Verifier

A Verifier defines how daemons prove their identity when connecting to the Riptides control plane. Each Verifier targets a specific authentication mechanism and can filter incoming daemons by required metadata and automatically assign workload identities.

• API Group: auth.riptides.io
• Version: v1alpha1
• Kind: Verifier
• Plural: verifiers

Spec

The spec must include exactly one of the following authentication method fields. Optionally, requiredMetadata and workloadIDTemplate can be set alongside any method.

Authentication Methods

AWSIID

• Type: object

Verifies daemons using the AWS EC2 Instance Identity Document. The daemon presents a signed document from the EC2 metadata service, and the control plane validates the signature against AWS public certificates. No additional configuration is required on the object itself - use requiredMetadata to restrict which AWS accounts, regions, or instance types are accepted.

GCPIIT

• Type: object

Verifies daemons using a Google Cloud Instance Identity Token (a JWT signed by Google).

Field	Type	Required	Description
audience	string	No	Expected audience claim in the token
jwksURL	string	No	Custom JWKS URL for token verification
jwksCacheTTL	string	No	Cache duration for JWKS keys (e.g., 300s)
iatLeeway	string	No	Allowed clock skew for the iat claim (e.g., 60s)

AzureIMDS

• Type: object

Verifies daemons using an Azure Instance Metadata Service (IMDS) managed-identity token (a JWT).

Field	Type	Required	Description
resource	string	No	Expected resource/audience claim in the token (default: https://management.azure.com/)
jwksURL	string	No	Custom JWKS URL for token verification
jwksCacheTTL	string	No	Cache duration for JWKS keys (e.g., 300s)
iatLeeway	string	No	Allowed clock skew for the iat claim (e.g., 60s)

Danger

requiredMetadata is required for AzureIMDS verifiers. Omitting it causes the Verifier to be rejected at admission time. Without it, any Azure VM or managed identity could authenticate.

joinToken

• Type: object

Verifies daemons using a pre-shared JoinToken. Useful for initial setup, development, or environments where platform-native identity is unavailable. No additional fields - the token itself is defined in a separate JoinToken resource.

K8sSAT

• Type: object

Verifies daemons using a Kubernetes Service Account Token.

Field	Type	Required	Description
clusterID	string	Yes	Identifier for the Kubernetes cluster
jwksSource	object	Yes	Source of JWKS for token validation. One of inline (string) or remote ({url, minRefreshInterval})
audience	string	No	Expected audience claim
iatLeeway	string	No	Allowed clock skew for iat (e.g., 60s)

X509CertPOP

• Type: object

Verifies daemons by X.509 certificate proof of possession.

Field	Type	Required	Description
caCertificatePEM	string	Yes	PEM-encoded CA certificate used to validate the daemon’s certificate

SSHCertPOP

• Type: object

Verifies daemons by SSH certificate proof of possession.

Field	Type	Required	Description
authorizedCA	array of string	Yes	List of authorized CA public keys

GitHubActions

• Type: object

Verifies daemons using a GitHub Actions OIDC token. The runner fetches the token from the Actions token endpoint (ACTIONS_ID_TOKEN_REQUEST_URL) and the control plane validates it against GitHub’s public JWKS.

Field	Type	Required	Description
audience	string	Yes	Expected audience claim in the token (default: riptides; must match the action’s audience input)
jwksURL	string	No	Custom JWKS URL (default: https://token.actions.githubusercontent.com/.well-known/jwks)
jwksCacheTTL	string	No	Cache duration for JWKS keys (e.g. 300s)
iatLeeway	string	No	Allowed clock skew for the iat claim (e.g. 60s)

Scoping to specific orgs, repositories, environments, or branches is done with the Verifier’s requiredMetadata selectors against the githubactions:* metadata below - not with fields on the verifier itself, mirroring the AWS/GCP/Azure verifiers.

Danger

requiredMetadata is required for GitHub Actions verifiers. Omitting it causes the Verifier to be rejected at admission time. Without it, any GitHub Actions workflow across all of GitHub could authenticate.

JWT

• Type: object

Verifies daemons using a generic JWT.

Field	Type	Required	Description
issuer	string	Yes	Expected token issuer
audience	string	No	Expected audience claim
jwksSource	object	No	JWKS source: inline (string) or remote ({url, minRefreshInterval})
metadataMap	map[string]string	No	Mapping of JWT claims to daemon metadata keys
iatLeeway	string	No	Allowed clock skew (e.g., 60s)

Common Fields

requiredMetadata

• Type: array of objects (free-form key-value pairs)
• Required: No

Restricts which daemons this verifier will accept. Each entry is a key-value group that must all match the daemon’s metadata derived from its authentication proof (AND within a group, OR across groups). For example, an AWSIID verifier can require a specific AWS account ID.

Commonly used keys by verifier type:

Verifier	Key	Description
AWSIID	awsiid:account:id	AWS account ID
AWSIID	awsiid:region	AWS region
GCPIIT	gcpiit:project:id	GCP project ID
GCPIIT	gcpiit:zone	GCP zone
AzureIMDS	azureimds:subscription:id	Azure subscription ID
AzureIMDS	azureimds:resource_group	Azure resource group
GitHubActions	githubactions:repository:owner	GitHub org or user
GitHubActions	githubactions:repository:full_name	Full repo name (org/repo)
GitHubActions	githubactions:workflow	Workflow name
GitHubActions	githubactions:environment	Deployment environment
GitHubActions	githubactions:ref	Git ref
GitHubActions	githubactions:actor	User that triggered the run
GitHubActions	githubactions:run:id	Unique per workflow run

See Node Attestation for the complete metadata label list produced by every verifier type.

workloadIDTemplate

• Type: string
• Required: No

A Go template string used to automatically generate the workloadID for daemons that match this verifier. Template variables are populated from the daemon’s authentication metadata.

Status

Field	Type	Description
state	string	One of Unspecified, Available, Failed
message	string	Human-readable status message (set on failure)

Examples

AWS Instance Identity Document Verifier

Accepts daemons from a specific AWS account:

apiVersion: auth.riptides.io/v1alpha1
kind: Verifier
metadata:
  name: awsiid
  namespace: riptides-system
spec:
  AWSIID: {}
  requiredMetadata:
    - awsiid:account:id: "123456789012"

GCP Instance Identity Token Verifier

Accepts daemons from a specific GCP project:

apiVersion: auth.riptides.io/v1alpha1
kind: Verifier
metadata:
  name: gcpiit
  namespace: riptides-system
spec:
  GCPIIT:
    audience: gcp-iit
  requiredMetadata:
    - gcpiit:project:id: my-gcp-project-123456

Azure IMDS Verifier

Accepts daemons from a specific Azure subscription:

apiVersion: auth.riptides.io/v1alpha1
kind: Verifier
metadata:
  name: azureimds
  namespace: riptides-system
spec:
  AzureIMDS: {}
  requiredMetadata:
    - azureimds:subscription:id: "00000000-0000-0000-0000-000000000000"

GitHub Actions Verifier

Accepts runners from a specific GitHub organisation, restricted to the main branch:

apiVersion: auth.riptides.io/v1alpha1
kind: Verifier
metadata:
  name: github-actions
  namespace: riptides-system
spec:
  GitHubActions:
    audience: riptides
  requiredMetadata:
    - githubactions:repository:owner: your-org
      githubactions:ref: refs/heads/main

Join Token Verifier

Accepts daemons that present a valid pre-shared token (useful for development):

apiVersion: auth.riptides.io/v1alpha1
kind: Verifier
metadata:
  name: jointoken
  namespace: riptides-system
spec:
  joinToken: {}

Related Resources

• Daemon - daemons authenticate through verifiers
• JoinToken - defines pre-shared tokens used with the joinToken verifier type