🤖 AI Summary
To address static permission bloat, coarse-grained auditing, and inadequate support for zero-trust principles in CI/CD pipelines, this paper proposes a dynamic credential proxy architecture grounded in runtime-verifiable identities (SPIFFE/SVID). The architecture decouples identity from access permissions and enables instantaneous, short-lived (second-scale) cross-trust-domain credential issuance via OAuth 2.0 Token Exchange. It integrates a gRPC-based proxy with unified RBAC/ABAC policy enforcement, enabling fine-grained, policy-driven authorization. This work introduces the first pipeline-centric dynamic credential proxy design paradigm, bridging a critical engineering gap in applying zero-trust identity models to continuous delivery. Evaluation in production demonstrates sub-500 ms policy enforcement latency, substantial reduction in long-lived credential exposure risk, and significant improvements in audit real-time performance and traceability.
📝 Abstract
Credential brokers offer a way to separate identity from access in CI/CD systems. This paper shows how verifiable identities issued at runtime, such as those from SPIFFE, can be used with brokers to enable short-lived, policy-driven credentials for pipelines and workloads. We walk through practical design patterns, including brokers that issue tokens just in time, apply access policies, and operate across trust domains. These ideas help reduce static permissions, improve auditability, and support Zero Trust goals in deployment workflows. This is the second paper in a three-part series on secure CI/CD identity architecture.