paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts

Browse Source 
Co-authored-by: Jamie Klassen <jamie.klassen@broadcom.com>
Signed-off-by: Andrés Mauricio Gómez P <andmagom@outlook.com>

Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts

Co-authored-by: Jamie Klassen <jamie.klassen@broadcom.com>
Signed-off-by: Andrés Mauricio Gómez P <andmagom@outlook.com>

Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts

Co-authored-by: Jamie Klassen <jamie.klassen@broadcom.com>
Signed-off-by: Andrés Mauricio Gómez P <andmagom@outlook.com>

Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts

Co-authored-by: Jamie Klassen <jamie.klassen@broadcom.com>
Signed-off-by: Andrés Mauricio Gómez P <andmagom@outlook.com>

Update plugins/kubernetes-node/src/auth/PinnipedHelper.ts

Co-authored-by: Jamie Klassen <jamie.klassen@broadcom.com>
Signed-off-by: Andrés Mauricio Gómez P <andmagom@outlook.com>
Signed-off-by: Andres Mauricio Gomez P <andmagom@outlook.com>
This commit is contained in:
Andrés Mauricio Gómez P
2024-01-09 08:59:59 -05:00
committed by Andres Mauricio Gomez P
parent 6a4724db0c
commit 6d615e781c
3 changed files with 45 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/kubernetes-node/src/auth/PinnipedHelper.test.ts
+20 -8
View File
@@ -117,10 +117,14 @@ describe('Pinniped - tokenCredentialRequest', () => {
) => {
const pinnipedHelper = new PinnipedHelper(logger);
const pinnipedParams: PinnipedParameters = {
clusterIdToken:
clusterScopedIdToken:
((authConfig.pinniped as JsonObject)
?.clusteridtoken as string) || '',
JWTAuthenticatorName: 'supervisor',
authenticator: {
apiGroup: 'authentication.concierge.pinniped.dev',
kind: 'JWTAuthenticator',
name: 'supervisor',
},
};
const clientCerts =
await pinnipedHelper.tokenCredentialRequest(
@@ -134,6 +138,7 @@ describe('Pinniped - tokenCredentialRequest', () => {
};
},
validateCluster: jest.fn().mockReturnValue([]),
presentAuthMetadata: jest.fn().mockReturnValue({}),
});
},
});
@@ -281,15 +286,21 @@ describe('Pinniped - tokenCredentialRequest', () => {
clusterDetails: ClusterDetails,
authConfig: KubernetesRequestAuth,
) => {
const pinnipedHelper = new PinnipedHelper(
logger,
'pinniped-tmc',
);
const pinnipedHelper = new PinnipedHelper(logger);
const pinnipedParams: PinnipedParameters = {
clusterIdToken:
clusterScopedIdToken:
((authConfig.pinniped as JsonObject)
?.clusteridtoken as string) || '',
JWTAuthenticatorName: 'supervisor',
authenticator: {
apiGroup:
'authentication.concierge.pinniped.tmc.cloud.vmware.com',
kind: 'WebhookAuthenticator',
name: 'supervisor',
},
tokenCredentialRequest: {
apiGroup:
'login.concierge.pinniped.tmc.cloud.vmware.com/v1alpha1',
},
};
const clientCerts =
await pinnipedHelper.tokenCredentialRequest(
@@ -303,6 +314,7 @@ describe('Pinniped - tokenCredentialRequest', () => {
};
},
validateCluster: jest.fn().mockReturnValue([]),
presentAuthMetadata: jest.fn().mockReturnValue({}),
});
},
});
plugins/kubernetes-node/src/auth/PinnipedHelper.ts
+15 -45
View File
@@ -35,16 +35,15 @@ export type PinnipedClientCerts = {
* @public
*/
export type PinnipedParameters = {
clusterIdToken: string;
JWTAuthenticatorName: string;
};
type ApiResourcePinniped = {
clusterScopedIdToken: string;
authenticator: {
apiGroup: string;
kind: string;
name: string;
};
tokenCredentialRequest?: {
apiGroup?: string;
};
apiVersion: string;
};
/**
@@ -52,14 +51,7 @@ type ApiResourcePinniped = {
* @public
*/
export class PinnipedHelper {
readonly flavour: 'pinniped' | 'pinniped-tmc';
constructor(
private readonly logger: Logger,
flavour: 'pinniped' | 'pinniped-tmc' = 'pinniped',
) {
this.flavour = flavour;
}
constructor(private readonly logger: Logger) {}
public async tokenCredentialRequest(
clusterDetails: ClusterDetails,
@@ -77,16 +69,16 @@ export class PinnipedHelper {
pinnipedParams: PinnipedParameters,
): Promise<PinnipedClientCerts> {
const url: URL = new URL(clusterDetails.url);
const apiResourcePinniped: ApiResourcePinniped =
this.getApiResourcePinniped();
const apiGroup =
pinnipedParams.tokenCredentialRequest?.apiGroup ??
'login.concierge.pinniped.dev/v1alpha1';
url.pathname = `/apis/${apiResourcePinniped.apiVersion}/tokencredentialrequests`;
url.pathname = `/apis/${apiGroup}/tokencredentialrequests`;
const requestInit: RequestInit = this.buildRequestForPinniped(
url,
clusterDetails,
pinnipedParams,
apiResourcePinniped,
);
this.logger.info(
@@ -119,18 +111,15 @@ export class PinnipedHelper {
url: URL,
clusterDetails: ClusterDetails,
pinnipedParams: PinnipedParameters,
apiResourcePinniped: ApiResourcePinniped,
): RequestInit {
const body = {
apiVersion: apiResourcePinniped.apiVersion,
apiVersion:
pinnipedParams.tokenCredentialRequest?.apiGroup ??
'login.concierge.pinniped.dev/v1alpha1',
kind: 'TokenCredentialRequest',
spec: {
authenticator: {
apiGroup: apiResourcePinniped.authenticator.apiGroup,
kind: apiResourcePinniped.authenticator.kind,
name: pinnipedParams.JWTAuthenticatorName,
},
token: pinnipedParams.clusterIdToken,
authenticator: pinnipedParams.authenticator,
token: pinnipedParams.clusterScopedIdToken,
},
};
const requestInit: RequestInit = {
@@ -155,23 +144,4 @@ export class PinnipedHelper {
return requestInit;
}
private getApiResourcePinniped(): ApiResourcePinniped {
if (this.flavour === 'pinniped') {
return {
authenticator: {
apiGroup: 'authentication.concierge.pinniped.dev',
kind: 'JWTAuthenticator',
},
apiVersion: 'login.concierge.pinniped.dev/v1alpha1',
};
}
return {
authenticator: {
apiGroup: 'authentication.concierge.pinniped.tmc.cloud.vmware.com',
kind: 'WebhookAuthenticator',
},
apiVersion: 'login.concierge.pinniped.tmc.cloud.vmware.com/v1alpha1',
};
}
}