Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Credential-less provider profiles cannot be instantiated without a credential source

Fermée
  • Quelque chose ne va pas ?
#3,304 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
68/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
rust
Domaine
cli, networking

Piste de recherche

Reproduisez le comportement avec les commandes provider profile lint, import et create montrées dans l’issue, en utilisant un profil avec credentials: []. Suivez le point d’entrée de la création du provider et la validation de sa source d’identifiants. Le travail est terminé lorsque les profils sans identifiants peuvent être créés et associés à un sandbox, tandis que les profils avec identifiants nécessitent toujours leur source configurée et que les endpoints restent dans la politique réseau effective.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

state:triage-needed
User Story

As an OpenShell user, I want to create a provider instance from a provider profile that declares no credentials, so that I can use the provider solely to distribute network access policies to sandboxes.
This is useful for internal services and public endpoints where authentication is not required, but where the provider profile is still useful for managing and attaching network policy.

Problem Statement

A valid provider profile with credentials: [] can be linted and imported successfully, but a provider instance cannot be created from that profile without supplying one of the credential-source options.
For example, a profile containing only a TCP endpoint and no credentials is accepted by the profile validation/import commands, but:
openshell provider create --name example --type example
fails because the CLI requires a credential source.
This prevents credential-less, policy-only provider profiles from being instantiated.

Impact / Why This Matters

Users who want to use provider profiles purely to distribute network policies must currently provide a credential source even when the provider profile does not require credentials.
As a workaround, users have to provide a dummy/fake secret when creating the provider instance.
This creates unnecessary configuration and makes the provider appear to have credentials when it does not actually require or use any.
For policy-only providers, this also makes it impossible to use the provider model as intended without introducing artificial credentials into the configuration.

Acceptance Criteria
  • A provider profile containing credentials: [] can be instantiated without providing a credential source.
  • The following command succeeds for a credential-less provider profile:
openshell provider create --name example --type example
  • No dummy, fake, or otherwise unnecessary credential is required.
  • The resulting provider instance can be attached to a sandbox.
  • Endpoints defined by the provider profile are included in the sandbox's effective network policy.
  • Existing provider profiles that require credentials continue to require their appropriate credential sources.
Reproduction Steps

Create /tmp/example-provider.yaml:

id: example
display_name: Example
description: Credential-less TCP access to example.com
category: other
inference_capable: false

credentials: []

endpoints:
  - host: example.com
    port: 443
    protocol: tcp

binaries:
  - /usr/bin/curl
2. Validate the profile
openshell provider profile lint -f /tmp/example-provider.yaml

Expected:

Provider profile lint passed.
3. Import the profile
openshell provider profile import \
  -f /tmp/example-provider.yaml

The profile is imported successfully.

4. Try to create a provider without credentials
openshell provider create \
  --name example \
  --type example

Actual result:

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>

The profile explicitly declares:

credentials: []

but the provider creation command still requires a credential-source option.

5. Workaround

The provider can only be created by supplying a credential source, for example by using a dummy/fake secret.

This is unnecessary because the provider profile itself declares that it has no credentials.

Environment
  • OpenShell: 0.0.116
  • OS: macOS 26.6.2
  • Deployment: OpenShell gateway running locally, docker desktop 4.90.0, docker engine 29.7.2,
  • Provider type: custom provider profile
  • Provider profile: credential-less (credentials: [])
  • Network policy: TCP endpoint example.com:443
Logs
$ openshell provider create --name example --type example

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>
Langage dominant
Rust
Étoiles
15.4k
Forks
1.7k
Merge moyen
1 j 19 h
PR mergées (30 j)
347

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de NVIDIA/OpenShell

Toutes les issues de NVIDIA/OpenShell

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.