Merge pull request #6747 from RoadieHQ/allow-external-id

add ability to specify an external id for assumed role for k8

plugins/kubernetes-backend/api-report.md

@@ -16,6 +16,8 @@ import { Logger as Logger_2 } from 'winston';
 export interface AWSClusterDetails extends ClusterDetails {
   // (undocumented)
   assumeRole?: string;
+  // (undocumented)
+  externalId?: string;
 }
 
 // Warning: (ae-missing-release-tag) "ClusterDetails" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)

plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts

@@ -55,7 +55,10 @@ export class AwsIamKubernetesAuthTranslator
     });
   };
 
-  async getCredentials(assumeRole: string | undefined): Promise<SigningCreds> {
+  async getCredentials(
+    assumeRole?: string,
+    externalId?: string,
+  ): Promise<SigningCreds> {
     return new Promise<SigningCreds>(async (resolve, reject) => {
       const awsCreds = await this.awsGetCredentials();
 
@@ -73,10 +76,12 @@ export class AwsIamKubernetesAuthTranslator
       if (!assumeRole) return resolve(creds);
 
       try {
-        const params = {
+        const params: AWS.STS.Types.AssumeRoleRequest = {
           RoleArn: assumeRole,
           RoleSessionName: 'backstage-login',
         };
+        if (externalId) params.ExternalId = externalId;
+
         const assumedRole = await new AWS.STS().assumeRole(params).promise();
 
         if (!assumedRole.Credentials) {
@@ -97,9 +102,10 @@ export class AwsIamKubernetesAuthTranslator
   }
   async getBearerToken(
     clusterName: string,
-    assumeRole: string | undefined,
+    assumeRole?: string,
+    externalId?: string,
   ): Promise<string> {
-    const credentials = await this.getCredentials(assumeRole);
+    const credentials = await this.getCredentials(assumeRole, externalId);
 
     const request = {
       host: `sts.amazonaws.com`,
@@ -132,6 +138,7 @@ export class AwsIamKubernetesAuthTranslator
     clusterDetailsWithAuthToken.serviceAccountToken = await this.getBearerToken(
       clusterDetails.name,
       clusterDetails.assumeRole,
+      clusterDetails.externalId,
     );
     return clusterDetailsWithAuthToken;
   }

plugins/kubernetes-backend/src/types/types.ts

@@ -86,4 +86,5 @@ export interface GKEClusterDetails extends ClusterDetails {}
 export interface ServiceAccountClusterDetails extends ClusterDetails {}
 export interface AWSClusterDetails extends ClusterDetails {
   assumeRole?: string;
+  externalId?: string;
 }