Best Current Practice for Workload Identity
draft-hofmann-wimse-workload-identity-bcp-00
| Document | Type |
Replaced Internet-Draft
(individual)
Expired & archived
|
|
|---|---|---|---|
| Authors | Benedikt Hofmann , Hannes Tschofenig | ||
| Last updated | 2024-04-05 (Latest revision 2023-10-10) | ||
| Replaced by | draft-ietf-wimse-workload-identity-bcp | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Replaced by draft-ietf-wimse-workload-identity-bcp | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
The use of the OAuth 2.0 framework for container orchestration systems poses a challenge as managing secrets, such as client_id and client_secret, can be complex and error-prone. "Service account token volume projection", a term introduced by Kubernetes, provides a way of injecting JSON Web Tokens (JWTs) to workloads. This document specifies the use of JWTs for client credentials in container orchestration systems to improve interoperability in orchestration systems, to reduce complexity for developers, and motivates authorization server to support RFC 7523.
Authors
Benedikt Hofmann
Hannes Tschofenig
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)