migrate oidcTokenProvider to authMetadata

Signed-off-by: Jamie Klassen <jklassen@vmware.com>

plugins/kubernetes-backend/api-report.md

@@ -54,7 +54,6 @@ export class AzureIdentityKubernetesAuthTranslator
 
 // @public (undocumented)
 export interface ClusterDetails {
-  // (undocumented)
   authMetadata?: Record<string, string>;
   // (undocumented)
   authProvider: string;
@@ -67,7 +66,6 @@ export interface ClusterDetails {
   dashboardParameters?: JsonObject;
   dashboardUrl?: string;
   name: string;
-  oidcTokenProvider?: string | undefined;
   skipMetricsLookup?: boolean;
   // (undocumented)
   skipTLSVerify?: boolean;

plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.test.ts

@@ -92,7 +92,7 @@ describe('CatalogClusterLocator', () => {
       url: 'https://apiserver.com',
       caData: 'caData',
       authProvider: 'oidc',
-      oidcTokenProvider: 'google',
+      authMetadata: { oidcTokenProvider: 'google' },
       skipMetricsLookup: true,
       skipTLSVerify: true,
       dashboardUrl: 'my-url',
@@ -114,8 +114,8 @@ describe('CatalogClusterLocator', () => {
       authMetadata: {
         assumeRole: 'my-role',
         externalId: 'my-id',
+        oidcTokenProvider: 'google',
       },
-      oidcTokenProvider: 'google',
       skipMetricsLookup: false,
       skipTLSVerify: false,
       dashboardUrl: 'my-url',

plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts

@@ -57,6 +57,10 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier {
       filter: [filter],
     });
     return clusters.items.map(entity => {
+      const oidcTokenProvider =
+        entity.metadata.annotations?.[
+          ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER
+        ];
       const clusterDetails: ClusterDetails = {
         name: entity.metadata.name,
         url: entity.metadata.annotations![ANNOTATION_KUBERNETES_API_SERVER]!,
@@ -64,10 +68,7 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier {
           entity.metadata.annotations![ANNOTATION_KUBERNETES_API_SERVER_CA]!,
         authProvider:
           entity.metadata.annotations![ANNOTATION_KUBERNETES_AUTH_PROVIDER]!,
-        oidcTokenProvider:
-          entity.metadata.annotations![
-            ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER
-          ]!,
+        ...(oidcTokenProvider && { authMetadata: { oidcTokenProvider } }),
         skipMetricsLookup:
           entity.metadata.annotations![
             ANNOTATION_KUBERNETES_SKIP_METRICS_LOOKUP
@@ -94,6 +95,7 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier {
               entity.metadata.annotations![
                 ANNOTATION_KUBERNETES_AWS_EXTERNAL_ID
               ]!,
+            ...clusterDetails.authMetadata,
           },
         };
       }

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts

@@ -88,7 +88,13 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier {
           case 'oidc': {
             const oidcTokenProvider = c.getString('oidcTokenProvider');
 
-            return { oidcTokenProvider, ...clusterDetails };
+            return {
+              authMetadata: {
+                oidcTokenProvider,
+                ...clusterDetails.authMetadata,
+              },
+              ...clusterDetails,
+            };
           }
           case 'serviceAccount': {
             return clusterDetails;

plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts

@@ -28,7 +28,7 @@ describe('OidcKubernetesAuthTranslator tests', () => {
   it('returns cluster details with auth token', async () => {
     const details = await at.decorateClusterDetailsWithAuth(
       {
-        oidcTokenProvider: 'okta',
+        authMetadata: { oidcTokenProvider: 'okta' },
         ...baseClusterDetails,
       },
       {
@@ -50,7 +50,7 @@ describe('OidcKubernetesAuthTranslator tests', () => {
   it('returns error when token is not included in request body', async () => {
     await expect(
       at.decorateClusterDetailsWithAuth(
-        { oidcTokenProvider: 'okta', ...baseClusterDetails },
+        { authMetadata: { oidcTokenProvider: 'okta' }, ...baseClusterDetails },
         {},
       ),
     ).rejects.toThrow('Auth token not found under oidc.okta in request body');

plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts

@@ -32,7 +32,7 @@ export class OidcKubernetesAuthTranslator implements KubernetesAuthTranslator {
       clusterDetails,
     );
 
-    const { oidcTokenProvider } = clusterDetails;
+    const oidcTokenProvider = clusterDetails.authMetadata?.oidcTokenProvider;
 
     if (!oidcTokenProvider || oidcTokenProvider === '') {
       throw new Error(

plugins/kubernetes-backend/src/service/KubernetesBuilder.ts

@@ -339,12 +339,15 @@ export class KubernetesBuilder {
     router.get('/clusters', async (_, res) => {
       const clusterDetails = await this.fetchClusterDetails(clusterSupplier);
       res.json({
-        items: clusterDetails.map(cd => ({
-          name: cd.name,
-          dashboardUrl: cd.dashboardUrl,
-          authProvider: cd.authProvider,
-          oidcTokenProvider: cd.oidcTokenProvider,
-        })),
+        items: clusterDetails.map(cd => {
+          const oidcTokenProvider = cd.authMetadata?.oidcTokenProvider;
+          return {
+            name: cd.name,
+            dashboardUrl: cd.dashboardUrl,
+            authProvider: cd.authProvider,
+            ...(oidcTokenProvider && { oidcTokenProvider }),
+          };
+        }),
       });
     });
 

plugins/kubernetes-backend/src/types/types.ts

@@ -156,9 +156,9 @@ export interface ClusterDetails {
   url: string;
   authProvider: string;
   /**
-   * oidc provider used to get id tokens to authenticate against kubernetes
+   * Provider-specific authentication configuration
    */
-  oidcTokenProvider?: string | undefined;
+  authMetadata?: Record<string, string>;
   skipTLSVerify?: boolean;
   /**
    * Whether to skip the lookup to the metrics server to retrieve pod resource usage.
@@ -204,8 +204,6 @@ export interface ClusterDetails {
    * Kubernetes resources.
    */
   customResources?: CustomResourceMatcher[];
-
-  authMetadata?: Record<string, string>;
 }
 
 /**