Workload Identity

Authenticate workloads without static credentials.

Workload identity APIs are not shipped in this repo.

Overview

Workload identity allows applications to authenticate based on their runtime identity rather than static secrets.

Supported platforms

Kubernetes

serviceAccountName: my-app
annotations:
  qnsp.io/workload-identity: "enabled"

AWS

{
  "type": "aws-iam",
  "roleArn": "arn:aws:iam::123456789:role/my-app"
}

GCP

{
  "type": "gcp-sa",
  "serviceAccount": "my-app@project.iam.gserviceaccount.com"
}

Authentication flow

1. Workload requests identity token from platform
2. Token presented to QNSP
3. QNSP validates token with platform
4. QNSP issues scoped access token
5. Workload accesses secrets

Configuration

For workloads running in Kubernetes, use a service account to obtain a QNSP access token (for example via auth-service service accounts) and pass the token to SDK/API calls.

Benefits

• No static credentials to manage
• Automatic rotation
• Platform-native security
• Audit trail of workload access