Documentation
¶
Overview ¶
Package static is the reference no-op Credential provider for governance R9.
It maps a CredentialSpec straight to an env-var map — no expiration, no revocation, no external calls. Two uses:
- Default fallback so skills that don't declare a JIT provider still get an explicit CredentialSpec-shaped path (audit visibility, one consistent code path).
- Test fixture — unit tests wire a static provider and inspect the injected env without pulling in AWS SDKs or mock servers.
Not suitable for production least-privilege scoping — for that, use sts_assume_role or a Vault provider.
Index ¶
Constants ¶
const ProviderName = "static"
ProviderName is the string used in CredentialSpec.Provider.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Credential ¶
type Credential struct {
// contains filtered or unexported fields
}
Credential is the materializer returned by Provider.NewCredential.
func (Credential) Kind ¶
func (Credential) Kind() string
Kind returns the provider name for audit-event tagging.
func (*Credential) Materialize ¶
func (c *Credential) Materialize(_ context.Context, _ string, _ json.RawMessage) (credentials.Materialization, error)
Materialize returns the operator-declared env/headers. No external I/O, no error path.
type Provider ¶
type Provider struct{}
Provider implements credentials.Provider.
func (Provider) NewCredential ¶
func (Provider) NewCredential(_ context.Context, cs credentials.CredentialSpec) (credentials.Credential, error)
NewCredential decodes spec.Spec into a Spec and returns a Credential closed over it.
type Spec ¶
type Spec struct {
Env map[string]string `json:"env,omitempty"`
Headers map[string]string `json:"headers,omitempty"`
TTL string `json:"ttl,omitempty"`
}
Spec is the plugin-specific config decoded from CredentialSpec.Spec. A minimal shape — env vars, optional headers, and an operator- declared TTL for audit purposes only (the values themselves never expire).
Source Files