diff --git a/.changeset/wild-moles-care.md b/.changeset/wild-moles-care.md new file mode 100644 index 0000000000..35b886c2c1 --- /dev/null +++ b/.changeset/wild-moles-care.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes-backend': patch +--- + +Add possibility to configure TLS verification for `gke` type clusters diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 5dbad9cf4a..45ef28ea2f 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -33,6 +33,7 @@ kubernetes: - type: 'gke' projectId: 'gke-clusters' region: 'europe-west1' + skipTLSVerify: true ``` ### `serviceLocatorMethod` @@ -129,6 +130,11 @@ The Google Cloud project to look for Kubernetes clusters in. The Google Cloud region to look for Kubernetes clusters in. Defaults to all regions. +##### `skipTLSVerify` + +This determines whether or not the Kubernetes client verifies the TLS +certificate presented by the API server. Defaults to `false`. + ### `customResources` (optional) Configures which [custom resources][3] to look for when returning an entity's diff --git a/plugins/kubernetes-backend/schema.d.ts b/plugins/kubernetes-backend/schema.d.ts index fa5bc52abf..71dbace6c7 100644 --- a/plugins/kubernetes-backend/schema.d.ts +++ b/plugins/kubernetes-backend/schema.d.ts @@ -14,14 +14,43 @@ * limitations under the License. */ -import { ClusterLocatorMethod, CustomResource } from './src/types'; - export interface Config { kubernetes?: { serviceLocatorMethod: { type: 'multiTenant'; }; - clusterLocatorMethods: ClusterLocatorMethod[]; - customResources?: CustomResource[]; + clusterLocatorMethods: Array< + | { + /** @visibility frontend */ + type: 'gke'; + /** @visibility frontend */ + projectId: string; + /** @visibility frontend */ + region?: string; + /** @visibility frontend */ + skipTLSVerify?: boolean; + } + | { + /** @visibility frontend */ + type: 'config'; + clusters: Array<{ + /** @visibility frontend */ + url: string; + /** @visibility frontend */ + name: string; + /** @visibility secret */ + serviceAccountToken?: string; + /** @visibility frontend */ + authProvider: 'aws' | 'google' | 'serviceAccount'; + /** @visibility frontend */ + skipTLSVerify?: boolean; + }>; + } + >; + customResources?: Array<{ + group: string; + apiVersion: string; + plural: string; + }>; }; } diff --git a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.test.ts index cf555bd8c9..f45368479c 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.test.ts @@ -106,6 +106,7 @@ describe('GkeClusterLocator', () => { authProvider: 'google', name: 'some-cluster', url: 'https://1.2.3.4', + skipTLSVerify: false, }, ]); expect(mockedListClusters).toBeCalledTimes(1); @@ -141,6 +142,7 @@ describe('GkeClusterLocator', () => { authProvider: 'google', name: 'some-cluster', url: 'https://1.2.3.4', + skipTLSVerify: false, }, ]); expect(mockedListClusters).toBeCalledTimes(1); @@ -181,11 +183,13 @@ describe('GkeClusterLocator', () => { authProvider: 'google', name: 'some-cluster', url: 'https://1.2.3.4', + skipTLSVerify: false, }, { authProvider: 'google', name: 'some-other-cluster', url: 'https://6.7.8.9', + skipTLSVerify: false, }, ]); expect(mockedListClusters).toBeCalledTimes(1); diff --git a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts index 7bfd62ef8d..b2bdc3bca8 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts @@ -18,28 +18,28 @@ import { Config } from '@backstage/config'; import * as container from '@google-cloud/container'; import { ClusterDetails, KubernetesClustersSupplier } from '../types/types'; -export class GkeClusterLocator implements KubernetesClustersSupplier { - private readonly projectId: string; - private readonly region: string | undefined; - private readonly client: container.v1.ClusterManagerClient; +type GkeClusterLocatorOptions = { + projectId: string; + region?: string; + skipTLSVerify?: boolean; +}; +export class GkeClusterLocator implements KubernetesClustersSupplier { constructor( - projectId: string, - client: container.v1.ClusterManagerClient, - region?: string, - ) { - this.projectId = projectId; - this.region = region; - this.client = client; - } + private readonly options: GkeClusterLocatorOptions, + private readonly client: container.v1.ClusterManagerClient, + ) {} static fromConfigWithClient( config: Config, client: container.v1.ClusterManagerClient, ): GkeClusterLocator { - const projectId = config.getString('projectId'); - const region = config.getOptionalString('region'); - return new GkeClusterLocator(projectId, client, region); + const options = { + projectId: config.getString('projectId'), + region: config.getOptionalString('region') ?? '-', + skipTLSVerify: config.getOptionalBoolean('skipTLSVerify') ?? false, + }; + return new GkeClusterLocator(options, client); } static fromConfig(config: Config): GkeClusterLocator { @@ -50,9 +50,9 @@ export class GkeClusterLocator implements KubernetesClustersSupplier { } async getClusters(): Promise { - const region = this.region ?? '-'; + const { projectId, region, skipTLSVerify } = this.options; const request = { - parent: `projects/${this.projectId}/locations/${region}`, + parent: `projects/${projectId}/locations/${region}`, }; try { @@ -62,10 +62,11 @@ export class GkeClusterLocator implements KubernetesClustersSupplier { name: r.name ?? 'unknown', url: `https://${r.endpoint ?? ''}`, authProvider: 'google', + skipTLSVerify, })); } catch (e) { throw new Error( - `There was an error retrieving clusters from GKE for projectId=${this.projectId} region=${region} : [${e.message}]`, + `There was an error retrieving clusters from GKE for projectId=${projectId} region=${region} : [${e.message}]`, ); } } diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts index 0be0b447af..ae254dfdae 100644 --- a/plugins/kubernetes-backend/src/types/types.ts +++ b/plugins/kubernetes-backend/src/types/types.ts @@ -19,50 +19,6 @@ import type { KubernetesFetchError, } from '@backstage/plugin-kubernetes-common'; -export type ClusterLocatorMethod = - | ConfigClusterLocatorMethod - | GKEClusterLocatorMethod; - -export interface ConfigClusterLocatorMethod { - /** - * @visibility frontend - */ - type: 'config'; - clusters: { - /** - * @visibility frontend - */ - url: string; - /** - * @visibility frontend - */ - name: string; - /** - * @visibility secret - */ - serviceAccountToken: string | undefined; - /** - * @visibility frontend - */ - authProvider: 'aws' | 'google' | 'serviceAccount'; - }[]; -} - -export interface GKEClusterLocatorMethod { - /** - * @visibility frontend - */ - type: 'gke'; - /** - * @visibility frontend - */ - projectId: string; - /** - * @visibility frontend - */ - region?: string; -} - export interface CustomResource { group: string; apiVersion: string;