Documentation
¶
Overview ¶
Package common provides the common config and provider models for delegated auth
Index ¶
- func CaseInsensitiveStringField(entry map[string]any, field string) (string, bool)
- func CaseInsensitiveStringFieldWithKey(entry map[string]any, field string) (string, string, bool)
- func NormalizeListShapeEntries(raw any) ([]any, bool)
- type AuthConfig
- type CredentialSourceReporter
- type Provider
- type ProviderConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CaseInsensitiveStringField ¶ added in v0.84.0
CaseInsensitiveStringField looks up a string field case-insensitively.
func CaseInsensitiveStringFieldWithKey ¶ added in v0.84.0
CaseInsensitiveStringFieldWithKey looks up a string field case-insensitively and returns its original key casing.
func NormalizeListShapeEntries ¶ added in v0.84.0
NormalizeListShapeEntries normalizes a list-shape additional_endpoints config value into []any, handling JSON strings, []any of map[any]any (YAML-sourced), and []map[string]any (registered defaults). Map-shaped elements are converted to map[string]any; any other element (e.g. a bare string, or nil from a blank YAML list item) is preserved as-is so a round-trip write doesn't silently drop it. Callers matching against api_key fields should type-assert each element and skip non-map entries. Returns ok=false for any other top-level shape.
Types ¶
type AuthConfig ¶
type AuthConfig struct {
OrgUUID string
}
AuthConfig provides cloud provider based authentication configuration.
type CredentialSourceReporter ¶ added in v0.83.0
type CredentialSourceReporter interface {
// LastCredentialSource returns the mechanism selected by the most recent resolution attempt, or
// "" if nothing has been attempted yet. Because the chain is first-match, this names the single
// mechanism the environment selected rather than a list of candidates.
//
// It is deliberately reported for failed attempts too, which is most of its value: "which
// source did it even try" is the first thing to establish when delegated auth works on one
// workload and not another. A non-empty value is therefore NOT evidence that credentials were
// resolved; pair it with the instance's last error to tell the two apart.
LastCredentialSource() string
}
CredentialSourceReporter is optionally implemented by a Provider that can name the credential mechanism it most recently attempted (ex: "DelegatedAuthIMDS"). The status page surfaces it so an operator can tell which credential source is in play without reading logs, which is the first question when delegated auth misbehaves on a host where several are available.
type Provider ¶
type Provider interface {
// GenerateAuthProof generates a cloud-specific authentication proof string.
// This proof will be passed to Datadog's intake-key API to exchange for an API key.
// The context allows for cancellation of the proof generation.
GenerateAuthProof(ctx context.Context, cfg pkgconfigmodel.Reader, config *AuthConfig) (string, error)
}
Provider is an interface for generating cloud-specific authentication proofs. Each provider implements how to generate a proof from their cloud platform (e.g., AWS SigV4 signed request). The proof is then exchanged for a Datadog API key using api.GetAPIKey().
type ProviderConfig ¶
type ProviderConfig interface {
// ProviderName returns the name of the provider (e.g., "aws").
ProviderName() string
}
ProviderConfig is an interface for provider-specific configuration. Each cloud provider implements its own config struct with the fields it needs.
Source Files