From 9a56cce9e8f7f0f6b5715ebe3f439d03633243c9 Mon Sep 17 00:00:00 2001
From: Zsolt Varga <wayne@riptides.io>
Date: Tue, 9 Jun 2026 12:16:21 +0200
Subject: [PATCH 1/2] feat(rfc8693): add option-based GetCredentialsWithOptions
 and Provider marker interface

---
 pkg/rfc8693/rfc8693.go | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pkg/rfc8693/rfc8693.go b/pkg/rfc8693/rfc8693.go
index 7834bbb..01e7132 100644
--- a/pkg/rfc8693/rfc8693.go
+++ b/pkg/rfc8693/rfc8693.go
@@ -52,6 +52,12 @@ type (
 	Credential = credential.Result
 )
 
+type Provider interface {
+	isRFC8693Provider()
+}
+
+func (cp *credentialsProvider) isRFC8693Provider() {}
+
 type CredentialsProvider interface {
 	GetCredentials(ctx context.Context, tokenEndpointURL string, subjectTokenProvider token.IdentityTokenProvider, opts ...option.Option) (<-chan Credential, error)
 }
@@ -79,6 +85,25 @@ func NewCredentialsProvider(_ context.Context, logger logr.Logger) (*credentials
 	return &credentialsProvider{logger: logger}, nil
 }
 
+// GetCredentialsWithOptions implements credential.Provider using option-based configuration.
+//
+// Required options: WithTokenEndpointURL, WithTokenProvider.
+func (cp *credentialsProvider) GetCredentialsWithOptions(ctx context.Context, opts ...option.Option) (<-chan Credential, error) {
+	cfg := &credentialsConfig{}
+
+	for _, opt := range opts {
+		if o, ok := isCredentialsOption(opt); ok {
+			o.Apply(cfg)
+		}
+	}
+
+	if err := validateConfig(cfg); err != nil {
+		return nil, err
+	}
+
+	return cp.GetCredentials(ctx, cfg.tokenEndpointURL, cfg.subjectTokenProvider, opts...)
+}
+
 func (cp *credentialsProvider) GetCredentials(
 	ctx context.Context,
 	tokenEndpointURL string,

From 11200d077892a8ed93124f3f102378330488b0d6 Mon Sep 17 00:00:00 2001
From: Zsolt Varga <wayne@riptides.io>
Date: Tue, 9 Jun 2026 12:16:33 +0200
Subject: [PATCH 2/2] feat(rfc7523): add Provider marker interface

---
 pkg/rfc7523/rfc7523.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkg/rfc7523/rfc7523.go b/pkg/rfc7523/rfc7523.go
index e21dcbd..5ca7bb3 100644
--- a/pkg/rfc7523/rfc7523.go
+++ b/pkg/rfc7523/rfc7523.go
@@ -43,6 +43,12 @@ type (
 	Credential = credential.Result
 )
 
+type Provider interface {
+	isRFC7523Provider()
+}
+
+func (cp *credentialsProvider) isRFC7523Provider() {}
+
 // CredentialsProvider exchanges identity JWTs for OAuth2 access tokens via the
 // RFC 7523 jwt-bearer grant type.
 type CredentialsProvider interface {