Oidc

Pool + OIDC provider with issuer token.actions.githubusercontent.com and an attribute-condition on repository_owner; roles/iam.workloadIdentityUser to the repo’s principalSet; auth@v3 with workload_identity_provider and service_account. No secrets to rotate.

Confidential OIDC client in Keycloak, pveum realm add –type openid with preferred_username as the username claim, autocreate and ACLs. The old guides with /auth/realms/ and a ‘username’ mapper are no longer needed.