Workload configuration

Paths in the tables are relative to [workload] and its nested headings. Check parsing and cross-field rules with gdsgate doctor --config <PATH> --json. See the registration and PKI guide.

[workload]

Used by: Authority.

Workload identity: which platform issuers may obtain a machine identity, and how their token claims map to SPIFFE IDs. Off by default (trust_domain empty). See Concepts → Workload identity and Integrations → Workload identity.

Key	Type	Default	Purpose
trust_domain	string	unset	SPIFFE trust domain of this cluster (lowercase [a-z0-9._-]). Every workload is named spiffe://<trust_domain>/<slug>/<path>. Empty disables workload identity.
cert_ttl_secs	u64	900	Validity of an issued workload certificate. The workload renews or obtains a new one before expiry.

A workload that uses a provision token (gdsgate authority create-token --role workload) needs no issuer entry. Each platform issuer is one [[workload.issuers]] table:

Key	Type	Default	Purpose
slug	string	unset	Short unique label ([A-Za-z0-9._-]), used as the first SPIFFE path segment.
issuer	string	unset	Issuer URL, the iss claim of the platform's tokens, for example a GitLab instance URL.
audience	string	unset, required	Expected token aud: the gateway's origin (for example https://gate.example.com). Authority refuses to start on an entry without it.
path_template	string	unset	SPIFFE path built from token claims, for example project/{project_path}/ref/{ref}. Substituted values must match [A-Za-z0-9._-]; a value with /, a dot segment, or an empty value refuses issuance.
groups	array of string	[]	Cedar groups for this issuer's workloads (Connector in Group::"<group>"). Token group claims are not used.
owner_claim	string	unset	Claim naming the person the workload acts for (for example GitLab user_login); the owner is User::"<value>".
owner_service	string	unset	Service owner used when owner_claim is unset or missing from the token; the owner is Service::"<value>".
single_use_jti	bool	true	Refuse a second exchange of the same token. Turn off only for a platform that re-sends one token on retry.

Discovery and JWKS fetches for workload issuers use the [oidc] HTTP settings (request_timeout_secs, allow_insecure_http, jwks_refresh_secs) and [oidc].id_token_signing_algs.

[workload]
trust_domain  = "gds.example"
cert_ttl_secs = 900

[[workload.issuers]]
slug          = "gitlab"
issuer        = "https://gitlab.example"
audience      = "https://gate.example.com"
path_template = "project/{project_path}/ref/{ref}"
groups        = ["ci"]
owner_claim   = "user_login"

Revocation needs the receipt key

gdsgate authority revoke-workload seals a receipt with the node revocation key of the control keyring. Name the keyring in [security.integrity]; otherwise revocation is refused.