{
  "slug": "receiver-secret-less-oidc-secured-webhooks-24e97f0fb868",
  "title": "Receiver secret-less OIDC-secured webhooks",
  "tools": [
    "flux"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-30T15:48:09.000Z",
  "announced_at": "2026-06-30T15:48:09.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When configuring an OIDC-secured webhook Receiver, set its type to `generic-oidc` and define an OIDC provider with validations and the Flux resources to reconcile. The Receiver uses no Secret; callers send a valid OIDC ID token in the `Authorization: Bearer` header.",
    "examples": [
      "apiVersion: notification.toolkit.fluxcd.io/v1\nkind: Receiver\nmetadata:\n  name: <receiver-name>\n  namespace: <namespace>\nspec:\n  type: generic-oidc\n  oidcProviders:\n    - issuerURL: <issuer-url>\n      validations:\n        - expression: \"<CEL expression>\"\n          message: \"<failure message>\"\n  resources:\n    - apiVersion: <api-group>/<version>\n      kind: <resource-kind>\n      name: <resource-name>"
    ],
    "gotchas": [
      "Version: v2.9.0",
      "spec.type (required): Set to `generic-oidc` for OIDC authentication without a Secret.",
      "spec.oidcProviders[].issuerURL (required): Issuer URL matched against the token's `iss` claim.",
      "spec.oidcProviders[].audience: Expected token `aud` claim; defaults to `notification-controller`.",
      "spec.oidcProviders[].validations (required): CEL boolean expressions; every expression must evaluate to true. `expression` is required; `message` is returned when that expression fails.",
      "spec.oidcProviders[].variables: Ordered named CEL expressions exposed as `vars.<name>`; each entry has `name` and `expression`. Variables can use claims and previously defined variables.",
      "spec.secretRef: Must be omitted for `generic-oidc`; setting it is rejected.",
      "spec.resources (required): Flux resources reconciled when the webhook is called. Each entry requires `kind` and `name`; `apiVersion` and `namespace` are optional. `matchLabels` is optional and requires `name: \"*\"`.",
      "Authorization header (required): Webhook request must carry a valid OIDC ID token as `Authorization: Bearer <token>`.",
      "Prerequisite: Configure at least one OIDC provider and required CEL validations; constrain identity claims because a valid token signature alone does not authorize a request.",
      "Prerequisite: The target Flux Custom Resources must be listed in `spec.resources`.",
      "The webhook is described as secret-less and OIDC-secured."
    ]
  },
  "why_it_matters": "Configure a Receiver webhook secured with OIDC without a secret.",
  "sources": [
    "https://github.com/fluxcd/flux2/releases/tag/v2.9.0",
    "https://v2-9.docs.fluxcd.io/flux/components/notification/receivers/"
  ],
  "rank": 0.94029,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-c32d821b4a38c9aa-11:rescue",
    "evidence_hash": "920ed5d44d86a1e6ae83bdbe72fcbf4a8e64b96688a7d16b526f72acbaec0ea2"
  },
  "review": {
    "draft_hash": "151f093ad442e17cf34f9c402bd5ee15aa852202a95230cef221e461e84a180c",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.64 (>= 0.6 needed)."
  }
}