From a3439ddac518216d5a42c98957329c428cebf020 Mon Sep 17 00:00:00 2001 From: Ruben Vallejo Date: Mon, 20 Mar 2023 11:55:39 -0400 Subject: [PATCH] update proxy docs Signed-off-by: Ruben Vallejo --- docs/features/kubernetes/proxy.md | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/docs/features/kubernetes/proxy.md b/docs/features/kubernetes/proxy.md index b53dfeb29d..7b6837dd7d 100644 --- a/docs/features/kubernetes/proxy.md +++ b/docs/features/kubernetes/proxy.md @@ -69,15 +69,9 @@ Overall, the only changes to each request are: - the endpoint's base URL prefix is stripped. - the `Backstage-Kubernetes-Authorization` header becomes the `Authorization` header that is used when forwarding the request. -## Authentication +The proxy expects a `KubernetesAuthTranslator` to be provided that is used to decorate all requests with `Auth` by default. It does this by supplying a `serviceAccountToken` field into `clusterDetails` using the defined `authProvider` in `clusterDetails`. -Until some security and permission decisions are made (see [this -conversation](https://github.com/backstage/backstage/pull/13026/files#r1029376939) -for context), contributors consuming the proxy endpoint in their plugin code are -responsible for negotiating their own bearer token out-of-band. This requires -knowing some auth details about the cluster being contacted -- in practice, only -clusters with [client side auth -providers](https://backstage.io/docs/features/kubernetes/authentication#client-side-providers) can reasonably be reached. +## Authentication The proxy has no provisions for mTLS, so it cannot be used to connect to clusters using the [x509 Client