From 6d615e781c4c428939668e1f98e7d9427488f189 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9s=20Mauricio=20G=C3=B3mez=20P?= Date: Tue, 9 Jan 2024 08:59:59 -0500 Subject: [PATCH] Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Jamie Klassen Signed-off-by: Andrés Mauricio Gómez P Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts Co-authored-by: Jamie Klassen Signed-off-by: Andrés Mauricio Gómez P Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts Co-authored-by: Jamie Klassen Signed-off-by: Andrés Mauricio Gómez P Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts Co-authored-by: Jamie Klassen Signed-off-by: Andrés Mauricio Gómez P Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts Co-authored-by: Jamie Klassen Signed-off-by: Andrés Mauricio Gómez P Signed-off-by: Andres Mauricio Gomez P --- plugins/kubernetes-node/api-report.md | 15 +++-- .../src/auth/PinnipedHelper.test.ts | 28 ++++++--- .../src/auth/PinnipedHelper.ts | 60 +++++-------------- 3 files changed, 45 insertions(+), 58 deletions(-) diff --git a/plugins/kubernetes-node/api-report.md b/plugins/kubernetes-node/api-report.md index ede0d213f1..0521ed72aa 100644 --- a/plugins/kubernetes-node/api-report.md +++ b/plugins/kubernetes-node/api-report.md @@ -242,9 +242,7 @@ export type PinnipedClientCerts = { // @public (undocumented) export class PinnipedHelper { - constructor(logger: Logger, flavour?: 'pinniped' | 'pinniped-tmc'); - // (undocumented) - readonly flavour: 'pinniped' | 'pinniped-tmc'; + constructor(logger: Logger); // (undocumented) tokenCredentialRequest( clusterDetails: ClusterDetails_2, @@ -254,8 +252,15 @@ export class PinnipedHelper { // @public (undocumented) export type PinnipedParameters = { - clusterIdToken: string; - JWTAuthenticatorName: string; + clusterScopedIdToken: string; + authenticator: { + apiGroup: string; + kind: string; + name: string; + }; + tokenCredentialRequest?: { + apiGroup?: string; + }; }; // @public (undocumented) diff --git a/plugins/kubernetes-node/src/auth/PinnipedHelper.test.ts b/plugins/kubernetes-node/src/auth/PinnipedHelper.test.ts index a112be26d3..3cb25d7934 100644 --- a/plugins/kubernetes-node/src/auth/PinnipedHelper.test.ts +++ b/plugins/kubernetes-node/src/auth/PinnipedHelper.test.ts @@ -117,10 +117,14 @@ describe('Pinniped - tokenCredentialRequest', () => { ) => { const pinnipedHelper = new PinnipedHelper(logger); const pinnipedParams: PinnipedParameters = { - clusterIdToken: + clusterScopedIdToken: ((authConfig.pinniped as JsonObject) ?.clusteridtoken as string) || '', - JWTAuthenticatorName: 'supervisor', + authenticator: { + apiGroup: 'authentication.concierge.pinniped.dev', + kind: 'JWTAuthenticator', + name: 'supervisor', + }, }; const clientCerts = await pinnipedHelper.tokenCredentialRequest( @@ -134,6 +138,7 @@ describe('Pinniped - tokenCredentialRequest', () => { }; }, validateCluster: jest.fn().mockReturnValue([]), + presentAuthMetadata: jest.fn().mockReturnValue({}), }); }, }); @@ -281,15 +286,21 @@ describe('Pinniped - tokenCredentialRequest', () => { clusterDetails: ClusterDetails, authConfig: KubernetesRequestAuth, ) => { - const pinnipedHelper = new PinnipedHelper( - logger, - 'pinniped-tmc', - ); + const pinnipedHelper = new PinnipedHelper(logger); const pinnipedParams: PinnipedParameters = { - clusterIdToken: + clusterScopedIdToken: ((authConfig.pinniped as JsonObject) ?.clusteridtoken as string) || '', - JWTAuthenticatorName: 'supervisor', + authenticator: { + apiGroup: + 'authentication.concierge.pinniped.tmc.cloud.vmware.com', + kind: 'WebhookAuthenticator', + name: 'supervisor', + }, + tokenCredentialRequest: { + apiGroup: + 'login.concierge.pinniped.tmc.cloud.vmware.com/v1alpha1', + }, }; const clientCerts = await pinnipedHelper.tokenCredentialRequest( @@ -303,6 +314,7 @@ describe('Pinniped - tokenCredentialRequest', () => { }; }, validateCluster: jest.fn().mockReturnValue([]), + presentAuthMetadata: jest.fn().mockReturnValue({}), }); }, }); diff --git a/plugins/kubernetes-node/src/auth/PinnipedHelper.ts b/plugins/kubernetes-node/src/auth/PinnipedHelper.ts index ce48927ad9..1f824bae33 100644 --- a/plugins/kubernetes-node/src/auth/PinnipedHelper.ts +++ b/plugins/kubernetes-node/src/auth/PinnipedHelper.ts @@ -35,16 +35,15 @@ export type PinnipedClientCerts = { * @public */ export type PinnipedParameters = { - clusterIdToken: string; - JWTAuthenticatorName: string; -}; - -type ApiResourcePinniped = { + clusterScopedIdToken: string; authenticator: { apiGroup: string; kind: string; + name: string; + }; + tokenCredentialRequest?: { + apiGroup?: string; }; - apiVersion: string; }; /** @@ -52,14 +51,7 @@ type ApiResourcePinniped = { * @public */ export class PinnipedHelper { - readonly flavour: 'pinniped' | 'pinniped-tmc'; - - constructor( - private readonly logger: Logger, - flavour: 'pinniped' | 'pinniped-tmc' = 'pinniped', - ) { - this.flavour = flavour; - } + constructor(private readonly logger: Logger) {} public async tokenCredentialRequest( clusterDetails: ClusterDetails, @@ -77,16 +69,16 @@ export class PinnipedHelper { pinnipedParams: PinnipedParameters, ): Promise { const url: URL = new URL(clusterDetails.url); - const apiResourcePinniped: ApiResourcePinniped = - this.getApiResourcePinniped(); + const apiGroup = + pinnipedParams.tokenCredentialRequest?.apiGroup ?? + 'login.concierge.pinniped.dev/v1alpha1'; - url.pathname = `/apis/${apiResourcePinniped.apiVersion}/tokencredentialrequests`; + url.pathname = `/apis/${apiGroup}/tokencredentialrequests`; const requestInit: RequestInit = this.buildRequestForPinniped( url, clusterDetails, pinnipedParams, - apiResourcePinniped, ); this.logger.info( @@ -119,18 +111,15 @@ export class PinnipedHelper { url: URL, clusterDetails: ClusterDetails, pinnipedParams: PinnipedParameters, - apiResourcePinniped: ApiResourcePinniped, ): RequestInit { const body = { - apiVersion: apiResourcePinniped.apiVersion, + apiVersion: + pinnipedParams.tokenCredentialRequest?.apiGroup ?? + 'login.concierge.pinniped.dev/v1alpha1', kind: 'TokenCredentialRequest', spec: { - authenticator: { - apiGroup: apiResourcePinniped.authenticator.apiGroup, - kind: apiResourcePinniped.authenticator.kind, - name: pinnipedParams.JWTAuthenticatorName, - }, - token: pinnipedParams.clusterIdToken, + authenticator: pinnipedParams.authenticator, + token: pinnipedParams.clusterScopedIdToken, }, }; const requestInit: RequestInit = { @@ -155,23 +144,4 @@ export class PinnipedHelper { return requestInit; } - - private getApiResourcePinniped(): ApiResourcePinniped { - if (this.flavour === 'pinniped') { - return { - authenticator: { - apiGroup: 'authentication.concierge.pinniped.dev', - kind: 'JWTAuthenticator', - }, - apiVersion: 'login.concierge.pinniped.dev/v1alpha1', - }; - } - return { - authenticator: { - apiGroup: 'authentication.concierge.pinniped.tmc.cloud.vmware.com', - kind: 'WebhookAuthenticator', - }, - apiVersion: 'login.concierge.pinniped.tmc.cloud.vmware.com/v1alpha1', - }; - } }