←Changelog

Workload identity federation

Workload identities settings showing two GitLab project bindings, each signing in as its own service user, and the trusted GitLab issuer

CI jobs, cloud workloads, and Kubernetes pods can now authenticate to Ryvn with their own OIDC tokens, so there's no Ryvn client secret to store or rotate. You trust an OIDC issuer such as GitLab CI and bind specific token claims to a service user, and the Ryvn CLI exchanges the workload's token for a short-lived Ryvn credential.