Compartment level binding for workload identity

A computing system comprising:

• one or more processors;
• and
• one or more computer-readable media having stored thereon a sequence of instructions that, when executed, cause the one or more processors to:
• receive, by a manager instance of the computing system and from a pod, a first request for a token used to access a resource managed by a customer tenancy, the pod managed by a provider tenancy and associated with a namespace;
• transmit, by the manager instance of the computing system and to a token issuance service of the computing system, a second request for the token;
• identify, by the token issuance service of the computing system, a mapping object that maps the namespace to the resource, the mapping object comprising a namespace identifier and a compartment identifier;
• transmit, by the token issuance service of the computing system and to an identity service of the computing system, the mapping object and a third request for the token;
• identify, by the identity service of the computing system, a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource;
• access, by the identity service of the computing system, a policy stored in a compartment;
• determine, by the identity service of the computing system, whether the pod has permission to access the resource based at least in part on the policy;
• generate, by the identity service of the computing system, the token based at least in part on the mapping object and the policy;
• and
• transmit, by the identity service of the computing system, the token to the pod.

One or more non-transitory computer-readable media having stored thereon a sequence of instructions that, when executed by one or more processors of a computing system, cause the computing system to:

• receive, by a manager instance of the computing system and from a pod, a first request for a token used to access a resource managed by a customer tenancy, the pod managed by a provider tenancy and associated with a namespace;
• transmit, by the manager instance of the computing system and to a token issuance service of the computing system, a second request for the token;
• identify, by the token issuance service of the computing system, a mapping object that maps the namespace to the resource, the mapping object comprising a namespace identifier and a compartment identifier;
• transmit, by the token issuance service of the computing system and to an identity service of the computing system, the mapping object and a third request for the token;
• identify, by the identity service of the computing system, a compartment of the customer tenancy based at least in part on the compartment identifier, the compartment managing the resource;
• access, by the identity service of the computing system, a policy stored in a compartment;
• determine, by the identity service of the computing system, whether the pod has permission to access the resource based at least in part on the policy;
• generate, by the identity service of the computing system, the token based at least in part on the mapping object and the policy;
• and
• transmit, by the identity service of the computing system, the token to the pod.