entry match 4. SVID · 5 min 5. token exchange 6. validate issuer + claims 7. claims accepted 8. robot token · 60 min 9. SVID → signing cert 10. SAN = SPIFFE ID 11. push apps/checkout 12. 403 outside scope Workload Identity and Credential Issue No push credential exceeds 60 minutes, and no runtime identity is ever issued one. Shared credentials do not exist. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • SPIRE issues an SVID to the build pod after node and workload attestation; nothing is provisioned as a secret
  • Harbor exchanges that SVID for a robot token scoped to the repositories that identity owns
  • Runtime identities receive pull-only credentials scoped to a namespace and environment

Hard limits

  • No credential with push scope has a lifetime exceeding 60 minutes
  • Fulcio signing certificates are valid for 10 minutes
  • A push outside the identity's scope is a 403 with a distinct reason code, logged

Separation of duty

  • No single human identity can both grant signing authority and use it — enforced in Keycloak group membership, checked at review
  • Root ceremony participation is a separate role again, with a two-person rule
  • Every HSM operation is authorised and logged individually
◀  Security Trust Zones All views Key Management and Trust Roots  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises29-identity-and-credentials