EnvPolicyOpaAuthToken = "MINIO_POLICY_OPA_AUTH_TOKEN"
)

// DefaultKVS - default config for OPA config
var (
	DefaultKVS = config.KVS{
		config.KV{
			Key:           URL,
			Value:         "",
			HiddenIfEmpty: true,
		},
		config.KV{
			Key:           AuthToken,
			Value:         "",
			HiddenIfEmpty: true,
		},
	}
)

// Args opa general purpose policy engine configuration.
type Args struct {

}

// Extract value of key out of Struct, but always return a Struct, even if the value isn't one
func (v *myProtoValue) keyAsStruct(key string) *myProtoValue {
	if v == nil || v.GetStructValue() == nil {
		return asMyProtoValue(&structpb.Struct{Fields: make(map[string]*structpb.Value)})
	}

	return &myProtoValue{v.GetStructValue().Fields[key]}
}

)

// DefaultKVS is the default K/V config system for
// the STS TLS API.
var DefaultKVS = config.KVS{
	config.KV{
		Key:   skipVerify,
		Value: "off",
	},
}

// Help is the help and description for the STS API K/V configuration.
var Help = config.HelpKVS{
	config.HelpKV{
		Key:         skipVerify,
		Description: `trust client certificates without verification (default: 'off')`,
		Optional:    true,

//
// `filterByLabels` is a map of label names to list of allowed label values to
// filter by. Note that this filtering happens before any renaming of labels.
//
// `renameLabels` is a map of label names to rename. The keys are the original
// label names and the values are the new label names.
//
// `bucketFilter` is a list of bucket values to filter. If this is non-empty,
// only metrics for the given buckets are added.
//

                byte[] sk = ctx.getSigningKey();
                if ( sk != null ) {
                    // session key is truncated to 16 bytes, right padded with 0 if shorter
                    byte[] key = new byte[16];
                    System.arraycopy(sk, 0, key, 0, Math.min(16, sk.length));
                    this.sessionKey = key;
                }

                boolean signed = response != null && response.isSigned();

create table DUMMY_MEMBER(
    MEMBER_ID INTEGER IDENTITY NOT NULL PRIMARY KEY,
    MEMBER_NAME VARCHAR(200) NOT NULL,
    MEMBER_ACCOUNT VARCHAR(50) NOT NULL,
    MEMBER_STATUS_CODE CHAR(3) NOT NULL,
    FORMALIZED_DATETIME DATETIME,
    BIRTHDATE DATE,
    REGISTER_DATETIME DATETIME NOT NULL,
    REGISTER_USER VARCHAR(200) NOT NULL,
    UPDATE_DATETIME DATETIME NOT NULL,
    UPDATE_USER VARCHAR(200) NOT NULL,
    VERSION_NO BIGINT NOT NULL

export AWS_ACCESS_KEY_ID=minioadmin
export AWS_SECRET_ACCESS_KEY=minioadmin
export AWS_REGION=us-east-1

aws s3api --endpoint-url http://localhost:9001 delete-object --bucket testbucket --key dir/file --version-id "$versionId"

./mc ls -r --versions myminio1/testbucket >/tmp/myminio1.txt
./mc ls -r --versions myminio2/testbucket >/tmp/myminio2.txt

out=$(diff -qpruN /tmp/myminio1.txt /tmp/myminio2.txt)
ret=$?

    buildType(RerunFlakyTest(Os.MACOS, Arch.AARCH64))
    buildType(WarmupEc2Agent)

    buildType(PublishKotlinDslPlugin)

    params {
        param("env.DEVELOCITY_ACCESS_KEY", "%ge.gradle.org.access.key%")
    }

    /**
     * Set a given project property.
     *
     * @param project the project to modify
     * @param key they property's key
     * @param value the value or {@code null} to unset the property
     */
    void setProperty(@Nonnull Project project, @Nonnull String key, @Nullable String value);

    @Nonnull
    Optional<Project> getExecutionProject(@Nonnull Project project);

Using the above `id_token` we can perform an STS request to MinIO to get temporary credentials for MinIO API operations. MinIO STS API uses [JSON Web Key Set Endpoint](https://docs.wso2.com/display/IS541/JSON+Web+Key+Set+Endpoint) to validate if JWT is valid and is properly signed.