`agentSandbox.auth`¶

6 options, generated from the kubenix modules — this page cannot drift from the code.

Region for the ALB public-key endpoint. REQUIRED when albVerify = true (no silent default — the public-key host is region-specific).

Type: null or string

Default:

null

alb-oidc: verify the x-amzn-oidc-data JWT signature (fetch ALB's public key) before trusting its claims.

Type: boolean

Default:

false

header mode: request header carrying the user's email (optional; set by the ingress).

Type: string

Default:

"x-auth-email"

Example:

"x-forwarded-email"

Identity source: header (default; a proxy sets userHeader/emailHeader) or alb-oidc (AWS ALB OIDC).

Type: one of "header", "alb-oidc"

Default:

"header"

Optional static map of user id (OIDC sub) -> email, seeding the learned identity store.

Type: attribute set of string

Default:

{ }

Example:

{
  cognito-sub-abc = "alice@example.com";
}

header mode: request header carrying the authenticated user id (set by the ingress).

Type: string

Default:

"x-auth-user"

Example:

"x-forwarded-user"

agentSandbox.auth¶