Struct Federated 

pub struct Federated { /* private fields */ }

A CI job’s OIDC token, exchanged at the security token service for the access token of the WORKLOAD service account a federated credential trusts the job as. The access token is reused until a minute before it expires; then a fresh job token is fetched and exchanged again. An exchange the STS can’t check right now (503) is sent again twice.

Implementations

impl Federated

pub fn from_file(path: impl Into<PathBuf>) -> Self

The token in the file at path, read again at every exchange, so that a rotated token is picked up: any CI provider’s, or a Kubernetes projected service account token.

pub fn github_actions( request_url: impl Into<String>, request_token: impl Into<String>, ) -> Self

A GitHub Actions job’s token, requested at request_url with request_token: the values of ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, which GitHub sets in a job granted permissions: id-token: write.

pub fn with_endpoint(self, url: impl Into<String>) -> Self

Exchanges the token at the STS at url instead of STS_ENDPOINT.

pub fn with_audience(self, audience: impl Into<String>) -> Self

Requests GitHub’s token for audience instead of OIDC_AUDIENCE. A token file’s audience is whatever its issuer put in it.

pub fn with_http_client(self, http: Client) -> Self

Sends the requests with http, instead of the client all credentials share. Each request is bounded by 30 seconds either way.

Trait Implementations

impl Credentials for Federated

fn token(&self) -> TokenFuture<'_>

A valid access token.

impl Debug for Federated

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.