Skip to content

Add Workload Identity Federation like the stackit terraform provider #1327

Open
Open
Add Workload Identity Federation like the stackit terraform provider#1327
Labels
enhancementNew feature or requesthas internal tracking issue

Description

@mardonner
mardonner
opened on Mar 5, 2026

Problem description

Recently, I saw that the stackit terraform provider added Workload Identity Federation support with examples for github and Azure DevOps. Even though I didn't adopt it yet(see edit at the bottom), this seems like it'd also be useful feature for the CLI.

Part of my pipelines are a small set of kubectl commands I execute for initial ske cluster bootstrapping (I deliberately not use the kubernetes terraform provider for that). For this, I use the stackit cli to create a kubeconfig. For authentication against stackit, I have a service account key that I inject into the environment. If I understand correctly, with workload identity federation, I could skip explicitly providing the service account key in the pipeline.

Is this feature something that could be implemented for the CLI?

Proposed solution

Same implementation like the terraform provider via STACKIT_USE_OIDC="1" and STACKIT_SERVICE_ACCOUNT_EMAIL.

Currently, I do this for creating the kubeconfig:

# (simplified)
export STACKIT_ACCESS_TOKEN=$(stackit auth activate-service-account --only-print-access-token --service-account-key-path $svcAccKeyPath))
stackit ske kubeconfig create $cluster_name

With WIF, I imagine the new flow would be:

# assuming the setup in stackit portal is already done for the service account + WIF
export STACKIT_USE_OIDC="1"
export STACKIT_SERVICE_ACCOUNT_EMAIL="<svc_acc_mail>"
export STACKIT_ACCESS_TOKEN=$(stackit auth activate-service-account --only-print-access-token)
stackit ske kubeconfig create $cluster_name

Alternative solutions (optional)

Current auth method works fine for me.

Additional information

edit: Here is how I use WIF with the terraform provider.

Activity

  1. mardonner
    added
    enhancementNew feature or request
    on Mar 5, 2026

  2. Fyusel commented on Mar 5, 2026

    @Fyusel
    Fyusel
    on Mar 5, 2026
    Contributor

    Hi @mardonner,
    thank you for reporting this issue. We will have a look at it.

  3. Fyusel
    added
    has internal tracking issue
    on Mar 5, 2026

  4. philross commented on May 13, 2026

    @philross
    philross
    on May 13, 2026
    Contributor

    @Fyuse @GokceGK l Any update on this?

  5. GokceGK commented on May 20, 2026

    @GokceGK
    GokceGK
    on May 20, 2026
    Contributor

    Hi @philross,
    we have discussed this enhancement request in team and created a work item to implement it.
    We have not find a chance to work on it yet but we have an eye on this to support it as soon as possible. When we have further information or progress, we will comment in this issue.

    We are always looking forward for the new contributions, whether from you or anyone else who would like to contribute.

    For further questions, please feel free to get in touch with our team.

    Regards,
    Gökce from the STACKIT Developer Tools Team

  6. philross commented on Aug 3, 2026

    @philross
    philross
    on Aug 3, 2026
    Contributor

    @mardonner Release https://github.com/stackitcloud/stackit-cli/releases/tag/v0.68.0 brings WIF support, here is a small example from me using it:

    stackit auth activate-service-account --use-oidc --verbosity debug (begin)
DBG arguments: [auth, activate-service-account, --use-oidc, --verbosity, debug]
DBG configuration is persisted and read from: /root/.config/stackit/cli-config.json
DBG read configuration profile "default" via
DBG active configuration profile: default
DBG configuration keys: [allowed_url_domain: stackit.cloud, assume_yes: false, async: false, region: eu01, session_time_limit: 12h, verbosity: debug]
DBG parsed input values: [OnlyPrintAccessToken: false, UseOIDC: true]
DBG authenticating using workload identity federation
DBG successfully authenticated service account sa-123456@sa.stackit.cloud

  7. mardonner commented on Aug 3, 2026

    @mardonner
    mardonner
    on Aug 3, 2026
    Author

    Excited to test this. Thanks for the hard work!

  8. AdrianoKF commented on Aug 5, 2026

    @AdrianoKF
    AdrianoKF
    on Aug 5, 2026

    Can confirm independently - this feature removes my bespoke curl/jq token dance that I had used as a stand-in for CLI WIF support in my GitHub Actions workflows previously. Thanks for the feature! 🙏🏻

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthas internal tracking issue

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions