Add organization_id to Container Registry JWT token claims

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Why

Follow-up from the organization parity assessment (WI #21, Q6.1) and investigation issue gitlab-org/gitlab#596900.

The Container Registry Go service logs have no organization_id, making per-organization debugging impossible. The Go service extracts metadata from JWT tokens issued by Rails — the Meta struct already carries project_id and root_namespace_id via this mechanism.

The Go-side changes to extract and log organization_id from the JWT are tracked in gitlab-org/container-registry#2185. This issue covers the Rails-side change to include organization_id in the JWT claims.

What

Add organization_id to the JWT token metadata issued by Auth::ContainerRegistryAuthenticationService.

The token payload's meta object currently includes:

{
  "project_path": "group/project",
  "project_id": 123,
  "root_namespace_id": 456
}

After this change:

{
  "project_path": "group/project",
  "project_id": 123,
  "root_namespace_id": 456,
  "organization_id": 1000
}

The value should come from project.organization_id (or equivalent path through the project's namespace).

Notes

  • The Go service MR (gitlab-org/container-registry#2185) can deploy independently before this change — it logs meta_organization_id: 0 until Rails starts sending the field.
  • Cells ADR 017 also plans JWT enrichment with organization_id for Cell routing (Q3 FY27). This change serves both observability and Cells.
  • No coordination or feature flags needed between the Go and Rails deployments. The Go service handles missing fields gracefully via zero-value semantics.

Related

Edited by 🤖 GitLab Bot 🤖