From 8cd1d9033dca3dd45c2fd1475b0bc9378ab054ad Mon Sep 17 00:00:00 2001 From: kim5566 <28945404+kim5566@users.noreply.github.com> Date: Thu, 20 Jan 2022 13:55:52 +1100 Subject: [PATCH 1/3] add new googleServiceAccount authProvider Signed-off-by: kim5566 <28945404+kim5566@users.noreply.github.com> --- docs/features/kubernetes/configuration.md | 11 ++--- .../cluster-locator/ConfigClusterLocator.ts | 3 ++ .../GoogleServiceAccountAuthProvider.ts | 42 +++++++++++++++++++ .../KubernetesAuthTranslatorGenerator.ts | 4 ++ .../GoogleServiceAccountAuthProvider.ts | 29 +++++++++++++ .../KubernetesAuthProviders.ts | 5 +++ 6 files changed, 89 insertions(+), 5 deletions(-) create mode 100644 plugins/kubernetes-backend/src/kubernetes-auth-translator/GoogleServiceAccountAuthProvider.ts create mode 100644 plugins/kubernetes/src/kubernetes-auth-provider/GoogleServiceAccountAuthProvider.ts diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 492cd86022..28e5b11006 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -81,11 +81,12 @@ array. Users will see this value in the Software Catalog Kubernetes plugin. This determines how the Kubernetes client authenticates with the Kubernetes cluster. Valid values are: -| Value | Description | -| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. | -| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | -| `aws` | This will use AWS credentials to access resources in EKS clusters | +| Value | Description | +| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. Otherwise it will use default kubeconfig file. | +| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | +| `aws` | This will use AWS credentials to access resources in EKS clusters | +| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters | ##### `clusters.\*.skipTLSVerify` diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts index d8436b6c24..1bde1226dd 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts @@ -64,6 +64,9 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier { case 'serviceAccount': { return clusterDetails; } + case 'googleServiceAccount': { + return clusterDetails; + } default: { throw new Error( `authProvider "${authProvider}" has no config associated with it`, diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/GoogleServiceAccountAuthProvider.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/GoogleServiceAccountAuthProvider.ts new file mode 100644 index 0000000000..e3e591065b --- /dev/null +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/GoogleServiceAccountAuthProvider.ts @@ -0,0 +1,42 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { KubernetesAuthTranslator } from './types'; +import { GKEClusterDetails } from '../types/types'; +import * as container from '@google-cloud/container'; + +export class GoogleServiceAccountAuthTranslator + implements KubernetesAuthTranslator +{ + async decorateClusterDetailsWithAuth( + clusterDetails: GKEClusterDetails, + ): Promise { + const clusterDetailsWithAuthToken: GKEClusterDetails = Object.assign( + {}, + clusterDetails, + ); + const client = new container.v1.ClusterManagerClient(); + const accessToken = await client.auth.getAccessToken(); + + if (accessToken) { + clusterDetailsWithAuthToken.serviceAccountToken = accessToken; + } else { + throw new Error( + 'Unable to obtain access token for the current Google Application Default Credentials', + ); + } + return clusterDetailsWithAuthToken; + } +} diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/KubernetesAuthTranslatorGenerator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/KubernetesAuthTranslatorGenerator.ts index 38ea04c9e1..337ae899dc 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/KubernetesAuthTranslatorGenerator.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/KubernetesAuthTranslatorGenerator.ts @@ -18,6 +18,7 @@ import { KubernetesAuthTranslator } from './types'; import { GoogleKubernetesAuthTranslator } from './GoogleKubernetesAuthTranslator'; import { ServiceAccountKubernetesAuthTranslator } from './ServiceAccountKubernetesAuthTranslator'; import { AwsIamKubernetesAuthTranslator } from './AwsIamKubernetesAuthTranslator'; +import { GoogleServiceAccountAuthTranslator } from './GoogleServiceAccountAuthProvider'; export class KubernetesAuthTranslatorGenerator { static getKubernetesAuthTranslatorInstance( @@ -33,6 +34,9 @@ export class KubernetesAuthTranslatorGenerator { case 'serviceAccount': { return new ServiceAccountKubernetesAuthTranslator(); } + case 'googleServiceAccount': { + return new GoogleServiceAccountAuthTranslator(); + } default: { throw new Error( `authProvider "${authProvider}" has no KubernetesAuthTranslator associated with it`, diff --git a/plugins/kubernetes/src/kubernetes-auth-provider/GoogleServiceAccountAuthProvider.ts b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleServiceAccountAuthProvider.ts new file mode 100644 index 0000000000..9f522bea64 --- /dev/null +++ b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleServiceAccountAuthProvider.ts @@ -0,0 +1,29 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { KubernetesAuthProvider } from './types'; +import { KubernetesRequestBody } from '@backstage/plugin-kubernetes-common'; + +export class GoogleServiceAccountAuthProvider + implements KubernetesAuthProvider +{ + async decorateRequestBodyForAuth( + requestBody: KubernetesRequestBody, + ): Promise { + // No-op, with google service account auth, server's AWS credentials are used for access + return requestBody; + } +} diff --git a/plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts b/plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts index dfe0d746d1..be6712f103 100644 --- a/plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts +++ b/plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts @@ -20,6 +20,7 @@ import { GoogleKubernetesAuthProvider } from './GoogleKubernetesAuthProvider'; import { ServiceAccountKubernetesAuthProvider } from './ServiceAccountKubernetesAuthProvider'; import { AwsKubernetesAuthProvider } from './AwsKubernetesAuthProvider'; import { OAuthApi } from '@backstage/core-plugin-api'; +import { GoogleServiceAccountAuthProvider } from './GoogleServiceAccountAuthProvider'; export class KubernetesAuthProviders implements KubernetesAuthProvidersApi { private readonly kubernetesAuthProviderMap: Map< @@ -37,6 +38,10 @@ export class KubernetesAuthProviders implements KubernetesAuthProvidersApi { 'serviceAccount', new ServiceAccountKubernetesAuthProvider(), ); + this.kubernetesAuthProviderMap.set( + 'googleServiceAccount', + new GoogleServiceAccountAuthProvider(), + ); this.kubernetesAuthProviderMap.set('aws', new AwsKubernetesAuthProvider()); } From edbd626d0a4222f18ab969512a6c70071ae0e3ee Mon Sep 17 00:00:00 2001 From: kim5566 <28945404+kim5566@users.noreply.github.com> Date: Thu, 20 Jan 2022 13:58:21 +1100 Subject: [PATCH 2/3] add changeset Signed-off-by: kim5566 <28945404+kim5566@users.noreply.github.com> --- .changeset/bright-eyes-carry.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .changeset/bright-eyes-carry.md diff --git a/.changeset/bright-eyes-carry.md b/.changeset/bright-eyes-carry.md new file mode 100644 index 0000000000..8792d1b618 --- /dev/null +++ b/.changeset/bright-eyes-carry.md @@ -0,0 +1,6 @@ +--- +'@backstage/plugin-kubernetes': patch +'@backstage/plugin-kubernetes-backend': patch +--- + +add a new auth provider to support use GOOGLE_APPLICATION_CREDENTIALS From a56eb5242abe63a158facf0dafaccdee917bd0e7 Mon Sep 17 00:00:00 2001 From: kim5566 <28945404+kim5566@users.noreply.github.com> Date: Thu, 20 Jan 2022 14:07:03 +1100 Subject: [PATCH 3/3] update doc Signed-off-by: kim5566 <28945404+kim5566@users.noreply.github.com> --- docs/features/kubernetes/configuration.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 28e5b11006..59f7c3d389 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -81,12 +81,12 @@ array. Users will see this value in the Software Catalog Kubernetes plugin. This determines how the Kubernetes client authenticates with the Kubernetes cluster. Valid values are: -| Value | Description | -| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. Otherwise it will use default kubeconfig file. | -| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | -| `aws` | This will use AWS credentials to access resources in EKS clusters | -| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters | +| Value | Description | +| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. | +| `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | +| `aws` | This will use AWS credentials to access resources in EKS clusters | +| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters | ##### `clusters.\*.skipTLSVerify`