Connect something¶
One row per integration, with its how-to and worked example.
In means the thing signs in to or calls sluis. Out means sluis calls it or manages it. Both means each.
People and consoles¶
| Integration | Connects | Direction | How-to | Example |
|---|---|---|---|---|
| Console with its own sign-in | a web UI you write | in | console-app | example |
| Native or gateway OIDC | the choice between the two | in | choosing | |
| Envoy Gateway OIDC | a console behind Envoy Gateway | in | envoy-gateway-oidc | example |
| oauth2-proxy | a console behind any other gateway | in | oauth2-proxy | example |
| Business surface | a test surface for employees | in | business-surface | |
| MCP server | a resource server and self-described clients | in | mcp | example |
| MCP server proxy | a stock MCP server behind a sidecar | in | mcp-resource-proxy | |
| Argo CD | its own OIDC flow | in | argocd | |
| Kargo | its own OIDC flow and CLI | in | kargo | |
| Generated client secret | a relying party's secret | out | generate | example |
Services and workloads¶
| Integration | Connects | Direction | How-to | Example |
|---|---|---|---|---|
| Service to service | a workload calling a service | in | service-to-service | |
| Kubernetes cluster | people and CI to an API server | in | kubernetes-cluster | |
| GitHub Actions | a job exchanging its identity token | in | github-actions | example |
| AWS account | people and CI assume roles | in | aws-account | person, CI |
| AWS workloads | a role proves itself | in | aws-workloads | example |
| Registries and artifacts | ECR and CodeArtifact on the profiles | in | registries | |
| Infrastructure as code | a Pulumi or Terraform program as an App | in | iac |
Secrets, hosts and data¶
| Integration | Connects | Direction | How-to | Example |
|---|---|---|---|---|
| OpenBao | certificates for SSH and databases | both | openbao, issuer side | |
| SSH | people and machines | in | ssh | |
| SSH hosts | host certificates from the SSH CA | in | ssh-hosts | |
| PostgreSQL | short-lived client certificates | in | postgresql, server side | |
| R2 credential broker (deprecated) | prefix-scoped object credentials | in | r2-storage | |
| Cloudflare tokens and R2 | short-lived tokens and R2 credentials | both | cloudflare-tokens | R2, token |
Directories, GitHub and Slack¶
| Integration | Connects | Direction | How-to | Example |
|---|---|---|---|---|
| Corporate directory | the people source | out | corporate directory | |
| Google Workspace | users, groups and domains | out | google-workspace | |
| GitHub organisation | teams and runner Apps | out | github-organisation | runner Apps |
| GitHub account links | a person's account | both | github-account-links | |
| GitHub App catalogue | declared Apps and their grants | both | catalogue, tokens, keys | example |
| Slack workspace | channels from the policy | out | slack-workspace | |
| Slack Apps catalogue | declared Slack Apps | out | slack-apps-catalogue | |
| Slack Connect channels | channels between workspaces | out | slack-connect-channels | |
| Slack console channels | channels kept on the console | out | slack-console-channels |