52:I[707087,["/_next/static/immutable/chunks/3arlv5bvukoo2.js","/_next/static/immutable/chunks/39v64hmfyo-sr.js","/_next/static/immutable/chunks/2nvof3-29tvc3.js","/_next/static/immutable/chunks/3tjobt77z_9dj.js","/_next/static/immutable/chunks/04j_o97cgxn2x.js","/_next/static/immutable/chunks/3upr08c9vtj8w.js","/_next/static/immutable/chunks/1ww0328si-u8x.js","/_next/static/immutable/chunks/11mfl5ymqld9-.js","/_next/static/immutable/chunks/2xxcqy6ppds3l.js","/_next/static/immutable/chunks/3j06ow7w40nxu.js","/_next/static/immutable/chunks/31nn7jwsjvqii.js","/_next/static/immutable/chunks/43_s7jweyypoh.js","/_next/static/immutable/chunks/0p6vao205o1jc.js","/_next/static/immutable/chunks/1_kyvgkyokw92.js","/_next/static/immutable/chunks/1lo-zn37dolb5.js","/_next/static/immutable/chunks/1v8k6yxw1rg0u.js"],"RegistryDependencies"] 53:I[314491,["/_next/static/immutable/chunks/3arlv5bvukoo2.js","/_next/static/immutable/chunks/39v64hmfyo-sr.js","/_next/static/immutable/chunks/2nvof3-29tvc3.js","/_next/static/immutable/chunks/3tjobt77z_9dj.js","/_next/static/immutable/chunks/04j_o97cgxn2x.js","/_next/static/immutable/chunks/3upr08c9vtj8w.js","/_next/static/immutable/chunks/1ww0328si-u8x.js","/_next/static/immutable/chunks/11mfl5ymqld9-.js","/_next/static/immutable/chunks/2xxcqy6ppds3l.js","/_next/static/immutable/chunks/3j06ow7w40nxu.js","/_next/static/immutable/chunks/31nn7jwsjvqii.js","/_next/static/immutable/chunks/43_s7jweyypoh.js","/_next/static/immutable/chunks/0p6vao205o1jc.js","/_next/static/immutable/chunks/1_kyvgkyokw92.js","/_next/static/immutable/chunks/1lo-zn37dolb5.js","/_next/static/immutable/chunks/1v8k6yxw1rg0u.js"],"FilesView"] 54:T30c7,"use client" import * as React from "react" import { Controller, useForm } from "react-hook-form" import { valibotResolver } from "@hookform/resolvers/valibot" import * as v from "valibot" import { cn } from "@/lib/utils" import { Button } from "@/components/ui/button" import { Field, FieldDescription, FieldError, FieldLabel, } from "@/components/ui/field" import { Input } from "@/components/ui/input" import { ClaimChip, ClaimsList, claimRowsFromPolicy, claimsListValid, mergeClaimRows, } from "@/components/oidc/claims" import type { OidcPolicy } from "@/lib/oidc/policy" function AwsIcon({ ...props }: React.ComponentProps<"svg">) { return ( ) } const issuerSchema = v.pipe( v.string(), v.minLength(1, "Paste the cluster issuer URL."), v.regex( /^https:\/\/[^?#\s]+$/, "Enter an https URL without query or fragment." ) ) const namespaceSchema = v.pipe( v.string(), v.minLength(1, "Enter the namespace."), v.regex( /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Lowercase letters, digits, and hyphens." ) ) const serviceAccountSchema = v.pipe( v.string(), v.minLength(1, "Enter the service account."), v.regex( /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Lowercase letters, digits, and hyphens." ) ) const audienceSchema = v.pipe(v.string(), v.minLength(1, "Enter the audience.")) const extraClaimsSchema = v.array( v.object({ name: v.string(), values: v.string() }) ) const schema = v.object({ issuer: issuerSchema, namespace: namespaceSchema, serviceAccount: serviceAccountSchema, audience: audienceSchema, extraClaims: extraClaimsSchema, }) type Fields = v.InferOutput const DEFAULTS: Fields = { issuer: "", namespace: "", serviceAccount: "", audience: "", extraClaims: [], } const FIRST_CLASS_CLAIMS = ["aud", "sub"] const SUB_PREFIX = "system:serviceaccount:" function parsePastedIssuer(text: string) { const match = text .trim() .match( /^(?:https:\/\/)?(oidc\.eks\.[\w-]+\.amazonaws\.com\/id\/[A-Za-z0-9]+)\/?$/ ) return match ? { issuer: `https://${match[1]}` } : null } // EKS is AWS's OIDC workload identity story: each cluster is its own issuer // and pods authenticate as Kubernetes service accounts. function compile(fields: Fields) { const claims: Record = {} if (fields.audience) { claims.aud = [fields.audience] } if (fields.namespace && fields.serviceAccount) { claims.sub = [`${SUB_PREFIX}${fields.namespace}:${fields.serviceAccount}`] } mergeClaimRows(claims, fields.extraClaims, FIRST_CLASS_CLAIMS) return { issuer: fields.issuer, claims } } function parse(policy: OidcPolicy) { if (!policy.issuer.startsWith("https://")) { return null } if ( FIRST_CLASS_CLAIMS.some((name) => (policy.claims[name]?.length ?? 0) > 1) ) { return null } const extraClaims = claimRowsFromPolicy(policy.claims, FIRST_CLASS_CLAIMS) if (extraClaims === null) { return null } const [sub = ""] = policy.claims.sub ?? [] if (!sub.startsWith(SUB_PREFIX)) { return null } const segments = sub.slice(SUB_PREFIX.length).split(":") if (segments.length !== 2 || !segments[0] || !segments[1]) { return null } return { issuer: policy.issuer, namespace: segments[0], serviceAccount: segments[1], audience: policy.claims.aud?.[0] ?? "", extraClaims, } } /** True when this form can represent the policy — for routing an edit. */ function matchesAwsPolicy(policy: OidcPolicy) { return parse(policy) !== null } function AwsPolicyForm({ defaultValue, onChange, onSubmit, className, }: { defaultValue?: OidcPolicy onChange?: (policy: OidcPolicy) => void onSubmit: (policy: OidcPolicy) => void className?: string }) { const form = useForm({ resolver: valibotResolver(schema), mode: "onChange", defaultValues: defaultValue ? (parse(defaultValue) ?? DEFAULTS) : DEFAULTS, }) const onChangeRef = React.useRef(onChange) React.useEffect(() => { onChangeRef.current = onChange }, [onChange]) React.useEffect(() => { return form.subscribe({ formState: { values: true }, callback: ({ values }) => { const policy = compile(values) onChangeRef.current?.( defaultValue?.label ? { ...policy, label: defaultValue.label } : policy ) }, }) }, [form, defaultValue?.label]) return (

{ if (!claimsListValid(fields.extraClaims, FIRST_CLASS_CLAIMS)) { return } const policy = compile(fields) onSubmit( defaultValue?.label ? { ...policy, label: defaultValue.label } : policy ) })} > ( Cluster OIDC issuer URL iss field.onChange(event.target.value.trim())} onPaste={(event) => { const patch = parsePastedIssuer( event.clipboardData.getData("text") ) if (!patch) { return } event.preventDefault() form.reset( { ...form.getValues(), ...patch }, { keepDefaultValues: true } ) }} /> {fieldState.invalid && } EKS console → your cluster → Overview → OpenID Connect provider URL. )} /> ( Namespace sub field.onChange(event.target.value.trim())} /> {fieldState.invalid && } )} /> ( Service account sub field.onChange(event.target.value.trim())} /> {fieldState.invalid && } )} /> ( Audience aud field.onChange(event.target.value.trim())} /> {fieldState.invalid && } The audience in your pod's projected service-account token. )} /> ( )} /> ) } export { AwsIcon, AwsPolicyForm, matchesAwsPolicy } 51:["$","div",null,{"className":"mt-3 flex min-h-0 min-w-0 flex-1 flex-col gap-3","children":[["$","div",null,{"className":"flex shrink-0 items-start gap-3","children":[["$","div",null,{"className":"flex max-h-28 min-w-0 flex-1 flex-wrap items-center gap-2 overflow-y-auto","children":[["$","ul",null,{"className":"flex min-w-0 flex-wrap gap-2","aria-label":"Package dependencies","children":[["$","li","@hookform/resolvers",{"className":"min-w-0 max-w-full","children":["$","a",null,{"href":"https://www.npmjs.com/package/%40hookform%2Fresolvers","target":"_blank","rel":"noopener noreferrer","className":"flex max-w-full min-w-0 items-center gap-1.5 rounded-md border px-2 py-1.5 text-xs","children":[["$","svg",null,{"viewBox":"0 0 24 24","className":"size-3 shrink-0","children":["$","path",null,{"d":"M1.763 0C.786 0 0 .786 0 1.763v20.474C0 23.214.786 24 1.763 24h20.474c.977 0 1.763-.786 1.763-1.763V1.763C24 .786 23.214 0 22.237 0zM5.13 5.323l13.837.019-.009 13.836h-3.464l.01-10.382h-3.456L12.04 19.17H5.113z","fill":"currentColor"}]}],["$","span",null,{"className":"min-w-0 break-all text-xs font-medium","children":"@hookform/resolvers"}]]}]}],["$","li","react-hook-form",{"className":"min-w-0 max-w-full","children":["$","a",null,{"href":"https://www.npmjs.com/package/react-hook-form","target":"_blank","rel":"noopener noreferrer","className":"flex max-w-full min-w-0 items-center gap-1.5 rounded-md border px-2 py-1.5 text-xs","children":[["$","svg",null,{"viewBox":"0 0 24 24","className":"size-3 shrink-0","children":["$","path",null,{"d":"M1.763 0C.786 0 0 .786 0 1.763v20.474C0 23.214.786 24 1.763 24h20.474c.977 0 1.763-.786 1.763-1.763V1.763C24 .786 23.214 0 22.237 0zM5.13 5.323l13.837.019-.009 13.836h-3.464l.01-10.382h-3.456L12.04 19.17H5.113z","fill":"currentColor"}]}],["$","span",null,{"className":"min-w-0 break-all text-xs font-medium","children":"react-hook-form"}]]}]}],["$","li","valibot",{"className":"min-w-0 max-w-full","children":["$","a",null,{"href":"https://www.npmjs.com/package/valibot","target":"_blank","rel":"noopener noreferrer","className":"flex max-w-full min-w-0 items-center gap-1.5 rounded-md border px-2 py-1.5 text-xs","children":[["$","svg",null,{"viewBox":"0 0 24 24","className":"size-3 shrink-0","children":["$","path",null,{"d":"M1.763 0C.786 0 0 .786 0 1.763v20.474C0 23.214.786 24 1.763 24h20.474c.977 0 1.763-.786 1.763-1.763V1.763C24 .786 23.214 0 22.237 0zM5.13 5.323l13.837.019-.009 13.836h-3.464l.01-10.382h-3.456L12.04 19.17H5.113z","fill":"currentColor"}]}],["$","span",null,{"className":"min-w-0 break-all text-xs font-medium","children":"valibot"}]]}]}]]}],["$","$L52",null,{"namespace":"@oidc","registryDependencies":["https://ui.shadcn.com/oidc/r/policy.json","https://ui.shadcn.com/oidc/r/claims.json","button","field","input"]}]]}],null]}],["$","$L53",null,{"files":[{"path":"registry/oidc/flavors/rhf-valibot/provider-aws.tsx","content":"$54","type":"registry:component","target":"@components/oidc/provider-aws.tsx"}],"className":"h-[70svh] min-h-80"}]]}]