Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrCredentialMissing = errors.New("per-request credential missing")
ErrCredentialMissing is returned when the per-request credential source is configured, the source is absent, and FallbackToConfigured is false. ProcessRequestHeaders converts this to a 401 ImmediateResponse.
var ErrIncompleteAWSCredential = errors.New("incomplete per-request AWS credential: access key ID and secret access key must both be present")
ErrIncompleteAWSCredential means the source carried some but not all of the SigV4 inputs. Failing beats falling back: the filter upstream is misconfigured, and signing with the gateway's own identity would attribute the request to the wrong principal.
Functions ¶
func NewHandler ¶
func NewHandler(ctx context.Context, config *filterapi.BackendAuth) (filterapi.BackendAuthHandler, error)
NewHandler returns a new implementation of filterapi.BackendAuthHandler based on the configuration. When config.CredentialOverride is set, the returned handler sources the upstream credential per-request and falls back to the static credential (or returns 401) as configured.
func WithEnvoyMetadata ¶ added in v1.1.0
WithEnvoyMetadata stores the Envoy dynamic metadata context so the credential override handler can read it without changing the BackendAuthHandler interface. When md is nil (Envoy sent no metadata), ctx is returned unchanged so that envoyMetadataFromContext still returns nil — the handler then follows its fallback path.
Types ¶
This section is empty.
Source Files