feat: add support for caching refresh token in armadactl#4490
Merged
dejanzele merged 2 commits intoarmadaproject:masterfrom Jan 16, 2026
Merged
feat: add support for caching refresh token in armadactl#4490dejanzele merged 2 commits intoarmadaproject:masterfrom
dejanzele merged 2 commits intoarmadaproject:masterfrom
Conversation
13c61aa to
c35aeb7
Compare
nikola-jokic
previously approved these changes
Nov 28, 2025
nikola-jokic
previously approved these changes
Dec 16, 2025
cf746b3 to
341710b
Compare
nikola-jokic
previously approved these changes
Jan 13, 2026
341710b to
5d3d080
Compare
nikola-jokic
previously approved these changes
Jan 14, 2026
5d3d080 to
ae3dd27
Compare
ae3dd27 to
c024772
Compare
Add token caching for OIDC auth to avoid repeated browser authentication. The refresh token is securely stored in the system keyring (macOS Keychain, Windows Credential Manager, Linux Secret Service). To enable, add `cacheRefreshToken: true` to your context in ~/.armadactl.yaml and include `offline_access` in your scopes. Note: armadactl must be built with CGO_ENABLED=1 on macOS for keychain access. Signed-off-by: Dejan Zele Pejchev <pejcev.dejan@gmail.com>
c024772 to
af92a0b
Compare
JamesMurkin
approved these changes
Jan 16, 2026
Sigele
pushed a commit
to Sigele/armada
that referenced
this pull request
Jan 30, 2026
…ct#4490) #### What type of PR is this? Feature which adds OIDC refresh token caching in armadactl. #### What this PR does / why we need it: Adds token caching for OIDC auth so you don't have to authenticate in the browser every single time you run armadactl. Currently it's super annoying - every command opens the browser for auth. This PR fixes that by securely caching the refresh token in your system keyring (Keychain on mac, etc). After you auth once, subsequent commands just work without the browser popup. The implementation is secure - only uses the OS keyring, never falls back to files. If there's no keyring available, caching just gets disabled. To use it, just add `cacheRefreshToken: true` to your context in `~/.armadactl.yaml`: ```yaml contexts: my-context: cacheRefreshToken: true openIdAuth: providerUrl: "http://localhost:8180/realms/armada" clientId: "armada-server" localPort: 8085 scopes: ["openid", "profile", "email", "offline_access"] ``` Make sure to add `offline_access` scope so refresh token is returned from the IDP. #### Which issue(s) this PR fixes: Fixes armadaproject#4487 #### Special notes `armadactl` MUST be built with `CGO_ENABLED=1` for this to work properly. Signed-off-by: Dejan Zele Pejchev <pejcev.dejan@gmail.com> Signed-off-by: Sigele Nickerson-Adams <sigele.nickerson-adams@nmc2.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Feature which adds OIDC refresh token caching in armadactl.
What this PR does / why we need it:
Adds token caching for OIDC auth so you don't have to authenticate in the browser every single time you run armadactl.
Currently it's super annoying - every command opens the browser for auth.
This PR fixes that by securely caching the refresh token in your system keyring (Keychain on mac, etc).
After you auth once, subsequent commands just work without the browser popup.
The implementation is secure - only uses the OS keyring, never falls back to files.
If there's no keyring available, caching just gets disabled.
To use it, just add
cacheRefreshToken: trueto your context in~/.armadactl.yaml:Make sure to add
offline_accessscope so refresh token is returned from the IDP.Which issue(s) this PR fixes:
Fixes #4487
Special notes
armadactlMUST be built withCGO_ENABLED=1for this to work properly.