Merge pull request #14966 from cthtrifork/feature/vault-publicUrl

Added (optional) publicUrl to vault-backend plugin

.changeset/loud-snails-sleep.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-vault-backend': patch
+---
+
+Added (optional) config `vault.publicUrl` as alternative to `vault.baseUrl` for `editUrl` and `showUrl` in case `vault.baseUrl` is internal

plugins/vault-backend/README.md

@@ -63,7 +63,8 @@ To get started, first you need a running instance of Vault. You can follow [this
 
    ```yaml
    vault:
-     baseUrl: http://your-vault-url
+     baseUrl: http://your-internal-vault-url.svc
+     publicUrl: https://your-vault-url.example.com
      token: <VAULT_TOKEN>
      secretEngine: 'customSecretEngine' # Optional. By default it uses 'secrets'
      kvVersion: <kv-version> # Optional. The K/V version that your instance is using. The available options are '1' or '2'

plugins/vault-backend/config.d.ts

@@ -23,6 +23,12 @@ export interface Config {
      */
     baseUrl: string;
 
+    /**
+     * The publicUrl for your Vault instance (Optional).
+     * @visibility frontend
+     */
+    publicUrl?: string;
+
     /**
      * The token used by Backstage to access Vault.
      * @visibility secret

plugins/vault-backend/src/config/config.test.ts

@@ -40,6 +40,7 @@ describe('GetVaultConfig', () => {
     const vaultConfig = getVaultConfig(config);
     expect(vaultConfig).toStrictEqual({
       baseUrl: 'http://www.example.com',
+      publicUrl: undefined,
       token: '123',
       kvVersion: 2,
       secretEngine: 'secrets',
@@ -59,6 +60,7 @@ describe('GetVaultConfig', () => {
     const vaultConfig = getVaultConfig(config);
     expect(vaultConfig).toStrictEqual({
       baseUrl: 'http://www.example.com',
+      publicUrl: undefined,
       token: '123',
       kvVersion: 1,
       secretEngine: 'test',

plugins/vault-backend/src/config/config.ts

@@ -27,6 +27,11 @@ export interface VaultConfig {
    */
   baseUrl: string;
 
+  /**
+   * The publicUrl for your Vault instance (Optional).
+   */
+  publicUrl?: string;
+
   /**
    * The token used by Backstage to access Vault.
    */
@@ -53,6 +58,7 @@ export interface VaultConfig {
 export function getVaultConfig(config: Config): VaultConfig {
   return {
     baseUrl: config.getString('vault.baseUrl'),
+    publicUrl: config.getOptionalString('vault.publicUrl'),
     token: config.getString('vault.token'),
     kvVersion: config.getOptionalNumber('vault.kvVersion') ?? 2,
     secretEngine: config.getOptionalString('vault.secretEngine') ?? 'secrets',

plugins/vault-backend/src/service/vaultApi.ts

@@ -135,11 +135,13 @@ export class VaultClient implements VaultApi {
             )),
           );
         } else {
+          const vaultUrl =
+            this.vaultConfig.publicUrl || this.vaultConfig.baseUrl;
           secrets.push({
             name: secret,
             path: secretPath,
-            editUrl: `${this.vaultConfig.baseUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/edit/${secretPath}/${secret}`,
-            showUrl: `${this.vaultConfig.baseUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/show/${secretPath}/${secret}`,
+            editUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/edit/${secretPath}/${secret}`,
+            showUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/show/${secretPath}/${secret}`,
           });
         }
       }),