oci-common 2.70.1 → 2.70.3

package/index.d.ts

@@ -22,6 +22,7 @@ import { RequireOnlyOne, AuthParams } from "./lib/types";
 import { HttpRequest } from "./lib/http-request";
 import InstancePrincipalsAuthenticationDetailsProviderBuilder from "./lib/auth/instance-principals-authentication-detail-provider";
 import ResourcePrincipalAuthenticationDetailsProvider from "./lib/auth/resource-principal-authentication-details-provider";
+import OkeWorkloadIdentityAuthenticationDetailsProvider from "./lib/auth/oke-workload-identity-authentication-details-provider";
 import { BaseRequest } from "./lib/base-request";
 import { ClientConfiguration } from "./lib/client-configuration";
 import { paginateRecords, genericPaginateRecords, paginatedRecordsWithLimit, paginateResponses, genericPaginateResponses, paginatedResponsesWithLimit } from "./lib/paginators";
@@ -48,4 +49,4 @@ export import convertStringToType = helper.convertStringToType;
 export import ObjectSerializer = serializer.ObjectSerializer;
 export import byteLength = helper.byteLength;
 export import Range = range.Range;
-export { Region, Realm, EndpointBuilder, DelayStrategy, TerminationStrategy, ExponentialBackoffDelayStrategy, MaxTimeTerminationStrategy, genericWaiter, genericTerminalConditionWaiter, WaiterConfiguration, RequireOnlyOne, AuthParams, paginateRecords, paginatedResponsesWithLimit, paginatedRecordsWithLimit, genericPaginateRecords, paginateResponses, genericPaginateResponses, Method, composeRequest, Params, composeResponse, HttpRequest, ConfigFileAuthenticationDetailsProvider, SessionAuthDetailProvider, ConfigFileReader, InstancePrincipalsAuthenticationDetailsProviderBuilder, ResourcePrincipalAuthenticationDetailsProvider, LOG, GenericRetrier, FixedTimeDelayStrategy, MaxAttemptsTerminationStrategy, RetryConfiguration, NoRetryConfigurationDetails, OciSdkDefaultRetryConfiguration, BaseRequest, ClientConfiguration, Constants, CircuitBreaker, getChunk, utils };
+export { Region, Realm, EndpointBuilder, DelayStrategy, TerminationStrategy, ExponentialBackoffDelayStrategy, MaxTimeTerminationStrategy, genericWaiter, genericTerminalConditionWaiter, WaiterConfiguration, RequireOnlyOne, AuthParams, paginateRecords, paginatedResponsesWithLimit, paginatedRecordsWithLimit, genericPaginateRecords, paginateResponses, genericPaginateResponses, Method, composeRequest, Params, composeResponse, HttpRequest, ConfigFileAuthenticationDetailsProvider, SessionAuthDetailProvider, ConfigFileReader, InstancePrincipalsAuthenticationDetailsProviderBuilder, ResourcePrincipalAuthenticationDetailsProvider, LOG, GenericRetrier, FixedTimeDelayStrategy, MaxAttemptsTerminationStrategy, RetryConfiguration, NoRetryConfigurationDetails, OciSdkDefaultRetryConfiguration, BaseRequest, ClientConfiguration, Constants, CircuitBreaker, getChunk, utils, OkeWorkloadIdentityAuthenticationDetailsProvider };

package/index.js

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.utils = exports.getChunk = exports.CircuitBreaker = exports.Constants = exports.OciSdkDefaultRetryConfiguration = exports.NoRetryConfigurationDetails = exports.MaxAttemptsTerminationStrategy = exports.FixedTimeDelayStrategy = exports.GenericRetrier = exports.LOG = exports.ResourcePrincipalAuthenticationDetailsProvider = exports.InstancePrincipalsAuthenticationDetailsProviderBuilder = exports.ConfigFileReader = exports.SessionAuthDetailProvider = exports.ConfigFileAuthenticationDetailsProvider = exports.composeResponse = exports.composeRequest = exports.genericPaginateResponses = exports.paginateResponses = exports.genericPaginateRecords = exports.paginatedRecordsWithLimit = exports.paginatedResponsesWithLimit = exports.paginateRecords = exports.genericTerminalConditionWaiter = exports.genericWaiter = exports.MaxTimeTerminationStrategy = exports.ExponentialBackoffDelayStrategy = exports.EndpointBuilder = exports.Realm = exports.Region = exports.Range = exports.byteLength = exports.ObjectSerializer = exports.convertStringToType = exports.handleErrorBody = exports.mapContainer = exports.handleErrorResponse = exports.getStringFromResponseBody = exports.DefaultRequestSigner = exports.OciError = exports.FetchHttpClient = exports.isRegionProvider = exports.SimpleAuthenticationDetailsProvider = void 0;
+exports.OkeWorkloadIdentityAuthenticationDetailsProvider = exports.utils = exports.getChunk = exports.CircuitBreaker = exports.Constants = exports.OciSdkDefaultRetryConfiguration = exports.NoRetryConfigurationDetails = exports.MaxAttemptsTerminationStrategy = exports.FixedTimeDelayStrategy = exports.GenericRetrier = exports.LOG = exports.ResourcePrincipalAuthenticationDetailsProvider = exports.InstancePrincipalsAuthenticationDetailsProviderBuilder = exports.ConfigFileReader = exports.SessionAuthDetailProvider = exports.ConfigFileAuthenticationDetailsProvider = exports.composeResponse = exports.composeRequest = exports.genericPaginateResponses = exports.paginateResponses = exports.genericPaginateRecords = exports.paginatedRecordsWithLimit = exports.paginatedResponsesWithLimit = exports.paginateRecords = exports.genericTerminalConditionWaiter = exports.genericWaiter = exports.MaxTimeTerminationStrategy = exports.ExponentialBackoffDelayStrategy = exports.EndpointBuilder = exports.Realm = exports.Region = exports.Range = exports.byteLength = exports.ObjectSerializer = exports.convertStringToType = exports.handleErrorBody = exports.mapContainer = exports.handleErrorResponse = exports.getStringFromResponseBody = exports.DefaultRequestSigner = exports.OciError = exports.FetchHttpClient = exports.isRegionProvider = exports.SimpleAuthenticationDetailsProvider = void 0;
 const auth = __importStar(require("./lib/auth/auth"));
 const error = __importStar(require("./lib/error"));
 const signer = __importStar(require("./lib/signer"));
@@ -63,6 +63,8 @@ const instance_principals_authentication_detail_provider_1 = __importDefault(req
 exports.InstancePrincipalsAuthenticationDetailsProviderBuilder = instance_principals_authentication_detail_provider_1.default;
 const resource_principal_authentication_details_provider_1 = __importDefault(require("./lib/auth/resource-principal-authentication-details-provider"));
 exports.ResourcePrincipalAuthenticationDetailsProvider = resource_principal_authentication_details_provider_1.default;
+const oke_workload_identity_authentication_details_provider_1 = __importDefault(require("./lib/auth/oke-workload-identity-authentication-details-provider"));
+exports.OkeWorkloadIdentityAuthenticationDetailsProvider = oke_workload_identity_authentication_details_provider_1.default;
 const paginators_1 = require("./lib/paginators");
 Object.defineProperty(exports, "paginateRecords", { enumerable: true, get: function () { return paginators_1.paginateRecords; } });
 Object.defineProperty(exports, "genericPaginateRecords", { enumerable: true, get: function () { return paginators_1.genericPaginateRecords; } });

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,sDAAwC;AACxC,mDAAqC;AACrC,qDAAuC;AACvC,qDAAuC;AACvC,iDAAmC;AACnC,oEAAsD;AACtD,mDAAqC;AACrC,mDAAqC;AA6GnC,sBAAK;AA5GP,yCAAsC;AAoEpC,uFApEO,eAAM,OAoEP;AAnER,uCAAoC;AAoElC,sFApEO,aAAK,OAoEP;AAnEP,6DAAyD;AAoEvD,gGApEO,kCAAe,OAoEP;AAnEjB,mCAAgC;AA6F9B,oFA7FO,SAAG,OA6FP;AA5FL,gEAAwC;AAqGtC,oBArGK,mBAAS,CAqGL;AApGX,4EAAmD;AAqGjD,yBArGK,yBAAc,CAqGL;AAnGhB,yCAUsB;AAwDpB,gHA/DA,wCAA+B,OA+DA;AAC/B,2GA/DA,mCAA0B,OA+DA;AAC1B,8FA/DA,sBAAa,OA+DA;AACb,+GA/DA,uCAA8B,OA+DA;AAuB9B,+GApFA,uCAA8B,OAoFA;AAD9B,uGAlFA,+BAAsB,OAkFA;AAhFxB,2CAKuB;AA0ErB,+FA9EA,wBAAc,OA8EA;AAId,4GAhFA,qCAA2B,OAgFA;AAC3B,gHAhFA,yCAA+B,OAgFA;AA5EjC,uJAAmI;AAoEjI,iEApEK,4DAAsD,CAoEL;AAnExD,uJAA2H;AAoEzH,yDApEK,4DAA8C,CAoEL;AAjEhD,iDAO0B;AA2CxB,gGAjDA,4BAAe,OAiDA;AAGf,uGAnDA,mCAAsB,OAmDA;AADtB,0GAjDA,sCAAyB,OAiDA;AAEzB,kGAlDA,8BAAiB,OAkDA;AACjB,yGAlDA,qCAAwB,OAkDA;AAJxB,4GA7CA,wCAA2B,OA6CA;AA1C7B,kEAAsF;AAoDpF,wHApDO,0DAAuC,OAoDP;AAnDzC,4FAAqF;AAoDnF,0GApDO,yDAAyB,OAoDP;AAnD3B,4DAAqC;AAkEnC,mBAlEK,iBAAQ,CAkEL;AAjEV,iEAA4D;AAmD1D,iGAnDO,qCAAgB,OAmDP;AAlDlB,+DAAyE;AA4CvE,+FA5Ce,kCAAc,OA4Cf;AA3ChB,iEAA2D;AA6CzD,gGA7CO,oCAAe,OA6CP;AA3CH,QAAA,mCAAmC,GAAG,IAAI,CAAC,mCAAmC,CAAC;AAE/E,QAAA,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;AAGzC,QAAA,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;AAEvC,QAAA,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;AAG1B,QAAA,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAEnD,QAAA,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC7D,QAAA,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AACjD,QAAA,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;AACnC,QAAA,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;AACzC,QAAA,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AACjD,QAAA,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;AAC/C,QAAA,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AAE/B,QAAA,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,sDAAwC;AACxC,mDAAqC;AACrC,qDAAuC;AACvC,qDAAuC;AACvC,iDAAmC;AACnC,oEAAsD;AACtD,mDAAqC;AACrC,mDAAqC;AA8GnC,sBAAK;AA7GP,yCAAsC;AAqEpC,uFArEO,eAAM,OAqEP;AApER,uCAAoC;AAqElC,sFArEO,aAAK,OAqEP;AApEP,6DAAyD;AAqEvD,gGArEO,kCAAe,OAqEP;AApEjB,mCAAgC;AA8F9B,oFA9FO,SAAG,OA8FP;AA7FL,gEAAwC;AAsGtC,oBAtGK,mBAAS,CAsGL;AArGX,4EAAmD;AAsGjD,yBAtGK,yBAAc,CAsGL;AApGhB,yCAUsB;AAyDpB,gHAhEA,wCAA+B,OAgEA;AAC/B,2GAhEA,mCAA0B,OAgEA;AAC1B,8FAhEA,sBAAa,OAgEA;AACb,+GAhEA,uCAA8B,OAgEA;AAuB9B,+GArFA,uCAA8B,OAqFA;AAD9B,uGAnFA,+BAAsB,OAmFA;AAjFxB,2CAKuB;AA2ErB,+FA/EA,wBAAc,OA+EA;AAId,4GAjFA,qCAA2B,OAiFA;AAC3B,gHAjFA,yCAA+B,OAiFA;AA7EjC,uJAAmI;AAqEjI,iEArEK,4DAAsD,CAqEL;AApExD,uJAA2H;AAqEzH,yDArEK,4DAA8C,CAqEL;AApEhD,6JAAgI;AAkF9H,2DAlFK,+DAAgD,CAkFL;AA/ElD,iDAO0B;AA2CxB,gGAjDA,4BAAe,OAiDA;AAGf,uGAnDA,mCAAsB,OAmDA;AADtB,0GAjDA,sCAAyB,OAiDA;AAEzB,kGAlDA,8BAAiB,OAkDA;AACjB,yGAlDA,qCAAwB,OAkDA;AAJxB,4GA7CA,wCAA2B,OA6CA;AA1C7B,kEAAsF;AAoDpF,wHApDO,0DAAuC,OAoDP;AAnDzC,4FAAqF;AAoDnF,0GApDO,yDAAyB,OAoDP;AAnD3B,4DAAqC;AAkEnC,mBAlEK,iBAAQ,CAkEL;AAjEV,iEAA4D;AAmD1D,iGAnDO,qCAAgB,OAmDP;AAlDlB,+DAAyE;AA4CvE,+FA5Ce,kCAAc,OA4Cf;AA3ChB,iEAA2D;AA6CzD,gGA7CO,oCAAe,OA6CP;AA3CH,QAAA,mCAAmC,GAAG,IAAI,CAAC,mCAAmC,CAAC;AAE/E,QAAA,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;AAGzC,QAAA,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;AAEvC,QAAA,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;AAG1B,QAAA,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAEnD,QAAA,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC7D,QAAA,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AACjD,QAAA,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;AACnC,QAAA,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;AACzC,QAAA,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AACjD,QAAA,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;AAC/C,QAAA,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AAE/B,QAAA,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC"}

package/lib/auth/X509-federation-client-for-oke-workload-identity.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+import FederationClient from "./models/federation-client";
+import SessionKeySupplier from "./models/session-key-supplier";
+import SecurityTokenAdapter from "./security-token-adapter";
+export default class X509FederationClientForOkeWorkloadIdentity implements FederationClient {
+    private proxymuxEndpoint;
+    private kubernetesServiceAccountToken;
+    private kubernetesServiceAccountCert;
+    private sessionKeySupplier;
+    securityTokenAdapter: SecurityTokenAdapter;
+    private retry;
+    constructor(proxymuxEndpoint: string, kubernetesServiceAccountToken: string, kubernetesServiceAccountCert: string, sessionKeySupplier: SessionKeySupplier);
+    /**
+     * Gets a security token. If there is already a valid token cached, it will be returned. Else this will make a call
+     * to the OKE Proxymux service to get a new token, using the provided suppliers.
+     *
+     * This method is thread-safe.
+     * @return the security token
+     * @throws OciError If there is any issue with getting a token from the OKE Proxymux server
+     */
+    getSecurityToken(): Promise<string>;
+    /**
+     * Return a claim embedded in the security token
+     * @param key the name of the claim
+     * @return the value of the claim or null if unable to find
+     */
+    getStringClaim(key: string): Promise<string | null>;
+    refreshAndGetSecurityToken(): Promise<string>;
+    private refreshAndGetSecurityTokenInner;
+    /**
+     * Gets a security token from the OKE Proxymux service
+     * @return the security token, which is basically a JWT token string
+     */
+    private getSecurityTokenFromServer;
+}

package/lib/auth/X509-federation-client-for-oke-workload-identity.js

@@ -0,0 +1,175 @@
+"use strict";
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const tls_1 = require("tls");
+const https_1 = require("https");
+const security_token_adapter_1 = __importDefault(require("./security-token-adapter"));
+const auth_utils_1 = __importDefault(require("./helpers/auth-utils"));
+const http_1 = require("../http");
+/**
+ * This class gets a security token from the OKE Proxymux service by authenticating the request with the kubernetes service account,
+ * passing along a temporary public key that is bounded to the service account.
+ */
+const OKE_WORKLOAD_IDENTITY_GENERIC_ERROR = "Failed to get a RPST token from Proxymux. See https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contenggrantingworkloadaccesstoresources.htm for more info.";
+class X509FederationClientForOkeWorkloadIdentity {
+    constructor(proxymuxEndpoint, kubernetesServiceAccountToken, kubernetesServiceAccountCert, sessionKeySupplier) {
+        this.proxymuxEndpoint = proxymuxEndpoint;
+        this.kubernetesServiceAccountToken = kubernetesServiceAccountToken;
+        this.kubernetesServiceAccountCert = kubernetesServiceAccountCert;
+        this.sessionKeySupplier = sessionKeySupplier;
+        this.retry = 0;
+        this.securityTokenAdapter = new security_token_adapter_1.default("", this.sessionKeySupplier);
+    }
+    /**
+     * Gets a security token. If there is already a valid token cached, it will be returned. Else this will make a call
+     * to the OKE Proxymux service to get a new token, using the provided suppliers.
+     *
+     * This method is thread-safe.
+     * @return the security token
+     * @throws OciError If there is any issue with getting a token from the OKE Proxymux server
+     */
+    getSecurityToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.securityTokenAdapter.isValid()) {
+                return this.securityTokenAdapter.getSecurityToken();
+            }
+            return yield this.refreshAndGetSecurityTokenInner(true);
+        });
+    }
+    /**
+     * Return a claim embedded in the security token
+     * @param key the name of the claim
+     * @return the value of the claim or null if unable to find
+     */
+    getStringClaim(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.refreshAndGetSecurityTokenInner(true);
+            return this.securityTokenAdapter.getStringClaim(key);
+        });
+    }
+    refreshAndGetSecurityToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.refreshAndGetSecurityTokenInner(false);
+        });
+    }
+    refreshAndGetSecurityTokenInner(doFinalTokenValidityCheck) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Check again to see if the JWT is still invalid, unless we want to skip that check
+            if (!doFinalTokenValidityCheck || !this.securityTokenAdapter.isValid()) {
+                this.sessionKeySupplier.refreshKeys();
+                this.securityTokenAdapter = yield this.getSecurityTokenFromServer();
+                return this.securityTokenAdapter.getSecurityToken();
+            }
+            return this.securityTokenAdapter.getSecurityToken();
+        });
+    }
+    /**
+     * Gets a security token from the OKE Proxymux service
+     * @return the security token, which is basically a JWT token string
+     */
+    getSecurityTokenFromServer() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keyPair = this.sessionKeySupplier.getKeyPair();
+            if (!keyPair) {
+                throw Error("keyPair for session was not provided");
+            }
+            const publicKey = keyPair.getPublic();
+            if (!publicKey) {
+                throw Error("Public key is not present");
+            }
+            try {
+                // Create request body and call auth service.
+                const url = this.proxymuxEndpoint;
+                const requestPayload = {
+                    podKey: auth_utils_1.default.sanitizeCertificateString(publicKey)
+                };
+                let jsonPayload = JSON.stringify(requestPayload);
+                jsonPayload = jsonPayload.replace(/\\n/g, "");
+                const requestObj = {
+                    uri: url,
+                    body: jsonPayload,
+                    method: "POST",
+                    headers: new Headers({
+                        "Authorization": `Bearer ${this.kubernetesServiceAccountToken}`,
+                        "Content-Type": "application/json"
+                    })
+                };
+                const httpOptions = {};
+                httpOptions.agent = new https_1.Agent({
+                    ca: [...tls_1.rootCertificates, this.kubernetesServiceAccountCert]
+                });
+                const httpClient = new http_1.FetchHttpClient(null, null, httpOptions);
+                // Call OKE Proxymux Service to get a base64 encoded JSON object which contains the auth token
+                const response = yield httpClient.send(requestObj);
+                //TODO: Implement retry here
+                // retry here
+                if (response.status !== 200) {
+                    if (this.retry < 3) {
+                        this.retry += 1;
+                        return yield this.getSecurityTokenFromServer();
+                    }
+                    else {
+                        throw Error(`Failed to call Proxymux for RPST token. Status: ${response.status}. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                    }
+                }
+                this.retry = 0;
+                // The response is a base64 blob of a json object, we need to decode and parse it
+                let responseBody;
+                try {
+                    responseBody = yield response.text();
+                }
+                catch (e) {
+                    throw Error(`Failed to read response body from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                let decodedBodyStr;
+                try {
+                    decodedBodyStr = Buffer.from(responseBody, "base64").toString("utf8");
+                }
+                catch (e) {
+                    throw Error(`Invalid JSON response received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                let parsedBody;
+                try {
+                    parsedBody = JSON.parse(decodedBodyStr);
+                }
+                catch (e) {
+                    throw Error(`Invalid JSON response received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                if (!parsedBody) {
+                    throw Error(`Invalid (undefined) RPST token received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                if (typeof parsedBody.token !== "string") {
+                    throw Error(`Invalid (string) RPST token received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                const token = parsedBody.token;
+                if (!token || token.length === 0) {
+                    throw Error(`Invalid (empty) RPST token received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                if (token.length < 3) {
+                    throw Error(`Invalid RPST token received from Proxymux. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+                }
+                return new security_token_adapter_1.default(token.slice(3), this.sessionKeySupplier);
+            }
+            catch (e) {
+                throw Error(`Failed to call Proxymux, error: ${e}. ${OKE_WORKLOAD_IDENTITY_GENERIC_ERROR}`);
+            }
+        });
+    }
+}
+exports.default = X509FederationClientForOkeWorkloadIdentity;
+//# sourceMappingURL=X509-federation-client-for-oke-workload-identity.js.map

package/lib/auth/X509-federation-client-for-oke-workload-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509-federation-client-for-oke-workload-identity.js","sourceRoot":"","sources":["../../../../../lib/auth/X509-federation-client-for-oke-workload-identity.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;AAEH,6BAAuC;AACvC,iCAA4C;AAG5C,sFAA4D;AAC5D,sEAA6C;AAE7C,kCAA0C;AAE1C;;;GAGG;AAEH,MAAM,mCAAmC,GACvC,oKAAoK,CAAC;AAEvK,MAAqB,0CAA0C;IAI7D,YACU,gBAAwB,EACxB,6BAAqC,EACrC,4BAAoC,EACpC,kBAAsC;QAHtC,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,kCAA6B,GAA7B,6BAA6B,CAAQ;QACrC,iCAA4B,GAA5B,4BAA4B,CAAQ;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QANxC,UAAK,GAAG,CAAC,CAAC;QAQhB,IAAI,CAAC,oBAAoB,GAAG,IAAI,gCAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACG,gBAAgB;;YACpB,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE;gBACvC,OAAO,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;aACrD;YACD,OAAO,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,GAAW;;YAC9B,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;KAAA;IAEK,0BAA0B;;YAC9B,OAAO,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;KAAA;IAEa,+BAA+B,CAC3C,yBAAkC;;YAElC,oFAAoF;YACpF,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE;gBACtE,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC;gBAEtC,IAAI,CAAC,oBAAoB,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBAEpE,OAAO,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;aACrD;YACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;QACtD,CAAC;KAAA;IAED;;;OAGG;IACW,0BAA0B;;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,EAAE;gBACZ,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;aACrD;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,EAAE;gBACd,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;aAC1C;YAED,IAAI;gBACF,6CAA6C;gBAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBAClC,MAAM,cAAc,GAAG;oBACrB,MAAM,EAAE,oBAAS,CAAC,yBAAyB,CAAC,SAAS,CAAC;iBACvD,CAAC;gBAEF,IAAI,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;gBACjD,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAE9C,MAAM,UAAU,GAAgB;oBAC9B,GAAG,EAAE,GAAG;oBACR,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,IAAI,OAAO,CAAC;wBACnB,eAAe,EAAE,UAAU,IAAI,CAAC,6BAA6B,EAAE;wBAC/D,cAAc,EAAE,kBAAkB;qBACnC,CAAC;iBACH,CAAC;gBAEF,MAAM,WAAW,GAAuC,EAAE,CAAC;gBAC3D,WAAW,CAAC,KAAK,GAAG,IAAI,aAAU,CAAC;oBACjC,EAAE,EAAE,CAAC,GAAG,sBAAgB,EAAE,IAAI,CAAC,4BAA4B,CAAC;iBAC7D,CAAC,CAAC;gBAEH,MAAM,UAAU,GAAG,IAAI,sBAAe,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAEhE,8FAA8F;gBAC9F,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACnD,4BAA4B;gBAC5B,aAAa;gBACb,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;oBAC3B,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE;wBAClB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;wBAChB,OAAO,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;qBAChD;yBAAM;wBACL,MAAM,KAAK,CACT,mDAAmD,QAAQ,CAAC,MAAM,KAAK,mCAAmC,EAAE,CAC7G,CAAC;qBACH;iBACF;gBACD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;gBAEf,iFAAiF;gBACjF,IAAI,YAAY,CAAC;gBACjB,IAAI;oBACF,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;iBACtC;gBAAC,OAAO,CAAC,EAAE;oBACV,MAAM,KAAK,CACT,+CAA+C,mCAAmC,EAAE,CACrF,CAAC;iBACH;gBAED,IAAI,cAAc,CAAC;gBACnB,IAAI;oBACF,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACvE;gBAAC,OAAO,CAAC,EAAE;oBACV,MAAM,KAAK,CACT,iDAAiD,mCAAmC,EAAE,CACvF,CAAC;iBACH;gBAED,IAAI,UAAU,CAAC;gBACf,IAAI;oBACF,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;iBACzC;gBAAC,OAAO,CAAC,EAAE;oBACV,MAAM,KAAK,CACT,iDAAiD,mCAAmC,EAAE,CACvF,CAAC;iBACH;gBACD,IAAI,CAAC,UAAU,EAAE;oBACf,MAAM,KAAK,CACT,0DAA0D,mCAAmC,EAAE,CAChG,CAAC;iBACH;gBACD,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE;oBACxC,MAAM,KAAK,CACT,uDAAuD,mCAAmC,EAAE,CAC7F,CAAC;iBACH;gBAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;gBAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;oBAChC,MAAM,KAAK,CACT,sDAAsD,mCAAmC,EAAE,CAC5F,CAAC;iBACH;gBACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;oBACpB,MAAM,KAAK,CACT,8CAA8C,mCAAmC,EAAE,CACpF,CAAC;iBACH;gBAED,OAAO,IAAI,gCAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;aAC1E;YAAC,OAAO,CAAC,EAAE;gBACV,MAAM,KAAK,CAAC,mCAAmC,CAAC,KAAK,mCAAmC,EAAE,CAAC,CAAC;aAC7F;QACH,CAAC;KAAA;CACF;AAxKD,6DAwKC"}

package/lib/auth/helpers/load-from-file.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+export declare function loadFromFile(filePath: string): string;

package/lib/auth/helpers/load-from-file.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadFromFile = void 0;
+const fs_1 = require("fs");
+function loadFromFile(filePath) {
+    try {
+        const fileContent = fs_1.readFileSync(filePath, "utf8");
+        return fileContent;
+    }
+    catch (e) {
+        throw Error(`Failed to read file contents, error: ${e}`);
+    }
+}
+exports.loadFromFile = loadFromFile;
+//# sourceMappingURL=load-from-file.js.map

package/lib/auth/helpers/load-from-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-from-file.js","sourceRoot":"","sources":["../../../../../../lib/auth/helpers/load-from-file.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,2BAAkC;AAElC,SAAgB,YAAY,CAAC,QAAgB;IAC3C,IAAI;QACF,MAAM,WAAW,GAAG,iBAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEnD,OAAO,WAAW,CAAC;KACpB;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;KAC1D;AACH,CAAC;AARD,oCAQC"}

package/lib/auth/oke-workload-identity-authentication-details-provider.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+import FederationClient from "./models/federation-client";
+import RefreshableOnNotAuthenticatedProvider from "./models/refreshable-on-not-authenticaticated-provider";
+import AbstractRequestingAuthenticationDetailsProvider from "./abstract-requesting-authentication-detail-provider";
+import SessionKeySupplier from "./models/session-key-supplier";
+export default class OkeWorkloadIdentityAuthenticationDetailsProvider extends AbstractRequestingAuthenticationDetailsProvider implements RefreshableOnNotAuthenticatedProvider<String> {
+    protected federationClient: FederationClient;
+    protected sessionKeySupplier: SessionKeySupplier;
+    static KUBERNETES_SERVICE_HOST_ENV_VAR_NAME: string;
+    static KUBERNETES_SERVICE_PORT_PROXYMUX_ENV_VAR_NAME: string;
+    static DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH: string;
+    static DEFAULT_DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH: string;
+    protected _sessionKeySupplier: SessionKeySupplier;
+    protected _federationClient: FederationClient;
+    constructor(federationClient: FederationClient, sessionKeySupplier: SessionKeySupplier);
+    static ClaimKeys: {
+        new (): {};
+        /**
+         * COMPARTMENT_ID is the claim name that the RPST holds for the resource compartment.
+         * This can be passed to {@link #getStringClaim} to retrieve the resource's compartment OCID.
+         */
+        COMPARTMENT_ID_CLAIM_KEY: string;
+        /**
+         * TENANT_ID_CLAIM_KEY is the claim name that the RPST holds for the resource tenancy.
+         * This can be passed to {@link #getStringClaim} to retrieve the resource's tenancy OCID.
+         */
+        TENANT_ID_CLAIM_KEY: string;
+    };
+    static builder(customKubernetesServiceAccountCertPath: string, customKubernetesServiceAccountTokenPath: string): OkeWorkloadIdentityAuthenticationDetailsProvider;
+    /**
+     * Session tokens carry JWT-like claims. Permit the retrieval of the value of those
+     * claims from the token.
+     * At the least, the token should carry claims for {@link ClaimKeys#COMPARTMENT_ID_CLAIM_KEY} and {@link ClaimKeys#TENANT_ID_CLAIM_KEY}
+     * @param key the name of a claim in the session token
+     * @return the claim value.
+     */
+    getStringClaim(key: string): Promise<string | null>;
+    /**
+     * Refreshes the authentication data used by the provider
+     * @return the refreshed authentication data
+     */
+    refresh(): Promise<string>;
+    /**
+     * Builder for OkeWorkloadIdentityAuthenticationDetailsProvider
+     */
+    static OkeWorkloadIdentityAuthenticationDetailsProviderBuilder: {
+        new (customKubernetesServiceAccountCertPath?: string | undefined, customKubernetesServiceAccountTokenPath?: string | undefined): {
+            kubernetesServiceAccountCertPath: string;
+            kubernetesServiceAccountTokenPath: string;
+            build(): OkeWorkloadIdentityAuthenticationDetailsProvider;
+        };
+    };
+}

package/lib/auth/oke-workload-identity-authentication-details-provider.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * Copyright (c) 2020, 2021 Oracle and/or its affiliates.  All rights reserved.
+ * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * This constructs a default implementation of the {@link OkeWorkloadIdentityAuthenticationDetailsProvider}, constructed
+ * in accordance with the following environment variable settings:
+ * <ul>
+ *
+ * <li>{@code KUBERNETES_SERVICE_HOST}:
+ * <p>This environment variable represents the Kubernetes service host.</p>
+ * </li>
+ *
+ * <li>{@code KUBERNETES_SERVICE_PORT_PROXYMUX}:
+ * <p>This environment variable represents the Kubernetes service port for proxymux.</p>
+ * </li>
+ *
+ * </ul>
+ */
+const load_from_file_1 = require("./helpers/load-from-file");
+const abstract_requesting_authentication_detail_provider_1 = __importDefault(require("./abstract-requesting-authentication-detail-provider"));
+const X509_federation_client_for_oke_workload_identity_1 = __importDefault(require("./X509-federation-client-for-oke-workload-identity"));
+const session_key_supplier_1 = __importDefault(require("./session-key-supplier"));
+const OKE_WORKLOAD_IDENTITY_DEBUG_INFORMATION_LOG = "OKE workload identity can only be used in Enhanced OKE clusters. See https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contenggrantingworkloadaccesstoresources.htm for more info.";
+class OkeWorkloadIdentityAuthenticationDetailsProvider extends abstract_requesting_authentication_detail_provider_1.default {
+    constructor(federationClient, sessionKeySupplier) {
+        super(federationClient, sessionKeySupplier);
+        this.federationClient = federationClient;
+        this.sessionKeySupplier = sessionKeySupplier;
+    }
+    // Builder method to create OkeWorkloadIdentityAuthenticationDetailsProviderBuilder which will build
+    // OkeWorkloadIdentityAuthenticationDetailsProvider
+    static builder(customKubernetesServiceAccountCertPath, customKubernetesServiceAccountTokenPath) {
+        return new OkeWorkloadIdentityAuthenticationDetailsProvider.OkeWorkloadIdentityAuthenticationDetailsProviderBuilder(customKubernetesServiceAccountCertPath, customKubernetesServiceAccountTokenPath).build();
+    }
+    /**
+     * Session tokens carry JWT-like claims. Permit the retrieval of the value of those
+     * claims from the token.
+     * At the least, the token should carry claims for {@link ClaimKeys#COMPARTMENT_ID_CLAIM_KEY} and {@link ClaimKeys#TENANT_ID_CLAIM_KEY}
+     * @param key the name of a claim in the session token
+     * @return the claim value.
+     */
+    getStringClaim(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.federationClient.getStringClaim(key);
+        });
+    }
+    /**
+     * Refreshes the authentication data used by the provider
+     * @return the refreshed authentication data
+     */
+    refresh() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.federationClient.refreshAndGetSecurityToken();
+        });
+    }
+}
+exports.default = OkeWorkloadIdentityAuthenticationDetailsProvider;
+OkeWorkloadIdentityAuthenticationDetailsProvider.KUBERNETES_SERVICE_HOST_ENV_VAR_NAME = "KUBERNETES_SERVICE_HOST";
+OkeWorkloadIdentityAuthenticationDetailsProvider.KUBERNETES_SERVICE_PORT_PROXYMUX_ENV_VAR_NAME = "KUBERNETES_SERVICE_PORT_PROXYMUX";
+OkeWorkloadIdentityAuthenticationDetailsProvider.DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt";
+OkeWorkloadIdentityAuthenticationDetailsProvider.DEFAULT_DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
+OkeWorkloadIdentityAuthenticationDetailsProvider.ClaimKeys = (_a = class ClaimsKey {
+    },
+    /**
+     * COMPARTMENT_ID is the claim name that the RPST holds for the resource compartment.
+     * This can be passed to {@link #getStringClaim} to retrieve the resource's compartment OCID.
+     */
+    _a.COMPARTMENT_ID_CLAIM_KEY = "res_compartment",
+    /**
+     * TENANT_ID_CLAIM_KEY is the claim name that the RPST holds for the resource tenancy.
+     * This can be passed to {@link #getStringClaim} to retrieve the resource's tenancy OCID.
+     */
+    _a.TENANT_ID_CLAIM_KEY = "res_tenant",
+    _a);
+/**
+ * Builder for OkeWorkloadIdentityAuthenticationDetailsProvider
+ */
+OkeWorkloadIdentityAuthenticationDetailsProvider.OkeWorkloadIdentityAuthenticationDetailsProviderBuilder = class OkeWorkloadIdentityAuthenticationDetailsProviderBuilder {
+    constructor(customKubernetesServiceAccountCertPath, customKubernetesServiceAccountTokenPath) {
+        this.kubernetesServiceAccountCertPath =
+            customKubernetesServiceAccountCertPath ||
+                OkeWorkloadIdentityAuthenticationDetailsProvider.DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH;
+        this.kubernetesServiceAccountTokenPath =
+            customKubernetesServiceAccountTokenPath ||
+                OkeWorkloadIdentityAuthenticationDetailsProvider.DEFAULT_DEFAULT_KUBERNETES_SERVICE_ACCOUNT_CERT_PATH;
+    }
+    build() {
+        let federationClient;
+        let sessionKeySupplier;
+        const kubernetesServiceHost = process.env[OkeWorkloadIdentityAuthenticationDetailsProvider.KUBERNETES_SERVICE_HOST_ENV_VAR_NAME];
+        if (!kubernetesServiceHost) {
+            throw Error(`${OkeWorkloadIdentityAuthenticationDetailsProvider.KUBERNETES_SERVICE_HOST_ENV_VAR_NAME} environment variable is missing. ` +
+                OKE_WORKLOAD_IDENTITY_DEBUG_INFORMATION_LOG);
+        }
+        const kubernetesServiceProxymuxPort = process.env[OkeWorkloadIdentityAuthenticationDetailsProvider
+            .KUBERNETES_SERVICE_PORT_PROXYMUX_ENV_VAR_NAME];
+        if (!kubernetesServiceProxymuxPort) {
+            throw Error(`${OkeWorkloadIdentityAuthenticationDetailsProvider.KUBERNETES_SERVICE_PORT_PROXYMUX_ENV_VAR_NAME} environment variable is missing. ` +
+                OKE_WORKLOAD_IDENTITY_DEBUG_INFORMATION_LOG);
+        }
+        let kubernetesServiceAccountCert;
+        try {
+            kubernetesServiceAccountCert = load_from_file_1.loadFromFile(this.kubernetesServiceAccountCertPath);
+        }
+        catch (e) {
+            throw Error(`Failed to read ${this.kubernetesServiceAccountCertPath}. ` +
+                OKE_WORKLOAD_IDENTITY_DEBUG_INFORMATION_LOG);
+        }
+        let kubernetesServiceAccountToken;
+        try {
+            kubernetesServiceAccountToken = load_from_file_1.loadFromFile(this.kubernetesServiceAccountTokenPath);
+        }
+        catch (e) {
+            throw Error(`Failed to read ${this.kubernetesServiceAccountTokenPath}. ` +
+                OKE_WORKLOAD_IDENTITY_DEBUG_INFORMATION_LOG);
+        }
+        // Initialize everything
+        sessionKeySupplier = new session_key_supplier_1.default();
+        federationClient = new X509_federation_client_for_oke_workload_identity_1.default(`https://${kubernetesServiceHost}:${kubernetesServiceProxymuxPort}/resourcePrincipalSessionTokens`, kubernetesServiceAccountToken, kubernetesServiceAccountCert, sessionKeySupplier);
+        return new OkeWorkloadIdentityAuthenticationDetailsProvider(federationClient, sessionKeySupplier);
+    }
+};
+//# sourceMappingURL=oke-workload-identity-authentication-details-provider.js.map

package/lib/auth/oke-workload-identity-authentication-details-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oke-workload-identity-authentication-details-provider.js","sourceRoot":"","sources":["../../../../../lib/auth/oke-workload-identity-authentication-details-provider.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;AAEH;;;;;;;;;;;;;;GAcG;AAEH,6DAAwD;AAGxD,8IAAmH;AAEnH,0IAA4G;AAC5G,kFAA4D;AAE5D,MAAM,2CAA2C,GAC/C,2LAA2L,CAAC;AAE9L,MAAqB,gDACnB,SAAQ,4DAA+C;IAevD,YACY,gBAAkC,EAClC,kBAAsC;QAEhD,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAHlC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,uBAAkB,GAAlB,kBAAkB,CAAoB;IAGlD,CAAC;IAgBD,oGAAoG;IACpG,mDAAmD;IAC5C,MAAM,CAAC,OAAO,CACnB,sCAA8C,EAC9C,uCAA+C;QAE/C,OAAO,IAAI,gDAAgD,CAAC,uDAAuD,CACjH,sCAAsC,EACtC,uCAAuC,CACxC,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACU,cAAc,CAAC,GAAW;;YACrC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACG,OAAO;;YACX,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,CAAC;KAAA;;AAlEH,mEAqJC;AAlJQ,qFAAoC,GAAG,yBAAyB,CAAC;AACjE,8FAA6C,GAAG,kCAAkC,CAAC;AACnF,6FAA4C,GACjD,sDAAsD,CAAC;AAClD,qGAAoD,GACzD,qDAAqD,CAAC;AAe1C,0DAAS,SAAG,MAAM,SAAS;KAYxC;IAXC;;;OAGG;IACW,2BAAwB,GAAG,iBAAkB;IAE3D;;;OAGG;IACW,sBAAmB,GAAG,YAAa;QACjD;AAiCF;;GAEG;AACW,wGAAuD,GAAG,MAAM,uDAAuD;IAInI,YACE,sCAA+C,EAC/C,uCAAgD;QAEhD,IAAI,CAAC,gCAAgC;YACnC,sCAAsC;gBACtC,gDAAgD,CAAC,4CAA4C,CAAC;QAChG,IAAI,CAAC,iCAAiC;YACpC,uCAAuC;gBACvC,gDAAgD,CAAC,oDAAoD,CAAC;IAC1G,CAAC;IAEM,KAAK;QACV,IAAI,gBAAkC,CAAC;QACvC,IAAI,kBAAsC,CAAC;QAE3C,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CACT,gDAAgD,CAAC,oCAAoC,CACtF,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE;YAC1B,MAAM,KAAK,CACT,GAAG,gDAAgD,CAAC,oCAAoC,oCAAoC;gBAC1H,2CAA2C,CAC9C,CAAC;SACH;QAED,MAAM,6BAA6B,GACjC,OAAO,CAAC,GAAG,CACT,gDAAgD;aAC7C,6CAA6C,CACjD,CAAC;QACJ,IAAI,CAAC,6BAA6B,EAAE;YAClC,MAAM,KAAK,CACT,GAAG,gDAAgD,CAAC,6CAA6C,oCAAoC;gBACnI,2CAA2C,CAC9C,CAAC;SACH;QAED,IAAI,4BAA4B,CAAC;QACjC,IAAI;YACF,4BAA4B,GAAG,6BAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;SACpF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,KAAK,CACT,kBAAkB,IAAI,CAAC,gCAAgC,IAAI;gBACzD,2CAA2C,CAC9C,CAAC;SACH;QAED,IAAI,6BAA6B,CAAC;QAClC,IAAI;YACF,6BAA6B,GAAG,6BAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;SACtF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,KAAK,CACT,kBAAkB,IAAI,CAAC,iCAAiC,IAAI;gBAC1D,2CAA2C,CAC9C,CAAC;SACH;QAED,wBAAwB;QACxB,kBAAkB,GAAG,IAAI,8BAAsB,EAAE,CAAC;QAClD,gBAAgB,GAAG,IAAI,0DAA0C,CAC/D,WAAW,qBAAqB,IAAI,6BAA6B,iCAAiC,EAClG,6BAA6B,EAC7B,4BAA4B,EAC5B,kBAAkB,CACnB,CAAC;QAEF,OAAO,IAAI,gDAAgD,CACzD,gBAAgB,EAChB,kBAAkB,CACnB,CAAC;IACJ,CAAC;CACF,CAAC"}

package/lib/auth/url-based-x509-certificate-supplier.d.ts

@@ -7,6 +7,7 @@ import X509CertificateSupplier from "./models/X509-certificate-supplier";
 import CertificateAndPrivateKeyPair from "./certificate-and-privatekey-pair";
 import Refreshable from "./models/refreshable";
 import CircuitBreaker from "../circuit-breaker";
+import { Response } from "node-fetch";
 /**
  * A class that retrieves certificate based on metadata service url
  */
@@ -35,6 +36,8 @@ export declare class ResourceDetails {
     private headers;
     private circuitBreaker;
     constructor(url: string, headers: Headers, circuitBreaker: CircuitBreaker);
+    private METADATA_AUTH_HEADERS;
+    private AUTHORIZATION;
     send(): Promise<Response>;
     getUrl(): string;
 }

package/lib/auth/url-based-x509-certificate-supplier.js

@@ -21,6 +21,7 @@ const sshpk_1 = require("sshpk");
 const http_1 = require("../http");
 const certificate_and_privatekey_pair_1 = __importDefault(require("./certificate-and-privatekey-pair"));
 const helper_1 = require("../helper");
+const node_fetch_1 = __importDefault(require("node-fetch"));
 /**
  * A class that retrieves certificate based on metadata service url
  */
@@ -89,14 +90,17 @@ class ResourceDetails {
         this.url = url;
         this.headers = headers;
         this.circuitBreaker = circuitBreaker;
+        this.METADATA_AUTH_HEADERS = "Bearer Oracle";
+        this.AUTHORIZATION = "Authorization";
     }
     send() {
         return __awaiter(this, void 0, void 0, function* () {
             const httpClient = new http_1.FetchHttpClient(null, this.circuitBreaker);
-            const response = yield httpClient.send({
-                uri: this.url,
+            const metaDataHeaders = {};
+            metaDataHeaders[this.AUTHORIZATION] = this.METADATA_AUTH_HEADERS;
+            const response = yield node_fetch_1.default(this.url, {
                 method: "GET",
-                headers: this.headers
+                headers: metaDataHeaders
             });
             return response;
         });

package/lib/auth/url-based-x509-certificate-supplier.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-based-x509-certificate-supplier.js","sourceRoot":"","sources":["../../../../../lib/auth/url-based-x509-certificate-supplier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,iCAAmF;AACnF,kCAA0C;AAE1C,wGAA6E;AAE7E,sCAAsD;AAGtD;;GAEG;AAEH,MAAa,+BAA+B;IAE1C,YACU,kBAAmC,EACnC,iBAAyC,EACzC,8BAA6C;QAF7C,uBAAkB,GAAlB,kBAAkB,CAAiB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAwB;QACzC,mCAA8B,GAA9B,8BAA8B,CAAe;IACpD,CAAC;IAEJ;;;OAGG;IACH,SAAS;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACG,OAAO;;YACX,MAAM,WAAW,GAAgB,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxF,MAAM,UAAU,GAAsB,MAAM,IAAI,CAAC,cAAc,CAC7D,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,8BAA8B,CACpC,CAAC;YACF,IAAI,CAAC,qBAAqB,GAAG,IAAI,yCAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEK,kBAAkB,CAAC,kBAAmC;;YAC1D,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAC1D,sDAAsD;YACtD,MAAM,iBAAiB,GAAG,MAAM,kCAAyB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,wBAAgB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,WAAW,CAAC;QACrB,CAAC;KAAA;IAEK,cAAc,CAClB,yBAAiD,EACjD,oBAAmC;;YAEnC,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,yBAAyB,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,EAAE;gBACrE,OAAO,IAAI,CAAC;aACb;YACD,IAAI,oBAAoB,EAAE;gBACxB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC9D;YACD,IAAI;gBACF,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,CAAC;gBAChE,gDAAgD;gBAChD,MAAM,gBAAgB,GAAG,MAAM,kCAAyB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAChF,MAAM,UAAU,GAAG,uBAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC;aACnB;YAAC,OAAO,CAAC,EAAE;gBACV,MAAM,KAAK,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;aAC5D;QACH,CAAC;KAAA;IAED,wBAAwB;QACtB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;CACF;AA/DD,0EA+DC;AAED,MAAa,eAAe;IAC1B,YACU,GAAW,EACX,OAAgB,EAChB,cAA8B;QAF9B,QAAG,GAAH,GAAG,CAAQ;QACX,YAAO,GAAP,OAAO,CAAS;QAChB,mBAAc,GAAd,cAAc,CAAgB;IACrC,CAAC;IAEE,IAAI;;YACR,MAAM,UAAU,GAAG,IAAI,sBAAe,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;gBACrC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF;AApBD,0CAoBC"}
+{"version":3,"file":"url-based-x509-certificate-supplier.js","sourceRoot":"","sources":["../../../../../lib/auth/url-based-x509-certificate-supplier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,iCAAmF;AACnF,kCAA0C;AAE1C,wGAA6E;AAE7E,sCAAsD;AAEtD,4DAA6C;AAE7C;;GAEG;AAEH,MAAa,+BAA+B;IAE1C,YACU,kBAAmC,EACnC,iBAAyC,EACzC,8BAA6C;QAF7C,uBAAkB,GAAlB,kBAAkB,CAAiB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAwB;QACzC,mCAA8B,GAA9B,8BAA8B,CAAe;IACpD,CAAC;IAEJ;;;OAGG;IACH,SAAS;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACG,OAAO;;YACX,MAAM,WAAW,GAAgB,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxF,MAAM,UAAU,GAAsB,MAAM,IAAI,CAAC,cAAc,CAC7D,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,8BAA8B,CACpC,CAAC;YACF,IAAI,CAAC,qBAAqB,GAAG,IAAI,yCAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEK,kBAAkB,CAAC,kBAAmC;;YAC1D,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAC1D,sDAAsD;YACtD,MAAM,iBAAiB,GAAG,MAAM,kCAAyB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,wBAAgB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,WAAW,CAAC;QACrB,CAAC;KAAA;IAEK,cAAc,CAClB,yBAAiD,EACjD,oBAAmC;;YAEnC,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,yBAAyB,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,EAAE;gBACrE,OAAO,IAAI,CAAC;aACb;YACD,IAAI,oBAAoB,EAAE;gBACxB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC9D;YACD,IAAI;gBACF,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,CAAC;gBAChE,gDAAgD;gBAChD,MAAM,gBAAgB,GAAG,MAAM,kCAAyB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAChF,MAAM,UAAU,GAAG,uBAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC;aACnB;YAAC,OAAO,CAAC,EAAE;gBACV,MAAM,KAAK,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;aAC5D;QACH,CAAC;KAAA;IAED,wBAAwB;QACtB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;CACF;AA/DD,0EA+DC;AAED,MAAa,eAAe;IAC1B,YACU,GAAW,EACX,OAAgB,EAChB,cAA8B;QAF9B,QAAG,GAAH,GAAG,CAAQ;QACX,YAAO,GAAP,OAAO,CAAS;QAChB,mBAAc,GAAd,cAAc,CAAgB;QAEhC,0BAAqB,GAAG,eAAe,CAAC;QACxC,kBAAa,GAAG,eAAe,CAAC;IAFrC,CAAC;IAIE,IAAI;;YACR,MAAM,UAAU,GAAG,IAAI,sBAAe,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,eAAe,GAAQ,EAAE,CAAC;YAChC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,oBAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF;AAvBD,0CAuBC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oci-common",
-  "version": "2.70.1",
+  "version": "2.70.3",
   "description": "OCI Common module for NodeJS",
   "repository": {
     "type": "git",
@@ -33,6 +33,7 @@
     "@types/chai": "4.1.7",
     "@types/node": "14.14.43",
     "@types/mocha": "5.2.5",
+    "@types/node-fetch": "2.6.5",
     "awesome-typescript-loader": "3.1.3",
     "chai": "^4.2.0",
     "mocha": "^5.2.0",
@@ -40,7 +41,8 @@
     "ts-node": "^8.0.2",
     "typescript": "4.1.3",
     "webpack": "4.0.0",
-    "webpack-cli": "^3.3.0"
+    "webpack-cli": "^3.3.0",
+    "node-fetch": "2.6.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"