From 1449a035ce439f40e9f85714c92cff0cfe4e22da Mon Sep 17 00:00:00 2001 From: Jamie Klassen Date: Tue, 5 Sep 2023 17:05:33 -0400 Subject: [PATCH] migrate oidcTokenProvider to authMetadata Signed-off-by: Jamie Klassen --- plugins/kubernetes-backend/api-report.md | 2 -- .../cluster-locator/CatalogClusterLocator.test.ts | 4 ++-- .../src/cluster-locator/CatalogClusterLocator.ts | 10 ++++++---- .../src/cluster-locator/ConfigClusterLocator.ts | 8 +++++++- .../OidcKubernetesAuthTranslator.test.ts | 4 ++-- .../OidcKubernetesAuthTranslator.ts | 2 +- .../src/service/KubernetesBuilder.ts | 15 +++++++++------ plugins/kubernetes-backend/src/types/types.ts | 6 ++---- 8 files changed, 29 insertions(+), 22 deletions(-) diff --git a/plugins/kubernetes-backend/api-report.md b/plugins/kubernetes-backend/api-report.md index a9037f2c31..37155edc1b 100644 --- a/plugins/kubernetes-backend/api-report.md +++ b/plugins/kubernetes-backend/api-report.md @@ -54,7 +54,6 @@ export class AzureIdentityKubernetesAuthTranslator // @public (undocumented) export interface ClusterDetails { - // (undocumented) authMetadata?: Record; // (undocumented) authProvider: string; @@ -67,7 +66,6 @@ export interface ClusterDetails { dashboardParameters?: JsonObject; dashboardUrl?: string; name: string; - oidcTokenProvider?: string | undefined; skipMetricsLookup?: boolean; // (undocumented) skipTLSVerify?: boolean; diff --git a/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.test.ts index 86776f4d02..8a4120ca56 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.test.ts @@ -92,7 +92,7 @@ describe('CatalogClusterLocator', () => { url: 'https://apiserver.com', caData: 'caData', authProvider: 'oidc', - oidcTokenProvider: 'google', + authMetadata: { oidcTokenProvider: 'google' }, skipMetricsLookup: true, skipTLSVerify: true, dashboardUrl: 'my-url', @@ -114,8 +114,8 @@ describe('CatalogClusterLocator', () => { authMetadata: { assumeRole: 'my-role', externalId: 'my-id', + oidcTokenProvider: 'google', }, - oidcTokenProvider: 'google', skipMetricsLookup: false, skipTLSVerify: false, dashboardUrl: 'my-url', diff --git a/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts index 9d81785a28..5fcc3d43a8 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/CatalogClusterLocator.ts @@ -57,6 +57,10 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier { filter: [filter], }); return clusters.items.map(entity => { + const oidcTokenProvider = + entity.metadata.annotations?.[ + ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER + ]; const clusterDetails: ClusterDetails = { name: entity.metadata.name, url: entity.metadata.annotations![ANNOTATION_KUBERNETES_API_SERVER]!, @@ -64,10 +68,7 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier { entity.metadata.annotations![ANNOTATION_KUBERNETES_API_SERVER_CA]!, authProvider: entity.metadata.annotations![ANNOTATION_KUBERNETES_AUTH_PROVIDER]!, - oidcTokenProvider: - entity.metadata.annotations![ - ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER - ]!, + ...(oidcTokenProvider && { authMetadata: { oidcTokenProvider } }), skipMetricsLookup: entity.metadata.annotations![ ANNOTATION_KUBERNETES_SKIP_METRICS_LOOKUP @@ -94,6 +95,7 @@ export class CatalogClusterLocator implements KubernetesClustersSupplier { entity.metadata.annotations![ ANNOTATION_KUBERNETES_AWS_EXTERNAL_ID ]!, + ...clusterDetails.authMetadata, }, }; } diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts index 161988d35b..4dbc083f6a 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts @@ -88,7 +88,13 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier { case 'oidc': { const oidcTokenProvider = c.getString('oidcTokenProvider'); - return { oidcTokenProvider, ...clusterDetails }; + return { + authMetadata: { + oidcTokenProvider, + ...clusterDetails.authMetadata, + }, + ...clusterDetails, + }; } case 'serviceAccount': { return clusterDetails; diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts index fe604008f1..f8184296e5 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts @@ -28,7 +28,7 @@ describe('OidcKubernetesAuthTranslator tests', () => { it('returns cluster details with auth token', async () => { const details = await at.decorateClusterDetailsWithAuth( { - oidcTokenProvider: 'okta', + authMetadata: { oidcTokenProvider: 'okta' }, ...baseClusterDetails, }, { @@ -50,7 +50,7 @@ describe('OidcKubernetesAuthTranslator tests', () => { it('returns error when token is not included in request body', async () => { await expect( at.decorateClusterDetailsWithAuth( - { oidcTokenProvider: 'okta', ...baseClusterDetails }, + { authMetadata: { oidcTokenProvider: 'okta' }, ...baseClusterDetails }, {}, ), ).rejects.toThrow('Auth token not found under oidc.okta in request body'); diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts index 5c0c0de181..c72e2fff71 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts @@ -32,7 +32,7 @@ export class OidcKubernetesAuthTranslator implements KubernetesAuthTranslator { clusterDetails, ); - const { oidcTokenProvider } = clusterDetails; + const oidcTokenProvider = clusterDetails.authMetadata?.oidcTokenProvider; if (!oidcTokenProvider || oidcTokenProvider === '') { throw new Error( diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts index 8f9d0769ed..905ef521a3 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts @@ -339,12 +339,15 @@ export class KubernetesBuilder { router.get('/clusters', async (_, res) => { const clusterDetails = await this.fetchClusterDetails(clusterSupplier); res.json({ - items: clusterDetails.map(cd => ({ - name: cd.name, - dashboardUrl: cd.dashboardUrl, - authProvider: cd.authProvider, - oidcTokenProvider: cd.oidcTokenProvider, - })), + items: clusterDetails.map(cd => { + const oidcTokenProvider = cd.authMetadata?.oidcTokenProvider; + return { + name: cd.name, + dashboardUrl: cd.dashboardUrl, + authProvider: cd.authProvider, + ...(oidcTokenProvider && { oidcTokenProvider }), + }; + }), }); }); diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts index 0096c166d8..890ebd73a3 100644 --- a/plugins/kubernetes-backend/src/types/types.ts +++ b/plugins/kubernetes-backend/src/types/types.ts @@ -156,9 +156,9 @@ export interface ClusterDetails { url: string; authProvider: string; /** - * oidc provider used to get id tokens to authenticate against kubernetes + * Provider-specific authentication configuration */ - oidcTokenProvider?: string | undefined; + authMetadata?: Record; skipTLSVerify?: boolean; /** * Whether to skip the lookup to the metrics server to retrieve pod resource usage. @@ -204,8 +204,6 @@ export interface ClusterDetails { * Kubernetes resources. */ customResources?: CustomResourceMatcher[]; - - authMetadata?: Record; } /**