Create a workload

Create a workload in a Project, grant it a Project role, and remove it when its job is retired.

Create one workload for each job that runs without a person, such as the nightly-curation job in the demo Project. The job then has its own ID and its own Project roles, so if it is retired or compromised, you revoke its access without touching anyone else's.

Prerequisites

You have the Project editor role to create a workload.
You have the Project admin role to grant the workload a Project role and to add its keys and trust policies.
You signed in with the CLI, or you have a token in $SPIRAL_TOKEN.

Create the workload

Create the workload in the Project that owns its identity. Give it a name that describes the job. Grant access separately in every Project the job uses, including its own Project.

In Studio, open Workloads in the Project sidebar and select Create workload. Select the new identity to add a trust policy or public key and grant a role in a target Project. The list shows workloads defined in this Project. Workloads defined elsewhere can have access here through separate grants without appearing in this list. Identity and credential changes apply across all branches, including when you have a historical commit open.

The trust policy form has templates for GitHub Actions, Google Cloud, Kubernetes, AWS, and Modal. Choose Custom OIDC provider to supply your own issuer, audience, and exact claim conditions. Provider templates have named fields for their supported identity claims. For GitHub Actions, the repository is required and the Git ref and other claim conditions are optional. Studio prefills a workload-specific audience. Request that exact value from the provider. Modal retains its fixed audience. For private-key sign-in, Register public key accepts an existing public JWK or an SSH .pub file by paste, file drop, or file selection. It also generates a key pair in your browser and downloads its private key. See Sign in with a private key.

The workload's Credentials section lists its trust policies by name and its public keys by key ID (kid). Open Public JWK to inspect a key. In Project access, choose the Target Project to list this workload's grants there, then select Grant role to add access. Managing grants requires permission in that target Project, independently of the Project that defines the workload. Grants in other Projects are separate. Use Revoke to remove a grant, or Deactivate workload to revoke all of the identity's credentials and trust policies when the job is retired. Credential changes can leave already issued access tokens valid until expiry.

request = WorkloadsCreateWorkloadRequest(name="nightly-curation")
workload = client.workloads.create_workload("demo", request).workload
print(f"created {workload.id}")

Grant a Project role

A new workload has no access. Grant it the narrowest role that covers its job; nightly-curation writes to the frames Table, so it needs editor:

spiral projects grant demo --role editor --workload-id work_01GHI

See Grant Project access for the HTTP form of this request.

Select how the workload signs in

A workload has no credentials when you create it, so it cannot sign in yet. Add one of these:

A trust policy, when the workload runs on a supported platform. See Sign in with a platform identity.
A public key, in other cases. See Sign in with a private key.