Merge pull request #5614 from backstage/eide/kube-gke-cluster-config

[kubernetes-backend]: Add options to skip TLS verification for gke type clusters

.changeset/wild-moles-care.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+Add possibility to configure TLS verification for `gke` type clusters

docs/features/kubernetes/configuration.md

@@ -33,6 +33,7 @@ kubernetes:
     - type: 'gke'
       projectId: 'gke-clusters'
       region: 'europe-west1'
+      skipTLSVerify: true
 ```
 
 ### `serviceLocatorMethod`
@@ -129,6 +130,11 @@ The Google Cloud project to look for Kubernetes clusters in.
 The Google Cloud region to look for Kubernetes clusters in. Defaults to all
 regions.
 
+##### `skipTLSVerify`
+
+This determines whether or not the Kubernetes client verifies the TLS
+certificate presented by the API server. Defaults to `false`.
+
 ### `customResources` (optional)
 
 Configures which [custom resources][3] to look for when returning an entity's

plugins/kubernetes-backend/schema.d.ts

@@ -14,14 +14,43 @@
  * limitations under the License.
  */
 
-import { ClusterLocatorMethod, CustomResource } from './src/types';
-
 export interface Config {
   kubernetes?: {
     serviceLocatorMethod: {
       type: 'multiTenant';
     };
-    clusterLocatorMethods: ClusterLocatorMethod[];
-    customResources?: CustomResource[];
+    clusterLocatorMethods: Array<
+      | {
+          /** @visibility frontend */
+          type: 'gke';
+          /** @visibility frontend */
+          projectId: string;
+          /** @visibility frontend */
+          region?: string;
+          /** @visibility frontend */
+          skipTLSVerify?: boolean;
+        }
+      | {
+          /** @visibility frontend */
+          type: 'config';
+          clusters: Array<{
+            /** @visibility frontend */
+            url: string;
+            /** @visibility frontend */
+            name: string;
+            /** @visibility secret  */
+            serviceAccountToken?: string;
+            /** @visibility frontend */
+            authProvider: 'aws' | 'google' | 'serviceAccount';
+            /** @visibility frontend */
+            skipTLSVerify?: boolean;
+          }>;
+        }
+    >;
+    customResources?: Array<{
+      group: string;
+      apiVersion: string;
+      plural: string;
+    }>;
   };
 }

plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.test.ts

@@ -106,6 +106,7 @@ describe('GkeClusterLocator', () => {
           authProvider: 'google',
           name: 'some-cluster',
           url: 'https://1.2.3.4',
+          skipTLSVerify: false,
         },
       ]);
       expect(mockedListClusters).toBeCalledTimes(1);
@@ -141,6 +142,7 @@ describe('GkeClusterLocator', () => {
           authProvider: 'google',
           name: 'some-cluster',
           url: 'https://1.2.3.4',
+          skipTLSVerify: false,
         },
       ]);
       expect(mockedListClusters).toBeCalledTimes(1);
@@ -181,11 +183,13 @@ describe('GkeClusterLocator', () => {
           authProvider: 'google',
           name: 'some-cluster',
           url: 'https://1.2.3.4',
+          skipTLSVerify: false,
         },
         {
           authProvider: 'google',
           name: 'some-other-cluster',
           url: 'https://6.7.8.9',
+          skipTLSVerify: false,
         },
       ]);
       expect(mockedListClusters).toBeCalledTimes(1);

plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts

@@ -18,28 +18,28 @@ import { Config } from '@backstage/config';
 import * as container from '@google-cloud/container';
 import { ClusterDetails, KubernetesClustersSupplier } from '../types/types';
 
-export class GkeClusterLocator implements KubernetesClustersSupplier {
-  private readonly projectId: string;
-  private readonly region: string | undefined;
-  private readonly client: container.v1.ClusterManagerClient;
+type GkeClusterLocatorOptions = {
+  projectId: string;
+  region?: string;
+  skipTLSVerify?: boolean;
+};
 
+export class GkeClusterLocator implements KubernetesClustersSupplier {
   constructor(
-    projectId: string,
-    client: container.v1.ClusterManagerClient,
-    region?: string,
-  ) {
-    this.projectId = projectId;
-    this.region = region;
-    this.client = client;
-  }
+    private readonly options: GkeClusterLocatorOptions,
+    private readonly client: container.v1.ClusterManagerClient,
+  ) {}
 
   static fromConfigWithClient(
     config: Config,
     client: container.v1.ClusterManagerClient,
   ): GkeClusterLocator {
-    const projectId = config.getString('projectId');
-    const region = config.getOptionalString('region');
-    return new GkeClusterLocator(projectId, client, region);
+    const options = {
+      projectId: config.getString('projectId'),
+      region: config.getOptionalString('region') ?? '-',
+      skipTLSVerify: config.getOptionalBoolean('skipTLSVerify') ?? false,
+    };
+    return new GkeClusterLocator(options, client);
   }
 
   static fromConfig(config: Config): GkeClusterLocator {
@@ -50,9 +50,9 @@ export class GkeClusterLocator implements KubernetesClustersSupplier {
   }
 
   async getClusters(): Promise<ClusterDetails[]> {
-    const region = this.region ?? '-';
+    const { projectId, region, skipTLSVerify } = this.options;
     const request = {
-      parent: `projects/${this.projectId}/locations/${region}`,
+      parent: `projects/${projectId}/locations/${region}`,
     };
 
     try {
@@ -62,10 +62,11 @@ export class GkeClusterLocator implements KubernetesClustersSupplier {
         name: r.name ?? 'unknown',
         url: `https://${r.endpoint ?? ''}`,
         authProvider: 'google',
+        skipTLSVerify,
       }));
     } catch (e) {
       throw new Error(
-        `There was an error retrieving clusters from GKE for projectId=${this.projectId} region=${region} : [${e.message}]`,
+        `There was an error retrieving clusters from GKE for projectId=${projectId} region=${region} : [${e.message}]`,
       );
     }
   }

plugins/kubernetes-backend/src/types/types.ts

@@ -19,50 +19,6 @@ import type {
   KubernetesFetchError,
 } from '@backstage/plugin-kubernetes-common';
 
-export type ClusterLocatorMethod =
-  | ConfigClusterLocatorMethod
-  | GKEClusterLocatorMethod;
-
-export interface ConfigClusterLocatorMethod {
-  /**
-   * @visibility frontend
-   */
-  type: 'config';
-  clusters: {
-    /**
-     * @visibility frontend
-     */
-    url: string;
-    /**
-     * @visibility frontend
-     */
-    name: string;
-    /**
-     * @visibility secret
-     */
-    serviceAccountToken: string | undefined;
-    /**
-     * @visibility frontend
-     */
-    authProvider: 'aws' | 'google' | 'serviceAccount';
-  }[];
-}
-
-export interface GKEClusterLocatorMethod {
-  /**
-   * @visibility frontend
-   */
-  type: 'gke';
-  /**
-   * @visibility frontend
-   */
-  projectId: string;
-  /**
-   * @visibility frontend
-   */
-  region?: string;
-}
-
 export interface CustomResource {
   group: string;
   apiVersion: string;