support STACKIT_FEDERATED_TOKEN_FILE

Author: philross

AUTHENTICATION.md

@@ -128,4 +128,6 @@ Using this flow is less secure since the token is long-lived. You can provide th
    STACKIT_SERVICE_ACCOUNT_EMAIL=my-sa@sa.stackit.cloud
    # Optional: provide the OIDC token directly instead of auto-detecting it from the CI environment
    STACKIT_SERVICE_ACCOUNT_FEDERATED_TOKEN=<oidc-token>
+   # Optional: provide a file path containing the OIDC token
+   STACKIT_FEDERATED_TOKEN_FILE=/path/to/oidc-token.jwt
    ```

internal/cmd/auth/activate-service-account/activate_service_account_test.go

@@ -204,4 +204,3 @@ func TestStoreCustomEndpointFlags(t *testing.T) {
 		})
 	}
 }
-

internal/pkg/auth/oidc.go

@@ -12,6 +12,7 @@ const (
 	EnvUseOIDC                      = "STACKIT_USE_OIDC"
 	EnvServiceAccountEmail          = "STACKIT_SERVICE_ACCOUNT_EMAIL"
 	EnvServiceAccountFederatedToken = "STACKIT_SERVICE_ACCOUNT_FEDERATED_TOKEN" //nolint:gosec // linter false positive
+	EnvFederatedTokenFile           = "STACKIT_FEDERATED_TOKEN_FILE"
 	EnvGitHubRequestURL             = "ACTIONS_ID_TOKEN_REQUEST_URL"
 	EnvGitHubRequestToken           = "ACTIONS_ID_TOKEN_REQUEST_TOKEN" //nolint:gosec // linter false positive
 	EnvAzureOIDCRequestURI          = "SYSTEM_OIDCREQUESTURI"
@@ -38,8 +39,8 @@ func OIDCServiceAccountEmail() string {
 
 // TokenFunc returns the OIDCTokenFunc to use for Workload Identity Federation.
 // It checks the following token sources in order: STACKIT_SERVICE_ACCOUNT_FEDERATED_TOKEN,
-// GitHub Actions (ACTIONS_ID_TOKEN_REQUEST_URL + ACTIONS_ID_TOKEN_REQUEST_TOKEN), and
-// Azure DevOps (SYSTEM_OIDCREQUESTURI + SYSTEM_ACCESSTOKEN).
+// STACKIT_FEDERATED_TOKEN_FILE, GitHub Actions (ACTIONS_ID_TOKEN_REQUEST_URL +
+// ACTIONS_ID_TOKEN_REQUEST_TOKEN), and Azure DevOps (SYSTEM_OIDCREQUESTURI + SYSTEM_ACCESSTOKEN).
 // Returns an error if no source is detected.
 func OIDCTokenFunc() (oidcadapters.OIDCTokenFunc, error) {
 	// static token provided directly via env var
@@ -49,6 +50,11 @@ func OIDCTokenFunc() (oidcadapters.OIDCTokenFunc, error) {
 		}, nil
 	}
 
+	// token read from filesystem path via env var
+	if tokenFilePath := os.Getenv(EnvFederatedTokenFile); tokenFilePath != "" {
+		return oidcadapters.ReadJWTFromFileSystem(tokenFilePath), nil
+	}
+
 	// GitHub Actions
 	if ghURL := os.Getenv(EnvGitHubRequestURL); ghURL != "" {
 		if ghToken := os.Getenv(EnvGitHubRequestToken); ghToken != "" {
@@ -65,10 +71,10 @@ func OIDCTokenFunc() (oidcadapters.OIDCTokenFunc, error) {
 
 	return nil, fmt.Errorf(
 		"%s is enabled but no OIDC token source was detected\n"+
-			"Provide the token via %s, or run in a supported CI environment:\n"+
+			"Provide the token via %s or %s, or run in a supported CI environment:\n"+
 			"  - GitHub Actions: grant 'id-token: write' permission; %s and %s are set automatically by the runner\n"+
 			"  - Azure DevOps:   pass 'SYSTEM_ACCESSTOKEN: $(System.AccessToken)' in your pipeline step",
-		EnvUseOIDC, EnvServiceAccountFederatedToken,
+		EnvUseOIDC, EnvServiceAccountFederatedToken, EnvFederatedTokenFile,
 		EnvGitHubRequestURL, EnvGitHubRequestToken,
 	)
 }