After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.

## API Request

To make an STS API request with this method, send a POST request to the MinIO endpoint with following query parameters:

| Parameter       | Type    | Required |                                                                      |

#ifndef TENSORFLOW_C_EAGER_C_API_REMOTE_TEST_UTIL_H_
#define TENSORFLOW_C_EAGER_C_API_REMOTE_TEST_UTIL_H_

// Run a function containing a MatMul op and check its output.
// If heavy_load_on_streaming_rpc is true, send some rpc requests before the one
// which creates a remote input, to simulate a scenario that the remote input
// is not ready when we start running an op or a function.

h:"Het wachtwoord is niet veilig genoeg",badTelephone:"U heeft een onjuist telefoonnummer ingevoerd",badTime:"U heeft een incorrecte tijd aangegeven",badUrl:"De ingevoerde waarde is geen correcte URL",badreCaptcha:"Bevestig a.u.b. dat u geen robot bent",errorTitle:"Indienen van formulier mislukt!",groupCheckedEnd:" item(s)",groupCheckedRangeStart:"Kies a.u.b. tussen ",groupCheckedTooFewStart:"Kies a.u.b. ten minste ",groupCheckedTooManyStart:"Kies a.u.b. maximaal ",imageRatioNotAccepted:"De afbeeldingsverhouding...

	// read yet and do not want to be completely blind to logs.
	if err := log.Configure(plugin.GetLoggingOptions(nil)); err != nil {
		return err
	}
	defer func() {
		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according

import com.google.common.annotations.Beta;
import com.google.errorprone.annotations.DoNotMock;
import java.io.Serializable;
import org.checkerframework.checker.nullness.qual.Nullable;

/**
 * An object which can send data from an object of type {@code T} into a {@code PrimitiveSink}.
 * Implementations for common types can be found in {@link Funnels}.
 *
 * <p>Note that serialization of {@linkplain BloomFilter bloom filters} requires the proper

    int recv ( byte[] buf, int off, int length ) throws IOException;


    /**
     * @param buf
     * @param off
     * @param length
     * @param direct
     * @throws IOException
     */
    void send ( byte[] buf, int off, int length ) throws IOException;


    /**
     * @param buf
     * @param off
     * @param length
     * @param inB
     * @param maxRecvCnt
     * @return len

		shutdownHealMRFWithTimeout() // this can take time sometimes, it needs to be executed
		// before stopping s3 operations

		// send signal to various go-routines that they need to quit.
		cancelGlobalContext()

		if httpServer := newHTTPServerFn(); httpServer != nil {
			if err := httpServer.Shutdown(); err != nil && !errors.Is(err, http.ErrServerClosed) {
				shutdownLogIf(context.Background(), err)
			}
		}

```

Then load the policy via OPA's REST API.

```
curl -X PUT --data-binary @example.rego \
  localhost:8181/v1/policies/putobject
```

### 4. Setup MinIO with OPA

Set the `MINIO_POLICY_PLUGIN_URL` as the endpoint that MinIO should send authorization requests to. Then start the server.

```sh
export MINIO_POLICY_PLUGIN_URL=http://localhost:8181/v1/data/httpapi/authz/allow
export MINIO_CI_CD=1
export MINIO_ROOT_USER=minio

- Pods which set `hostNetwork: true` and declare ports, get the `hostPort` field set automatically. Previously this would happen in the PodTemplate of a Deployment, DaemonSet or other workload API.  Now `hostPort` will only be set when an actual Pod is being created.  If this presents a problem, setting the feature gate "DefaultHostNetworkHostPortsInPodTemplates" to true...

Then, the browser will send an HTTP `OPTIONS` request to the `:80`-backend, and if the backend sends the appropriate headers authorizing the communication from this different origin (`http://localhost:8080`) then the `:8080`-browser will let the JavaScript in the frontend send its request to the `:80`-backend.

To achieve this, the `:80`-backend must have a list of "allowed origins".