From 0058d2751773dcee4079947528a16dc587627560 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Mon, 29 Aug 2022 13:43:40 -0500 Subject: [PATCH 01/12] docs: Add section for Kuberentes plugin Auth Signed-off-by: Carlos Esteban Lopez --- .changeset/few-nails-search.md | 5 +++++ docs/features/kubernetes/authentication.md | 26 ++++++++++++++++++++++ docs/features/kubernetes/configuration.md | 3 +++ mkdocs.yml | 1 + 4 files changed, 35 insertions(+) create mode 100644 .changeset/few-nails-search.md create mode 100644 docs/features/kubernetes/authentication.md diff --git a/.changeset/few-nails-search.md b/.changeset/few-nails-search.md new file mode 100644 index 0000000000..048e29867f --- /dev/null +++ b/.changeset/few-nails-search.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes': patch +--- + +Add docs section for Kubernetes plugin Auth. diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md new file mode 100644 index 0000000000..c605e7479a --- /dev/null +++ b/docs/features/kubernetes/authentication.md @@ -0,0 +1,26 @@ +--- +id: kubernetes-auth +title: Kubernetes Authentication +description: Authentication in kubernetes plugin +--- + +The authentication process in kubernetes is basically separate from backstage auth, the +providers are configured so your kubernetes plugin can locate and access the clusters you +have access to, the providers currently available are categorized in server side auth and +client side auth, here's the list: + +## Server Side Providers + +These providers authenticate your application with the clusters, meaning anyone that is +logged in into your backstage app will be able to access the same clusters, the providers +available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure` +and `localKubectlProxy`. + +## Client Side Providers + +These providers authenticate your user with the cluster, each user will be requested for +credentials and will have access to the clusters as long as the user has been authorized +to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the +config, but the user hasn't been authorized to access, the user will see the cluster +listed but will not see any resources in the plugin page for that cluster, and the error +will show as `401` or similar, current providers available are `google` and `oidc`. diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 04a04304f9..adef82696a 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -110,6 +110,8 @@ cluster. Valid values are: | `azure` | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters | | `oidc` | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. | +Check the [Kubernetes Authentication][4] section for additional explanation. + ##### `clusters.\*.skipTLSVerify` This determines whether the Kubernetes client verifies the TLS certificate @@ -477,3 +479,4 @@ for more info. [1]: https://cloud.google.com/kubernetes-engine [2]: https://cloud.google.com/docs/authentication/production#linux-or-macos [3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ +[4]: https://https://backstage.io/docs/features/kubernetes/authentication diff --git a/mkdocs.yml b/mkdocs.yml index e3bd86afdb..c9ad457634 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -55,6 +55,7 @@ nav: - Overview: 'features/kubernetes/index.md' - Installation: 'features/kubernetes/installation.md' - Configuration: 'features/kubernetes/configuration.md' + - Authentication: 'features/kubernetes/authentication.md' - Troubleshooting: 'features/kubernetes/troubleshooting.md' - Software Templates: - Overview: 'features/software-templates/index.md' From 97542dca4ba81a644e259649bc715e5f95f8791f Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 09:55:27 -0500 Subject: [PATCH 02/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index c605e7479a..279e722787 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -11,8 +11,8 @@ client side auth, here's the list: ## Server Side Providers -These providers authenticate your application with the clusters, meaning anyone that is -logged in into your backstage app will be able to access the same clusters, the providers +These providers authenticate your _application_ with the cluster, meaning anyone that is +logged in into your backstage app will be granted the same access to Kubernetes objects. The providers available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure` and `localKubectlProxy`. From 9b11c256617e899cb3cf78b4a487dab7212ccb6e Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 09:59:12 -0500 Subject: [PATCH 03/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 279e722787..29b43d0cd2 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -13,8 +13,12 @@ client side auth, here's the list: These providers authenticate your _application_ with the cluster, meaning anyone that is logged in into your backstage app will be granted the same access to Kubernetes objects. The providers -available as server side are `serviceAccount`, `googleServiceAccount`, `aws`, `azure` -and `localKubectlProxy`. +available as server side are: +* `aws` +* `azure` +* `googleServiceAccount` +* `localKubectlProxy` +* `serviceAccount` ## Client Side Providers From c0531dd10f9e20c04b74cc4a4796b285eb141e72 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Tue, 30 Aug 2022 10:10:27 -0500 Subject: [PATCH 04/12] docs: Remove changeset & docs changes Signed-off-by: Carlos Esteban Lopez --- .changeset/few-nails-search.md | 5 ----- docs/features/kubernetes/authentication.md | 23 +++++++++++++--------- 2 files changed, 14 insertions(+), 14 deletions(-) delete mode 100644 .changeset/few-nails-search.md diff --git a/.changeset/few-nails-search.md b/.changeset/few-nails-search.md deleted file mode 100644 index 048e29867f..0000000000 --- a/.changeset/few-nails-search.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@backstage/plugin-kubernetes': patch ---- - -Add docs section for Kubernetes plugin Auth. diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 29b43d0cd2..74edc1d7d2 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -7,18 +7,19 @@ description: Authentication in kubernetes plugin The authentication process in kubernetes is basically separate from backstage auth, the providers are configured so your kubernetes plugin can locate and access the clusters you have access to, the providers currently available are categorized in server side auth and -client side auth, here's the list: +client side auth. ## Server Side Providers These providers authenticate your _application_ with the cluster, meaning anyone that is -logged in into your backstage app will be granted the same access to Kubernetes objects. The providers -available as server side are: -* `aws` -* `azure` -* `googleServiceAccount` -* `localKubectlProxy` -* `serviceAccount` +logged in into your backstage app will be granted the same access to Kubernetes objects. +The providers available as server side are: + +- `aws` +- `azure` +- `googleServiceAccount` +- `localKubectlProxy` +- `serviceAccount` ## Client Side Providers @@ -27,4 +28,8 @@ credentials and will have access to the clusters as long as the user has been au to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the config, but the user hasn't been authorized to access, the user will see the cluster listed but will not see any resources in the plugin page for that cluster, and the error -will show as `401` or similar, current providers available are `google` and `oidc`. +will show as `401` or similar. +The providers available as client side are: + +- `google` +- `oidc` From 0823dd02033fa3e9fc0cdf2a5cfc2b4f3090fcfa Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 16:47:22 -0500 Subject: [PATCH 05/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 74edc1d7d2..cf3a71075a 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -1,7 +1,7 @@ --- id: kubernetes-auth title: Kubernetes Authentication -description: Authentication in kubernetes plugin +description: Authentication in Kubernetes plugin --- The authentication process in kubernetes is basically separate from backstage auth, the From b654a3d5be259e439400f7fa568641b8925836b2 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 16:48:25 -0500 Subject: [PATCH 06/12] docs: Update docs/features/kubernetes/configuration.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index adef82696a..0adbec6a82 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -479,4 +479,4 @@ for more info. [1]: https://cloud.google.com/kubernetes-engine [2]: https://cloud.google.com/docs/authentication/production#linux-or-macos [3]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ -[4]: https://https://backstage.io/docs/features/kubernetes/authentication +[4]: https://backstage.io/docs/features/kubernetes/authentication From 37d63608449f37bdeabe174204332f1c06fb9905 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 16:52:55 -0500 Subject: [PATCH 07/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index cf3a71075a..34ff2b69b4 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -1,5 +1,5 @@ --- -id: kubernetes-auth +id: authentication title: Kubernetes Authentication description: Authentication in Kubernetes plugin --- From 60a9f41b6e73e96a0c6f79634d32a89f088e2b9b Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 16:53:18 -0500 Subject: [PATCH 08/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 34ff2b69b4..543992a4ae 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -6,8 +6,8 @@ description: Authentication in Kubernetes plugin The authentication process in kubernetes is basically separate from backstage auth, the providers are configured so your kubernetes plugin can locate and access the clusters you -have access to, the providers currently available are categorized in server side auth and -client side auth. +have access to. The providers currently available are divided into server side and +client side. ## Server Side Providers From 638930fab2baa3e65a87feb4dd546c34ed7050a6 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Tue, 30 Aug 2022 17:10:35 -0500 Subject: [PATCH 09/12] docs: Add auth section to microsite's sidebar Signed-off-by: Carlos Esteban Lopez --- microsite/sidebars.json | 1 + 1 file changed, 1 insertion(+) diff --git a/microsite/sidebars.json b/microsite/sidebars.json index 04f5623c86..b488225ddc 100644 --- a/microsite/sidebars.json +++ b/microsite/sidebars.json @@ -81,6 +81,7 @@ "features/kubernetes/overview", "features/kubernetes/installation", "features/kubernetes/configuration", + "features/kubernetes/authentication", "features/kubernetes/troubleshooting" ] }, From ccb891fb861d9929b1ae8c471ccc6e99342066a1 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 17:11:57 -0500 Subject: [PATCH 10/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 543992a4ae..3bb3733109 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -23,7 +23,7 @@ The providers available as server side are: ## Client Side Providers -These providers authenticate your user with the cluster, each user will be requested for +These providers authenticate your _user_ with the cluster. Each Backstage user will be prompted for credentials and will have access to the clusters as long as the user has been authorized to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the config, but the user hasn't been authorized to access, the user will see the cluster From 4f7826376827b8b629b051bf1c6ac265f33df585 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Jaramillo Date: Tue, 30 Aug 2022 17:12:28 -0500 Subject: [PATCH 11/12] docs: Update docs/features/kubernetes/authentication.md Co-authored-by: Jamie Klassen Signed-off-by: Carlos Esteban Lopez Jaramillo --- docs/features/kubernetes/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 3bb3733109..71d0d7b758 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -25,7 +25,7 @@ The providers available as server side are: These providers authenticate your _user_ with the cluster. Each Backstage user will be prompted for credentials and will have access to the clusters as long as the user has been authorized -to access said cluster, if the cluster is listed in the `clusterLocatorMethods` in the +to access said cluster. If the cluster is listed in the `clusterLocatorMethods` in the config, but the user hasn't been authorized to access, the user will see the cluster listed but will not see any resources in the plugin page for that cluster, and the error will show as `401` or similar. From a0180e7889c1a6d593178051b5d0ce8c170bf689 Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 31 Aug 2022 11:01:14 -0500 Subject: [PATCH 12/12] docs: Improve authentication explanation for kubernetes plugin Signed-off-by: Carlos Esteban Lopez --- docs/features/kubernetes/authentication.md | 28 ++++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/docs/features/kubernetes/authentication.md b/docs/features/kubernetes/authentication.md index 71d0d7b758..7669d967ed 100644 --- a/docs/features/kubernetes/authentication.md +++ b/docs/features/kubernetes/authentication.md @@ -4,15 +4,22 @@ title: Kubernetes Authentication description: Authentication in Kubernetes plugin --- -The authentication process in kubernetes is basically separate from backstage auth, the -providers are configured so your kubernetes plugin can locate and access the clusters you -have access to. The providers currently available are divided into server side and -client side. +The authentication process in Kubernetes relies on `KubernetesAuthProviders`, which are +not the same as the application's auth providers, the default providers are defined in +`plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts`, you can +add custom providers there if needed. + +These providers are configured so your Kubernetes plugin can locate and access the +clusters you have access to, some of them have special requirements in the third party in +question, like Azure's Managed AAD subscription or Azure RBAC support active on the cluster. + +The providers currently available are divided into server side and client side. ## Server Side Providers These providers authenticate your _application_ with the cluster, meaning anyone that is logged in into your backstage app will be granted the same access to Kubernetes objects. + The providers available as server side are: - `aws` @@ -23,12 +30,13 @@ The providers available as server side are: ## Client Side Providers -These providers authenticate your _user_ with the cluster. Each Backstage user will be prompted for -credentials and will have access to the clusters as long as the user has been authorized -to access said cluster. If the cluster is listed in the `clusterLocatorMethods` in the -config, but the user hasn't been authorized to access, the user will see the cluster -listed but will not see any resources in the plugin page for that cluster, and the error -will show as `401` or similar. +These providers authenticate your _user_ with the cluster. Each Backstage user will be +prompted for credentials and will have access to the clusters as long as the user has been +authorized to access said cluster. If the cluster is listed in the `clusterLocatorMethods`, +but the user hasn't been authorized to access, the user will see the cluster listed but +will not see any resources in the plugin page for that cluster, and the error will show +as `401` or similar. + The providers available as client side are: - `google`