Merge pull request #9046 from kim5566/k8s/google-service-account-authprovider

Kubernetes plugin: Add a Google Service Account auth provider

.changeset/bright-eyes-carry.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-kubernetes': patch
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+add a new auth provider to support use GOOGLE_APPLICATION_CREDENTIALS

docs/features/kubernetes/configuration.md

@@ -81,11 +81,12 @@ array. Users will see this value in the Software Catalog Kubernetes plugin.
 This determines how the Kubernetes client authenticates with the Kubernetes
 cluster. Valid values are:
 
-| Value            | Description                                                                                                                                                                                                                       |
-| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. |
-| `google`         | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API.                                                                                             |
-| `aws`            | This will use AWS credentials to access resources in EKS clusters                                                                                                                                                                 |
+| Value                  | Description                                                                                                                                                                                                                       |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `serviceAccount`       | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. |
+| `google`               | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API.                                                                                             |
+| `aws`                  | This will use AWS credentials to access resources in EKS clusters                                                                                                                                                                 |
+| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters                                                                                                                                        |
 
 ##### `clusters.\*.skipTLSVerify`
 

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts

@@ -64,6 +64,9 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier {
           case 'serviceAccount': {
             return clusterDetails;
           }
+          case 'googleServiceAccount': {
+            return clusterDetails;
+          }
           default: {
             throw new Error(
               `authProvider "${authProvider}" has no config associated with it`,

plugins/kubernetes-backend/src/kubernetes-auth-translator/GoogleServiceAccountAuthProvider.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { KubernetesAuthTranslator } from './types';
+import { GKEClusterDetails } from '../types/types';
+import * as container from '@google-cloud/container';
+
+export class GoogleServiceAccountAuthTranslator
+  implements KubernetesAuthTranslator
+{
+  async decorateClusterDetailsWithAuth(
+    clusterDetails: GKEClusterDetails,
+  ): Promise<GKEClusterDetails> {
+    const clusterDetailsWithAuthToken: GKEClusterDetails = Object.assign(
+      {},
+      clusterDetails,
+    );
+    const client = new container.v1.ClusterManagerClient();
+    const accessToken = await client.auth.getAccessToken();
+
+    if (accessToken) {
+      clusterDetailsWithAuthToken.serviceAccountToken = accessToken;
+    } else {
+      throw new Error(
+        'Unable to obtain access token for the current Google Application Default Credentials',
+      );
+    }
+    return clusterDetailsWithAuthToken;
+  }
+}

plugins/kubernetes-backend/src/kubernetes-auth-translator/KubernetesAuthTranslatorGenerator.ts

@@ -18,6 +18,7 @@ import { KubernetesAuthTranslator } from './types';
 import { GoogleKubernetesAuthTranslator } from './GoogleKubernetesAuthTranslator';
 import { ServiceAccountKubernetesAuthTranslator } from './ServiceAccountKubernetesAuthTranslator';
 import { AwsIamKubernetesAuthTranslator } from './AwsIamKubernetesAuthTranslator';
+import { GoogleServiceAccountAuthTranslator } from './GoogleServiceAccountAuthProvider';
 
 export class KubernetesAuthTranslatorGenerator {
   static getKubernetesAuthTranslatorInstance(
@@ -33,6 +34,9 @@ export class KubernetesAuthTranslatorGenerator {
       case 'serviceAccount': {
         return new ServiceAccountKubernetesAuthTranslator();
       }
+      case 'googleServiceAccount': {
+        return new GoogleServiceAccountAuthTranslator();
+      }
       default: {
         throw new Error(
           `authProvider "${authProvider}" has no KubernetesAuthTranslator associated with it`,

plugins/kubernetes/src/kubernetes-auth-provider/GoogleServiceAccountAuthProvider.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { KubernetesAuthProvider } from './types';
+import { KubernetesRequestBody } from '@backstage/plugin-kubernetes-common';
+
+export class GoogleServiceAccountAuthProvider
+  implements KubernetesAuthProvider
+{
+  async decorateRequestBodyForAuth(
+    requestBody: KubernetesRequestBody,
+  ): Promise<KubernetesRequestBody> {
+    // No-op, with google service account auth, server's AWS credentials are used for access
+    return requestBody;
+  }
+}

plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts

@@ -20,6 +20,7 @@ import { GoogleKubernetesAuthProvider } from './GoogleKubernetesAuthProvider';
 import { ServiceAccountKubernetesAuthProvider } from './ServiceAccountKubernetesAuthProvider';
 import { AwsKubernetesAuthProvider } from './AwsKubernetesAuthProvider';
 import { OAuthApi } from '@backstage/core-plugin-api';
+import { GoogleServiceAccountAuthProvider } from './GoogleServiceAccountAuthProvider';
 
 export class KubernetesAuthProviders implements KubernetesAuthProvidersApi {
   private readonly kubernetesAuthProviderMap: Map<
@@ -37,6 +38,10 @@ export class KubernetesAuthProviders implements KubernetesAuthProvidersApi {
       'serviceAccount',
       new ServiceAccountKubernetesAuthProvider(),
     );
+    this.kubernetesAuthProviderMap.set(
+      'googleServiceAccount',
+      new GoogleServiceAccountAuthProvider(),
+    );
     this.kubernetesAuthProviderMap.set('aws', new AwsKubernetesAuthProvider());
   }