openai / openai/openai-agents-python
Add native OIDC authentication support to Modal cloud bucket mounts
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 29.6k
- Forks
- 4.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 123
Description
Add OIDC support for Modal cloud bucket mounts
Modal supports CloudBucketMount(oidc_auth_role_arn=...), but the Agents SDK ModalCloudBucketMountStrategy only supports static credentials or a named Modal Secret.
Some deployments cannot create long-lived AWS keys and instead require Modal to assume an IAM role through OIDC.
Could the adapter support:
ModalCloudBucketMountStrategy(
oidc_auth_role_arn="arn:aws:iam::123456789012:role/modal-s3-reader",
)
The role ARN should pass through ModalCloudBucketMountConfig into:
modal.CloudBucketMount(
...,
oidc_auth_role_arn=config.oidc_auth_role_arn,
)
OIDC should be mutually exclusive with secret_name and inline credentials. Existing Secret-backed behavior should remain unchanged.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ModalCloudBucketMountStrategy and ModalCloudBucketMountConfig, then trace how their existing secret_name and inline-credential options reach modal.CloudBucketMount. Add the OIDC role ARN path while preserving Secret-backed behavior and enforcing mutual exclusion with the other credential modes; verify the relevant existing adapter tests and add coverage for the new combinations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100