Workload configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [workload] and its nested headings. Each row gives the serde type and source default or unset meaning; issuer material stays in protected files. Check parsing and workload cross-field rules with gdsgate doctor --config <PATH> --json, then follow the registration and PKI guide.

[workload]

Used by: Authority.

Workload identity: which platform issuers may bootstrap a machine identity and how their token claims are templated into SPIFFE IDs. Off by default (trust_domain empty). See Concepts → Workload identity and Integrations → Workload identity.

Key	Type	Default	Purpose
trust_domain	string	unset	SPIFFE trust domain of this cluster (lowercase [a-z0-9._-]). Every workload is named spiffe://<trust_domain>/<slug>/<path>. Empty disables workload identity.
cert_ttl_secs	u64	900	Validity of an issued workload certificate. Short by design: the workload re-bootstraps or renews to stay fresh, so there is no long-lived credential.

A provision-token workload needs no issuer entry, since an operator mints its proof with gdsgate authority create-token --role workload. A platform issuer is one [[workload.issuers]] table:

Key	Type	Default	Purpose
slug	string	unset	Short unique label ([A-Za-z0-9._-]), forced as the first SPIFFE path segment so two issuers' workloads can never collide by name.
issuer	string	unset	Issuer URL, the iss claim of this platform's tokens, for example a GitLab instance URL.
audience	string	unset, required	Expected token aud, the gateway's own origin (for example https://gate.example.com). It is what stops a token minted for the platform's default audience from being exchangeable for a gdsgate certificate by whoever it was shown to; Authority refuses to start on an entry without it.
path_template	string	unset	SPIFFE path rendered from token claims, for example project/{project_path}/ref/{ref}. Substituted values are limited to [A-Za-z0-9._-]; a value carrying /, a dot segment, or an empty value refuses issuance rather than being escaped.
groups	array of string	[]	Cedar groups granted to this issuer's workloads (Connector in Group::"<group>"). Groups come from this mapping only, never from raw token claims.
owner_claim	string	unset	Claim naming the human the workload acts for (for example GitLab user_login); when present the owner is User::"<value>".
owner_service	string	unset	Static service-account owner used when owner_claim is unset or absent from the proof; the owner becomes Service::"<value>".
single_use_jti	bool	true	Refuse a second exchange of the same proof token. On by default; opt out only for a platform whose retry semantics legitimately re-present one token.

Discovery and JWKS fetches for a workload issuer reuse the [oidc] HTTP settings (request_timeout_secs, allow_insecure_http, jwks_refresh_secs) and the [oidc].id_token_signing_algs whitelist.

[workload]
trust_domain  = "gds.example"
cert_ttl_secs = 900

[[workload.issuers]]
slug          = "gitlab"
issuer        = "https://gitlab.example"
audience      = "https://gate.example.com"
path_template = "project/{project_path}/ref/{ref}"
groups        = ["ci"]
owner_claim   = "user_login"

Revocation needs the receipt key

gdsgate authority revoke-workload seals a tamper-evident receipt with the same HMAC key the per-node registry uses. Set [audit].revocation_key_path and run gdsgate authority init-revocation-key, or revocation fails closed.