From 3efdf55f238fb806f112dadbb6f25ed1faeb020c Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Wed, 8 Mar 2023 16:33:45 +0000 Subject: [PATCH 1/5] remove unhandled promise on bad creds The unhandled promise had been bringing down the whole application when the creds were bad. Signed-off-by: Brian Fletcher --- .../AwsIamKubernetesAuthTranslator.ts | 66 +++++++++---------- 1 file changed, 32 insertions(+), 34 deletions(-) diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts index b89945902d..84e60c9c69 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts @@ -55,46 +55,44 @@ export class AwsIamKubernetesAuthTranslator assumeRole?: string, externalId?: string, ): Promise { - return new Promise(async (resolve, reject) => { - const awsCreds = await this.awsGetCredentials(); + const awsCreds = await this.awsGetCredentials(); - if (!(awsCreds instanceof Credentials)) - return reject(Error('No AWS credentials found.')); + if (!(awsCreds instanceof Credentials)) + throw new Error('No AWS credentials found.'); - let creds: SigningCreds = { - accessKeyId: awsCreds.accessKeyId, - secretAccessKey: awsCreds.secretAccessKey, - sessionToken: awsCreds.sessionToken, + let creds: SigningCreds = { + accessKeyId: awsCreds.accessKeyId, + secretAccessKey: awsCreds.secretAccessKey, + sessionToken: awsCreds.sessionToken, + }; + + if (!this.validCredentials(creds)) + throw new Error('Invalid AWS credentials found.'); + if (!assumeRole) return creds; + + try { + const params: AWS.STS.Types.AssumeRoleRequest = { + RoleArn: assumeRole, + RoleSessionName: 'backstage-login', }; + if (externalId) params.ExternalId = externalId; - if (!this.validCredentials(creds)) - return reject(Error('Invalid AWS credentials found.')); - if (!assumeRole) return resolve(creds); + const assumedRole = await new AWS.STS().assumeRole(params).promise(); - try { - const params: AWS.STS.Types.AssumeRoleRequest = { - RoleArn: assumeRole, - RoleSessionName: 'backstage-login', - }; - if (externalId) params.ExternalId = externalId; - - const assumedRole = await new AWS.STS().assumeRole(params).promise(); - - if (!assumedRole.Credentials) { - throw new Error(`No credentials returned for role ${assumeRole}`); - } - - creds = { - accessKeyId: assumedRole.Credentials.AccessKeyId, - secretAccessKey: assumedRole.Credentials.SecretAccessKey, - sessionToken: assumedRole.Credentials.SessionToken, - }; - } catch (e) { - console.warn(`There was an error assuming the role: ${e}`); - return reject(Error(`Unable to assume role: ${e}`)); + if (!assumedRole.Credentials) { + throw new Error(`No credentials returned for role ${assumeRole}`); } - return resolve(creds); - }); + + creds = { + accessKeyId: assumedRole.Credentials.AccessKeyId, + secretAccessKey: assumedRole.Credentials.SecretAccessKey, + sessionToken: assumedRole.Credentials.SessionToken, + }; + } catch (e) { + console.warn(`There was an error assuming the role: ${e}`); + throw new Error(`Unable to assume role: ${e}`); + } + return creds; } async getBearerToken( clusterName: string, From 75d4985f5e80c8a86bbe2dbf216da330a651994c Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Wed, 8 Mar 2023 16:38:42 +0000 Subject: [PATCH 2/5] add changeset for k8s plugin Signed-off-by: Brian Fletcher --- .changeset/fuzzy-actors-turn.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/fuzzy-actors-turn.md diff --git a/.changeset/fuzzy-actors-turn.md b/.changeset/fuzzy-actors-turn.md new file mode 100644 index 0000000000..3cb8f84cae --- /dev/null +++ b/.changeset/fuzzy-actors-turn.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes-backend': patch +--- + +Fixes bug whereby backstage crashes when bad aws credentials are provided to the kubernetes plugin. From bd1ee2b7403b5049e67c72458526e521328770eb Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Wed, 8 Mar 2023 16:42:59 +0000 Subject: [PATCH 3/5] remove typo Signed-off-by: Brian Fletcher --- .changeset/fuzzy-actors-turn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/fuzzy-actors-turn.md b/.changeset/fuzzy-actors-turn.md index 3cb8f84cae..bd92ad34ef 100644 --- a/.changeset/fuzzy-actors-turn.md +++ b/.changeset/fuzzy-actors-turn.md @@ -2,4 +2,4 @@ '@backstage/plugin-kubernetes-backend': patch --- -Fixes bug whereby backstage crashes when bad aws credentials are provided to the kubernetes plugin. +Fixes bug whereby backstage crashes when bad credentials are provided to the kubernetes plugin. From 2d6efa32792a2273bb31671228ea4713cb5fbb15 Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Tue, 14 Mar 2023 12:55:17 +0000 Subject: [PATCH 4/5] dont fail if cluster auth fails for one cluster Signed-off-by: Brian Fletcher --- .../AwsIamKubernetesAuthTranslator.ts | 66 +++++++++---------- .../src/service/KubernetesFanOutHandler.ts | 17 ++++- 2 files changed, 47 insertions(+), 36 deletions(-) diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts index b89945902d..84e60c9c69 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts @@ -55,46 +55,44 @@ export class AwsIamKubernetesAuthTranslator assumeRole?: string, externalId?: string, ): Promise { - return new Promise(async (resolve, reject) => { - const awsCreds = await this.awsGetCredentials(); + const awsCreds = await this.awsGetCredentials(); - if (!(awsCreds instanceof Credentials)) - return reject(Error('No AWS credentials found.')); + if (!(awsCreds instanceof Credentials)) + throw new Error('No AWS credentials found.'); - let creds: SigningCreds = { - accessKeyId: awsCreds.accessKeyId, - secretAccessKey: awsCreds.secretAccessKey, - sessionToken: awsCreds.sessionToken, + let creds: SigningCreds = { + accessKeyId: awsCreds.accessKeyId, + secretAccessKey: awsCreds.secretAccessKey, + sessionToken: awsCreds.sessionToken, + }; + + if (!this.validCredentials(creds)) + throw new Error('Invalid AWS credentials found.'); + if (!assumeRole) return creds; + + try { + const params: AWS.STS.Types.AssumeRoleRequest = { + RoleArn: assumeRole, + RoleSessionName: 'backstage-login', }; + if (externalId) params.ExternalId = externalId; - if (!this.validCredentials(creds)) - return reject(Error('Invalid AWS credentials found.')); - if (!assumeRole) return resolve(creds); + const assumedRole = await new AWS.STS().assumeRole(params).promise(); - try { - const params: AWS.STS.Types.AssumeRoleRequest = { - RoleArn: assumeRole, - RoleSessionName: 'backstage-login', - }; - if (externalId) params.ExternalId = externalId; - - const assumedRole = await new AWS.STS().assumeRole(params).promise(); - - if (!assumedRole.Credentials) { - throw new Error(`No credentials returned for role ${assumeRole}`); - } - - creds = { - accessKeyId: assumedRole.Credentials.AccessKeyId, - secretAccessKey: assumedRole.Credentials.SecretAccessKey, - sessionToken: assumedRole.Credentials.SessionToken, - }; - } catch (e) { - console.warn(`There was an error assuming the role: ${e}`); - return reject(Error(`Unable to assume role: ${e}`)); + if (!assumedRole.Credentials) { + throw new Error(`No credentials returned for role ${assumeRole}`); } - return resolve(creds); - }); + + creds = { + accessKeyId: assumedRole.Credentials.AccessKeyId, + secretAccessKey: assumedRole.Credentials.SecretAccessKey, + sessionToken: assumedRole.Credentials.SessionToken, + }; + } catch (e) { + console.warn(`There was an error assuming the role: ${e}`); + throw new Error(`Unable to assume role: ${e}`); + } + return creds; } async getBearerToken( clusterName: string, diff --git a/plugins/kubernetes-backend/src/service/KubernetesFanOutHandler.ts b/plugins/kubernetes-backend/src/service/KubernetesFanOutHandler.ts index 63e46a44e3..0c1bc670fd 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesFanOutHandler.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesFanOutHandler.ts @@ -49,6 +49,14 @@ import { PodStatus, } from '@kubernetes/client-node'; +const isRejected = ( + input: PromiseSettledResult, +): input is PromiseRejectedResult => input.status === 'rejected'; + +const isFulfilled = ( + input: PromiseSettledResult, +): input is PromiseFulfilledResult => input.status === 'fulfilled'; + /** * * @public @@ -298,12 +306,12 @@ export class KubernetesFanOutHandler { auth: KubernetesRequestAuth, requestContext: ServiceLocatorRequestContext, ) { - const clusterDetails: ClusterDetails[] = await ( + const clusterDetails: ClusterDetails[] = ( await this.serviceLocator.getClustersByEntity(entity, requestContext) ).clusters; // Execute all of these async actions simultaneously/without blocking sequentially as no common object is modified by them - return await Promise.all( + const promiseResults = await Promise.allSettled( clusterDetails.map(cd => { const kubernetesAuthTranslator: KubernetesAuthTranslator = this.getAuthTranslator(cd.authProvider); @@ -313,6 +321,11 @@ export class KubernetesFanOutHandler { ); }), ); + + promiseResults.filter(isRejected).map(item => { + this.logger.info(`Failed to decorate cluster details: ${item.reason}`); + }); + return promiseResults.filter(isFulfilled).map(item => item.value); } toObjectsByEntityResponse( From e185fd1e5de583b67852093b534229bfd2cd58ff Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Tue, 14 Mar 2023 15:18:32 +0000 Subject: [PATCH 5/5] add a test Signed-off-by: Brian Fletcher --- .../AwsIamKubernetesAuthTranslator.test.ts | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts index 2696587e69..1f8d525ea8 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.test.ts @@ -17,6 +17,13 @@ import AWS from 'aws-sdk'; import AWSMock from 'aws-sdk-mock'; import { AwsIamKubernetesAuthTranslator } from './AwsIamKubernetesAuthTranslator'; +const awsError: AWS.AWSError = { + code: '123', + message: 'no way', + name: 'nope', + time: new Date(), +}; + describe('AwsIamKubernetesAuthTranslator tests', () => { let role: any = undefined; const credentials: any = { @@ -84,6 +91,25 @@ describe('AwsIamKubernetesAuthTranslator tests', () => { expect(response.serviceAccountToken).toBeDefined(); }); + describe('When the credentials is failing', () => { + beforeEach(() => { + jest.spyOn(AWS.config, 'getCredentials').mockImplementation(cb => { + cb(awsError, null); + }); + }); + it('throws the right error', async () => { + const authTranslator = new AwsIamKubernetesAuthTranslator(); + await expect( + authTranslator.decorateClusterDetailsWithAuth({ + assumeRole: role, + name: 'test-cluster', + url: '', + authProvider: 'aws', + }), + ).rejects.toEqual(awsError); + }); + }); + describe('When the role is assumed', () => { // These credentials are not real. // Pulled from example in docs: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html