Documentation
¶
Overview ¶
Package outbound presents the proxy's own credentials on connections it dials.
A CredentialProvider supplies per-RPC metadata for every call over a connection. CredentialProviderFor selects one from configuration, and DialOptions installs it, together with interceptors that strip the credential's header from each call's forwarded metadata so a value being relayed cannot collide with the credential.
Headers are canonicalized to lowercase and default to "authorization" with a "Bearer" scheme, matching what gRPC does to metadata keys on the wire.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DialOptions ¶
func DialOptions(cp CredentialProvider) []grpc.DialOption
DialOptions returns the dial options that install cp on an outbound connection: the per-RPC credential itself, plus client interceptors that strip cp's header from each call's forwarded metadata so a forwarded value on the same header cannot collide with the credential.
Types ¶
type CredentialProvider ¶
type CredentialProvider interface {
credentials.PerRPCCredentials
Header() string
}
CredentialProvider supplies per-RPC metadata for outbound calls to an upstream. Header reports the metadata header it sets, so the proxy can strip any forwarded value on that header before the credential adds its own.
func CredentialProviderFor ¶
func CredentialProviderFor(cfg *config.CredentialConfig) (CredentialProvider, error)
CredentialProviderFor maps configuration to the selected CredentialProvider. It returns (nil, nil) only when cfg is nil (no credential configured); a present-but-empty block fails closed with an error rather than silently dialing the upstream without the configured credential.
type StaticCredentialProvider ¶
type StaticCredentialProvider struct {
// contains filtered or unexported fields
}
StaticCredentialProvider attaches a fixed bearer header to every outbound request to an upstream. It implements google.golang.org/grpc/credentials PerRPCCredentials and requires transport security, so gRPC refuses to send the credential over an insecure connection.
func NewStaticCredentialProvider ¶
func NewStaticCredentialProvider(apiKey, header, scheme string) (*StaticCredentialProvider, error)
NewStaticCredentialProvider builds a StaticCredentialProvider. header and scheme default to "authorization" and "Bearer" when blank. A blank apiKey is an error.
func (*StaticCredentialProvider) GetRequestMetadata ¶
func (p *StaticCredentialProvider) GetRequestMetadata(context.Context, ...string) (map[string]string, error)
GetRequestMetadata returns the fixed credential header for every call.
func (*StaticCredentialProvider) Header ¶
func (p *StaticCredentialProvider) Header() string
Header returns the metadata header this credential sets.
func (*StaticCredentialProvider) RequireTransportSecurity ¶
func (p *StaticCredentialProvider) RequireTransportSecurity() bool
RequireTransportSecurity reports that the credential must only travel over a secure transport.
Source Files