Documentation
¶
Overview ¶
Package emulator implements the emulator-bound auth identities (kind: aws/emulator, gcp/emulator, azure/emulator, kubernetes/emulator).
These are root identities not minted by a cloud: the running emulator container is the credential source. They authenticate to nothing (like the ambient identity) and inject their connection profile at environment-preparation time — SDK env vars for the cloud targets, or a harvested kubeconfig (written to a realm-scoped file, exported as KUBECONFIG) for the kubernetes target.
The actual resolution is delegated to an injected types.EmulatorResolver, which lives above the auth layer (it needs stack processing and the container runtime). This keeps pkg/auth free of any emulator/stack-processing import (no cycle).
Index ¶
- type Identity
- func (i *Identity) Authenticate(_ context.Context, _ types.ICredentials) (types.ICredentials, error)
- func (i *Identity) AuthenticateStandalone(ctx context.Context) (types.ICredentials, error)
- func (i *Identity) CredentialsExist() (bool, error)
- func (i *Identity) Environment() (map[string]string, error)
- func (i *Identity) GetProviderName() (string, error)
- func (i *Identity) IsStandalone() bool
- func (i *Identity) Kind() string
- func (i *Identity) LoadCredentials(_ context.Context) (types.ICredentials, error)
- func (i *Identity) Logout(_ context.Context) error
- func (i *Identity) Name() string
- func (i *Identity) Paths() ([]types.Path, error)
- func (i *Identity) PostAuthenticate(ctx context.Context, params *types.PostAuthenticateParams) error
- func (i *Identity) PrepareEnvironment(ctx context.Context, environ map[string]string) (map[string]string, error)
- func (i *Identity) SetConfig(config *schema.Identity)
- func (i *Identity) SetEmulatorResolver(resolver types.EmulatorResolver)
- func (i *Identity) SetName(name string)
- func (i *Identity) SetRealm(realm string)
- func (i *Identity) SetStack(stack string)
- func (i *Identity) Validate() error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Identity ¶
type Identity struct {
// contains filtered or unexported fields
}
Identity implements an emulator-bound auth identity. A single type backs all four emulator kinds; behavior diverges only on the resolved profile shape (env vs kubeconfig).
func (*Identity) Authenticate ¶
func (i *Identity) Authenticate(_ context.Context, _ types.ICredentials) (types.ICredentials, error)
Authenticate is a no-op for emulator identities. Like the ambient identity, they do not mint or cache credentials — the emulator container is the live source, and the profile is resolved fresh at environment-preparation time.
func (*Identity) AuthenticateStandalone ¶
AuthenticateStandalone authenticates a standalone emulator identity. Emulator identities do not mint credentials (the connection profile is injected at environment-preparation time), so this returns nil credentials — mirroring the standalone ambient identity. Part of the types.StandaloneIdentity interface.
func (*Identity) CredentialsExist ¶
CredentialsExist reports true: the emulator is the live credential source.
func (*Identity) Environment ¶
Environment returns no static environment variables. The profile is dynamic (it depends on a running emulator's live host port) and is resolved in PrepareEnvironment, which has the context needed to reach the resolver.
func (*Identity) GetProviderName ¶
GetProviderName returns this identity's own name. Emulator identities are root identities (no upstream provider); the chain is just the identity itself.
func (*Identity) IsStandalone ¶
IsStandalone reports that emulator-bound identities authenticate without an upstream provider step: the running emulator container is the credential source. Part of the types.StandaloneIdentity interface the chain manager dispatches through.
func (*Identity) LoadCredentials ¶
LoadCredentials returns nil: emulator identities have no stored credentials.
func (*Identity) Logout ¶
Logout removes the harvested kubeconfig file (best-effort). No-op for cloud targets.
func (*Identity) Paths ¶
Paths returns no credential paths. The kubernetes kubeconfig path is managed internally (written/removed by PrepareEnvironment/Logout).
func (*Identity) PostAuthenticate ¶
func (i *Identity) PostAuthenticate(ctx context.Context, params *types.PostAuthenticateParams) error
PostAuthenticate populates the in-process auth context for cloud-target emulator identities. Stores, `!store`, store hooks, and the secrets engine build cloud SDK clients inside the atmos process and read credentials from the auth context (not the subprocess env that PrepareEnvironment sets for Terraform). Kubernetes is consumed via KUBECONFIG, so it needs nothing here.
func (*Identity) PrepareEnvironment ¶
func (i *Identity) PrepareEnvironment(ctx context.Context, environ map[string]string) (map[string]string, error)
PrepareEnvironment resolves the bound emulator's connection profile and merges it into the environment: SDK env vars for cloud targets, or a harvested kubeconfig (written to a realm-scoped file and exported as KUBECONFIG) for the kubernetes target.
func (*Identity) SetConfig ¶
SetConfig sets the identity configuration (invoked by the factory after construction).
func (*Identity) SetEmulatorResolver ¶
func (i *Identity) SetEmulatorResolver(resolver types.EmulatorResolver)
SetEmulatorResolver injects the process-wide emulator resolver. Part of the emulatorResolverReceiver interface the auth manager duck-types against.
Source Files