Revert kubernetes create and read permissions to singular proxy permission, reword changeset, add permission parameter to install doc

Signed-off-by: Ruben Vallejo <rvallejo@vmware.com>

.changeset/eleven-bats-tease.md

@@ -2,4 +2,4 @@
 '@backstage/plugin-kubernetes-backend': minor
 ---
 
-PermissionApi of type PermissionEvaluator must now be passed as a parameter when calling proxy.createRequestHandler() for the KubernetesProxyEndpoint. Kubernetes `/proxy` endpoint now requires two tokens in its header per request.The field `X-Kubernetes-Authentication` needs the value of a authentication authorities' bearer token.The field `Authorization` should contain a backstage identity token.
+`KubernetesBuilder.create` now requires a `permissions` field of type `PermissionEvaluator`. The kubernetes `/proxy` endpoint now requires two tokens: the `X-Kubernetes-Authorization` header should contain a bearer token for the target cluster, and the `Authorization` header should contain a backstage identity token.

docs/features/kubernetes/installation.md

@@ -75,6 +75,7 @@ export default async function createPlugin(
     logger: env.logger,
     config: env.config,
     catalogApi,
+    permissions: env.permissions,
   }).build();
   return router;
 }

plugins/kubernetes-backend/src/service/KubernetesProxy.ts

@@ -23,10 +23,7 @@ import {
   serializeError,
 } from '@backstage/errors';
 import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
-import {
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
-} from '@backstage/plugin-kubernetes-common';
+import { kubernetesProxyPermission } from '@backstage/plugin-kubernetes-common';
 import {
   PermissionEvaluator,
   AuthorizeResult,
@@ -76,10 +73,7 @@ export class KubernetesProxy {
 
       const authorizeResponse = (
         await permissionApi.authorize(
-          [
-            { permission: kubernetesProxyReadPermission },
-            { permission: kubernetesProxyCreatePermission },
-          ],
+          [{ permission: kubernetesProxyPermission }],
           {
             token,
           },

plugins/kubernetes-common/src/index.ts

@@ -23,7 +23,6 @@
 export * from './types';
 export * from './catalog-entity-constants';
 export {
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
+  kubernetesProxyPermission,
   kubernetesClusterPermissions,
 } from './permissions';

plugins/kubernetes-common/src/permissions.ts

@@ -16,27 +16,16 @@
 
 import { createPermission } from '@backstage/plugin-permission-common';
 
-/** This permission is used to authorize `read` actions that involve using the kubernetes Proxy Endpoint /proxy
+/** This permission is used to check access to the proxy endpoint
  * @alpha
  */
-export const kubernetesProxyReadPermission = createPermission({
-  name: 'kubernetes.proxy.read',
-  attributes: { action: 'read' },
-});
-
-/** This permission is used to authorize `create` actions that involve using the kubernetes Proxy Endpoint /proxy
- * @alpha
- */
-export const kubernetesProxyCreatePermission = createPermission({
-  name: 'kubernetes.proxy.create',
-  attributes: { action: 'create' },
+export const kubernetesProxyPermission = createPermission({
+  name: 'kubernetes.proxy',
+  attributes: {},
 });
 
 /**
  * List of all cluster permissions.
  * @alpha
  */
-export const kubernetesClusterPermissions = [
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
-];
+export const kubernetesClusterPermissions = [kubernetesProxyPermission];