OIDC diagrams #2657
OIDC diagrams #2657
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughA new documentation section was added to explain the fundamentals of OIDC authentication for both public and private CI/CD platforms. This includes conceptual explanations and two sequence diagrams illustrating the authentication flows to AWS, without altering any code or exported entities. Changes
Sequence Diagram(s)sequenceDiagram
participant CI/CD Platform (Public)
participant AWS
participant SCM Host
CI/CD Platform (Public)->>SCM Host: Generate key pair, sign JWT
CI/CD Platform (Public)->>AWS: Send JWT
AWS->>SCM Host: Fetch public key
AWS->>AWS: Validate JWT signature & content
AWS-->>CI/CD Platform (Public): Return temporary AWS credentials
sequenceDiagram
participant CI/CD Platform (Private)
participant S3 Bucket
participant AWS
CI/CD Platform (Private)->>S3 Bucket: Publish public key
CI/CD Platform (Private)->>AWS: Update IdP provider URL & issuer
CI/CD Platform (Private)->>AWS: Generate & sign JWT with updated issuer
AWS->>S3 Bucket: Fetch public key
AWS->>AWS: Validate JWT signature & content
AWS-->>CI/CD Platform (Private): Return temporary AWS credentials
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
docs/2.0/docs/pipelines/concepts/cloud-auth.md (4)
75-80: Rephrase the introductory sentence for precision and toneThe phrase “like some self-hosted GitLab Ultimate, GitHub Enterprise etc. instances” is a bit vague and slightly informal. Consider tightening it up and explicitly naming the products rather than using “etc.” to keep the docs crisp.
-The below diagrams illustrate how CI/CD Platforms use OIDC to authenticate to cloud accounts (AWS in these examples). There is a difference in how this is done for publicly available CI/CD platforms (like GitHub.com and GitLab Cloud) and non-publicly available CI/CD platforms (like some self-hosted GitLab Ultimate, GitHub Enterprise etc. instances). +The diagrams below illustrate how CI/CD platforms use OIDC to authenticate to cloud accounts (AWS in these examples). The process differs between publicly available platforms (e.g., GitHub.com, GitLab.com) and private, self-hosted platforms (e.g., GitLab Ultimate Self-Managed, GitHub Enterprise Server).
90-94: Replace raw HTML<br>with Mermaid-friendly line breaksMermaid sequence-diagram text nodes don’t reliably render raw HTML tags. Use the Mermaid‐supported line-break sequence (
\\) instead to avoid rendering issues.- AWSIdP->>SCMPublicRoute: Fetch public key via HTTPS <br>(which validates that the SCM is who it says it is) + AWSIdP->>SCMPublicRoute: Fetch public key via HTTPS \\n(which validates that the SCM is who it says it is)
104-109: Inconsistent participant label capitalisation
AwsIdP(lower-case “s”) breaks the naming convention you set earlier (AWSIdP). Align the casing to avoid confusion.- participant AWSIdP as AWS IdP & STS + participant AWSIdP as AWS IdP & STS(Note: also update the later arrow definitions that use
AwsIdP.)
112-116: Clarify who updates the AWS IdP settingsLine 113 implies that the SCM itself updates the provider URL in AWS, which is done by an administrator, not the CI/CD platform. A quick wording tweak removes that potential confusion.
- SCM->>AwsIdP: Update provider URL in AWS IdP to S3 bucket public URL - SCM->>SCM: Update issuer to hostname of S3 bucket public URL + Admin->>AWSIdP: Configure provider URL in AWS IdP to point to the S3-hosted JWKS + Admin->>SCM: Set issuer to the S3 bucket’s hostname(Adjust participant names in the diagram header accordingly if you adopt this change.)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/2.0/docs/pipelines/concepts/cloud-auth.md(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Validate generated content
- GitHub Check: validate_build
Summary by CodeRabbit