Receiver secret-less OIDC-secured webhooks

Introduced 2026-06-30 · score 0.94

HOW TO USE IT

When configuring an OIDC-secured webhook Receiver, set its type to `generic-oidc` and define an OIDC provider with validations and the Flux resources to reconcile. The Receiver uses no Secret; callers send a valid OIDC ID token in the `Authorization: Bearer` header.

apiVersion: notification.toolkit.fluxcd.io/v1
kind: Receiver
metadata:
  name: <receiver-name>
  namespace: <namespace>
spec:
  type: generic-oidc
  oidcProviders:
    - issuerURL: <issuer-url>
      validations:
        - expression: "<CEL expression>"
          message: "<failure message>"
  resources:
    - apiVersion: <api-group>/<version>
      kind: <resource-kind>
      name: <resource-name>

WHY THIS HELPS

Configure a Receiver webhook secured with OIDC without a secret.

REQUIREMENTS AND LIMITATIONS

Version: v2.9.0
spec.type (required): Set to `generic-oidc` for OIDC authentication without a Secret.
spec.oidcProviders[].issuerURL (required): Issuer URL matched against the token's `iss` claim.
spec.oidcProviders[].audience: Expected token `aud` claim; defaults to `notification-controller`.
spec.oidcProviders[].validations (required): CEL boolean expressions; every expression must evaluate to true. `expression` is required; `message` is returned when that expression fails.
spec.oidcProviders[].variables: Ordered named CEL expressions exposed as `vars.<name>`; each entry has `name` and `expression`. Variables can use claims and previously defined variables.
spec.secretRef: Must be omitted for `generic-oidc`; setting it is rejected.
spec.resources (required): Flux resources reconciled when the webhook is called. Each entry requires `kind` and `name`; `apiVersion` and `namespace` are optional. `matchLabels` is optional and requires `name: "*"`.
Authorization header (required): Webhook request must carry a valid OIDC ID token as `Authorization: Bearer <token>`.
Prerequisite: Configure at least one OIDC provider and required CEL validations; constrain identity claims because a valid token signature alone does not authorize a request.
Prerequisite: The target Flux Custom Resources must be listed in `spec.resources`.
The webhook is described as secret-less and OIDC-secured.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card

Tools change faster than your agent’s training data.

Changes

Receiver secret-less OIDC-secured webhooks