CredentialSource

CredentialSource defines where and how credentials are obtained for workloads. It supports a wide range of credential types including Kubernetes secrets, cloud IAM federation (AWS, GCP, Azure), HashiCorp Vault, JWT minting, OAuth2 flows, and OCI.

• API Group: core.riptides.io
• Version: v1alpha1
• Kind: CredentialSource
• Plural: credentialsources

Spec

Exactly one credential type must be specified in the spec. The following sections describe each supported type.

---

kubernetes

Retrieves a credential from a Kubernetes Secret.

Field	Type	Required	Description
type	string	Yes	Credential type. Valid options: BearerToken.
secretRef.name	string	Yes	Name of the Kubernetes Secret.
secretRef.key	string	Yes	Key within the Secret that contains the credential value.

---

aws

Obtains temporary AWS credentials via OIDC federation (STS AssumeRoleWithWebIdentity).

Field	Type	Required	Description
roleArn	string	Yes	The ARN of the IAM role to assume (e.g., arn:aws:iam::123456789012:role/my-role).
audience	array of string	No	Audiences for the OIDC token presented to AWS STS.
lifetime	string	No	Requested session duration (e.g., 3600s).
idTokenLifetime	string	No	Lifetime of the intermediate OIDC ID token (e.g., 300s).
idTokenClaims	object	No	Additional claims to include in the OIDC ID token.

---

gcp

Obtains GCP credentials via Workload Identity Federation.

Field	Type	Required	Description
oidcProviderId	string	Yes	Full resource name of the GCP Workload Identity Pool provider.
serviceAccount	string	No	GCP service account email to impersonate. If omitted, uses the federated identity directly.
scopes	array of string	No	OAuth2 scopes to request (e.g., https://www.googleapis.com/auth/cloud-platform).
lifetime	string	No	Requested token lifetime (e.g., 3600s).
audience	array of string	No	Audiences for the OIDC token.
idTokenLifetime	string	No	Lifetime of the intermediate OIDC ID token.
idTokenClaims	object	No	Additional claims to include in the OIDC ID token.

---

azure

Obtains Azure AD credentials via federated identity.

Field	Type	Required	Description
clientId	string	Yes	Azure AD application (client) ID.
tenantId	string	Yes	Azure AD tenant ID.
scope	string	Yes	The scope to request (e.g., https://management.azure.com/.default).
audience	array of string	No	Audiences for the OIDC token.
idTokenLifetime	string	No	Lifetime of the intermediate OIDC ID token.
idTokenClaims	object	No	Additional claims to include in the OIDC ID token.

---

vault

Retrieves credentials from HashiCorp Vault. Riptides authenticates to Vault using a JWT and then reads from a specified secrets engine path.

Field	Type	Required	Description
address	string	Yes	Vault server URL (e.g., https://vault.example.com).
role	string	Yes	Vault auth role name.
path	string	Yes	Vault secrets engine path to read from (e.g., secret/data/myapp).
jwtAuthMethodPath	string	No	Path to the JWT auth method in Vault (e.g., jwt_prod). If omitted, uses the default JWT auth path.
audience	array of string	No	Audiences for the JWT token presented to Vault.
pollInterval	string	No	How often to refresh the credential from Vault (e.g., 60s).
idTokenLifetime	string	No	Lifetime of the JWT used for Vault authentication.
idTokenClaims	object	No	Additional claims in the JWT for Vault auth.
type	object	No	Specifies how to handle the secret returned by Vault. See below.

vault.type

Defines the format of the credential returned by Vault and how Riptides should process it. Exactly one sub-field may be set:

• token — The Vault response contains a token or API key.

  • source (string, required) — The key in the Vault response JSON that contains the token value (e.g., api_key).

• aws — The Vault response contains AWS credentials (from the AWS secrets engine). No additional configuration needed.

• gcp — The Vault response contains GCP credentials. One of:

  • accessToken — Treat the response as a GCP access token. No additional fields.
  • serviceAccountKey — Treat the response as a GCP service account key.
    • scopes (array of string) — OAuth2 scopes to request when minting an access token from the key.

• azure — The Vault response contains Azure credentials.

  • tenantId (string, required) — Azure AD tenant ID.
  • scopes (array of string) — Scopes for minting the access token.

---

jwt

Mints a JWT credential using the workload’s SPIFFE identity. Useful for service-to-service authentication where the consumer expects a JWT.

Field	Type	Required	Description
audience	array of string	Yes	Audiences to include in the JWT aud claim.
lifetime	string	No	Token lifetime (e.g., 60s).
claims	object	No	Additional custom claims to include in the JWT payload.

---

oa2cc

Obtains an access token using the OAuth2 Client Credentials grant.

Field	Type	Required	Description
tokenEndpointUrl	string	Yes	Token endpoint URL of the authorization server.
secretRef.name	string	Yes	Kubernetes Secret containing the client credentials.
secretRef.key	string	Yes	Key within the Secret.
scopes	array of string	No	OAuth2 scopes to request.
authStyle	string	No	How to send client credentials. Valid options: HEADER, BODY.
additionalParams	map of string	No	Additional parameters to include in the token request.

---

oa2ac

Obtains an access token using the OAuth2 Authorization Code grant.

Field	Type	Required	Description
authorizationEndpointUrl	string	Yes	Authorization endpoint URL.
tokenEndpointUrl	string	Yes	Token endpoint URL.
secretRef.name	string	Yes	Kubernetes Secret containing the client credentials.
secretRef.key	string	Yes	Key within the Secret.
scopes	array of string	No	OAuth2 scopes to request.
usePkce	boolean	No	Enable PKCE (Proof Key for Code Exchange).
authStyle	string	No	How to send client credentials. Valid options: HEADER, BODY.
additionalParams	map of string	No	Additional parameters for the token request.

---

oci

Obtains credentials from Oracle Cloud Infrastructure (OCI) Identity Domains.

Field	Type	Required	Description
region	string	Yes	OCI region (e.g., us-ashburn-1).
clientId	string	Yes	OIDC client ID.
clientSecret	string	Yes	OIDC client secret.
identityDomainUrl	string	Yes	OCI Identity Domain URL.
tenancyOcid	string	Yes	OCI tenancy OCID.
idTokenLifetime	string	No	Lifetime of the intermediate OIDC ID token.
idTokenClaims	object	No	Additional claims in the OIDC ID token.

Status

Field	Type	Description
state	string	Current state of the credential source. Valid values: AVAILABLE, UNAVAILABLE.
message	string	Human-readable message providing additional detail about the current state.

Examples

Kubernetes BearerToken from a Secret

apiVersion: core.riptides.io/v1alpha1
kind: CredentialSource
metadata:
  name: my-api-bearer
  namespace: riptides-system
spec:
  kubernetes:
    type: BearerToken
    secretRef:
      name: my-api-key
      key: token

AWS IAM role via OIDC federation

apiVersion: core.riptides.io/v1alpha1
kind: CredentialSource
metadata:
  name: aws-cred-source
  namespace: riptides-system
spec:
  aws:
    roleArn: arn:aws:iam::123456789012:role/my-workload-role

GCP Workload Identity Federation

apiVersion: core.riptides.io/v1alpha1
kind: CredentialSource
metadata:
  name: gcp-cred-source
  namespace: riptides-system
spec:
  gcp:
    oidcProviderId: //iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/my-pool/providers/my-provider
    serviceAccount: my-service@my-project.iam.gserviceaccount.com
    scopes:
      - https://www.googleapis.com/auth/cloud-platform
    lifetime: 3600s

JWT credential

apiVersion: core.riptides.io/v1alpha1
kind: CredentialSource
metadata:
  name: my-jwt-svid
  namespace: riptides-system
spec:
  jwt:
    audience:
      - https://api.example.com
    claims:
      custom: value
    lifetime: 60s

HashiCorp Vault (token type)

apiVersion: core.riptides.io/v1alpha1
kind: CredentialSource
metadata:
  name: vault-api-keys
  namespace: riptides-system
spec:
  vault:
    address: https://vault.example.com
    role: my-api-keys
    path: secret/creds/my-role
    jwtAuthMethodPath: jwt_prod
    audience:
      - vault.example.com
    type:
      token:
        source: api_key

Related Resources

• CredentialBinding — Bind this credential source to a workload for delivery.
• WorkloadIdentity — The workload that receives injected credentials.
• API Reference Overview