paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

Merge pull request #32010 from backstage/techdocs-integrations-support

Browse Source
This commit is contained in:
Fredrik Adelöw
2026-01-16 20:29:26 +01:00
committed by GitHub
parent 2e7855c6de bd096c93b1
commit b3a36948b0
4 changed files with 361 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/techdocs-node/src/stages/publish/awsS3.test.ts
+211 -6
View File
@@ -280,25 +280,230 @@ describe('AwsS3Publish', () => {
expect(getCredProviderMock).toHaveBeenCalledTimes(1);
});
it('should fall back to deprecated method of retrieving credentials', async () => {
it('should use aws.accounts over integrations.awsS3 if both are provided', async () => {
await jest.isolateModulesAsync(async () => {
jest.doMock('@aws-sdk/client-s3', () => ({
...jest.requireActual('@aws-sdk/client-s3'),
S3Client: jest.fn(),
}));
const { S3Client: MockS3Client } = require('@aws-sdk/client-s3');
const { AwsS3Publish: IsolatedAwsS3Publish } = require('./awsS3');
const mockConfig = new ConfigReader({
techdocs: {
publisher: {
type: 'awsS3',
awsS3: {
accountId: '111111111111',
bucketName: 'bucketName',
bucketRootPath: '/',
},
},
},
integrations: {
awsS3: [
{
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
},
],
},
aws: {
accounts: [
{
accountId: '111111111111',
accessKeyId: 'access-key-from-aws',
secretAccessKey: 'secret-access-key-from-aws',
},
],
},
});
await IsolatedAwsS3Publish.fromConfig(mockConfig, logger);
expect(getCredProviderMock).toHaveBeenCalledTimes(0);
expect(MockS3Client).toHaveBeenCalledTimes(1);
await expect(
MockS3Client.mock.calls[0][0]!.credentialDefaultProvider!(
undefined!,
)(),
).resolves.toEqual({
accessKeyId: 'access-key-from-aws',
secretAccessKey: 'secret-access-key-from-aws',
});
});
});
it('should use awsS3.credentials if they are provided', async () => {
await jest.isolateModulesAsync(async () => {
jest.doMock('@aws-sdk/client-s3', () => ({
...jest.requireActual('@aws-sdk/client-s3'),
S3Client: jest.fn(),
}));
const { S3Client: MockS3Client } = require('@aws-sdk/client-s3');
const { AwsS3Publish: IsolatedAwsS3Publish } = require('./awsS3');
const mockConfig = new ConfigReader({
techdocs: {
publisher: {
type: 'awsS3',
awsS3: {
credentials: {
accessKeyId: 'accessKeyId',
secretAccessKey: 'secretAccessKey',
},
bucketName: 'bucketName',
bucketRootPath: '/',
},
},
},
integrations: {
awsS3: [
{
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
},
],
},
});
await IsolatedAwsS3Publish.fromConfig(mockConfig, logger);
expect(getCredProviderMock).toHaveBeenCalledTimes(0);
expect(MockS3Client).toHaveBeenCalledTimes(1);
await expect(
MockS3Client.mock.calls[0][0]!.credentialDefaultProvider!(
undefined!,
)(),
).resolves.toEqual({
accessKeyId: 'accessKeyId',
secretAccessKey: 'secretAccessKey',
});
});
});
it('should use credentials from integrations if awsS3.credentials is not provided', async () => {
await jest.isolateModulesAsync(async () => {
jest.doMock('@aws-sdk/client-s3', () => ({
...jest.requireActual('@aws-sdk/client-s3'),
S3Client: jest.fn(),
}));
const { S3Client: MockS3Client } = require('@aws-sdk/client-s3');
const { AwsS3Publish: IsolatedAwsS3Publish } = require('./awsS3');
const mockConfig = new ConfigReader({
techdocs: {
publisher: {
type: 'awsS3',
awsS3: {
credentials: {},
bucketName: 'bucketName',
bucketRootPath: '/',
},
},
},
integrations: {
awsS3: [
{
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
},
],
},
});
await IsolatedAwsS3Publish.fromConfig(mockConfig, logger);
expect(getCredProviderMock).toHaveBeenCalledTimes(0);
expect(MockS3Client).toHaveBeenCalledTimes(1);
await expect(
MockS3Client.mock.calls[0][0]!.credentialDefaultProvider!(
undefined!,
)(),
).resolves.toEqual({
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
});
});
});
it('should retrieve default credentials if multiple integrations are present', async () => {
const mockConfig = new ConfigReader({
techdocs: {
publisher: {
type: 'awsS3',
awsS3: {
credentials: {
accessKeyId: 'accessKeyId',
secretAccessKey: 'secretAccessKey',
},
credentials: {},
bucketName: 'bucketName',
bucketRootPath: '/',
},
},
},
integrations: {
awsS3: [
{
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
},
{
accessKeyId: 'access-key-from-integrations-2',
secretAccessKey: 'secret-access-key-from-integrations-2',
},
],
},
});
await AwsS3Publish.fromConfig(mockConfig, logger);
expect(getCredProviderMock).toHaveBeenCalledTimes(0);
expect(getCredProviderMock).toHaveBeenCalledTimes(1);
});
it('should retrieve the target integration if multiple integrations are provided and credentials are not provided', async () => {
await jest.isolateModulesAsync(async () => {
jest.doMock('@aws-sdk/client-s3', () => ({
...jest.requireActual('@aws-sdk/client-s3'),
S3Client: jest.fn(),
}));
const { S3Client: MockS3Client } = require('@aws-sdk/client-s3');
const { AwsS3Publish: IsolatedAwsS3Publish } = require('./awsS3');
const mockConfig = new ConfigReader({
techdocs: {
publisher: {
type: 'awsS3',
awsS3: {
credentials: {
accessKeyId: 'access-key-from-integrations-2',
},
bucketName: 'bucketName',
bucketRootPath: '/',
},
},
},
integrations: {
awsS3: [
{
accessKeyId: 'access-key-from-integrations',
secretAccessKey: 'secret-access-key-from-integrations',
},
{
accessKeyId: 'access-key-from-integrations-2',
secretAccessKey: 'secret-access-key-from-integrations-2',
},
],
},
});
await IsolatedAwsS3Publish.fromConfig(mockConfig, logger);
expect(getCredProviderMock).toHaveBeenCalledTimes(0);
expect(MockS3Client).toHaveBeenCalledTimes(1);
await expect(
MockS3Client.mock.calls[0][0]!.credentialDefaultProvider!(
undefined!,
)(),
).resolves.toEqual({
accessKeyId: 'access-key-from-integrations-2',
secretAccessKey: 'secret-access-key-from-integrations-2',
});
});
});
});
plugins/techdocs-node/src/stages/publish/awsS3.ts
+86 -15
View File
@@ -67,6 +67,7 @@ import {
TechDocsMetadata,
} from './types';
import { LoggerService } from '@backstage/backend-plugin-api';
import { AwsS3Integration, ScmIntegrations } from '@backstage/integration';
const streamToBuffer = (stream: Readable): Promise<Buffer> => {
return new Promise((resolve, reject) => {
@@ -148,9 +149,16 @@ export class AwsS3Publish implements PublisherBase {
const credentialsConfig = config.getOptionalConfig(
'techdocs.publisher.awsS3.credentials',
);
const credsManager = DefaultAwsCredentialsManager.fromConfig(config);
const scmIntegrations = ScmIntegrations.fromConfig(config);
const awsS3Integrations = scmIntegrations.awsS3.list();
const sdkCredentialProvider = await AwsS3Publish.buildCredentials(
credsManager,
logger,
awsS3Integrations,
accountId,
credentialsConfig,
region,
@@ -227,8 +235,10 @@ export class AwsS3Publish implements PublisherBase {
private static async buildCredentials(
credsManager: AwsCredentialsManager,
logger: LoggerService,
awsS3Integrations: AwsS3Integration[],
accountId?: string,
config?: Config,
credentialsConfig?: Config,
region?: string,
): Promise<AwsCredentialIdentityProvider> {
// Pull credentials for the specified account ID from the 'aws' config section
@@ -237,21 +247,14 @@ export class AwsS3Publish implements PublisherBase {
.sdkCredentialProvider;
}
// Fall back to the default credential chain if neither account ID
// nor explicit credentials are provided
if (!config) {
return (await credsManager.getCredentialProvider()).sdkCredentialProvider;
}
const explicitCredentials = await AwsS3Publish.getExplicitCredentials({
credsManager,
credentialsConfig,
awsS3Integrations,
logger,
});
// Pull credentials from the techdocs config section (deprecated)
const accessKeyId = config.getOptionalString('accessKeyId');
const secretAccessKey = config.getOptionalString('secretAccessKey');
const explicitCredentials: AwsCredentialIdentityProvider =
accessKeyId && secretAccessKey
? AwsS3Publish.buildStaticCredentials(accessKeyId, secretAccessKey)
: (await credsManager.getCredentialProvider()).sdkCredentialProvider;
const roleArn = config.getOptionalString('roleArn');
const roleArn = credentialsConfig?.getOptionalString('roleArn');
if (roleArn) {
return fromTemporaryCredentials({
masterCredentials: explicitCredentials,
@@ -349,6 +352,74 @@ export class AwsS3Publish implements PublisherBase {
);
}
private static async getExplicitCredentials({
credentialsConfig,
awsS3Integrations,
credsManager,
logger,
}: {
credentialsConfig?: Config;
awsS3Integrations: AwsS3Integration[];
credsManager: AwsCredentialsManager;
logger: LoggerService;
}): Promise<AwsCredentialIdentityProvider> {
const accessKeyId = credentialsConfig?.getOptionalString('accessKeyId');
const secretAccessKey =
credentialsConfig?.getOptionalString('secretAccessKey');
if (accessKeyId && secretAccessKey) {
return AwsS3Publish.buildStaticCredentials(accessKeyId, secretAccessKey);
}
if (awsS3Integrations.length > 0) {
if (awsS3Integrations.length === 1) {
const singleAwsS3IntegrationConfig = awsS3Integrations[0].config;
const singleAwsS3IntegrationAccessKeyId =
singleAwsS3IntegrationConfig.accessKeyId;
const singleAwsS3IntegrationSecretAccessKey =
singleAwsS3IntegrationConfig.secretAccessKey;
if (
singleAwsS3IntegrationAccessKeyId &&
singleAwsS3IntegrationSecretAccessKey
) {
return AwsS3Publish.buildStaticCredentials(
singleAwsS3IntegrationAccessKeyId,
singleAwsS3IntegrationSecretAccessKey,
);
}
} else {
if (accessKeyId) {
const targetAwsS3IntegrationConfig = awsS3Integrations.find(
c => c.config.accessKeyId === accessKeyId,
);
if (!targetAwsS3IntegrationConfig) {
logger.warn(
`No AWS S3 integration config under integrations.awsS3 found for access key id ${accessKeyId}.`,
);
}
const targetAwsS3IntegrationAccessKeyId =
targetAwsS3IntegrationConfig?.config.accessKeyId;
const targetAwsS3IntegrationSecretAccessKey =
targetAwsS3IntegrationConfig?.config.secretAccessKey;
if (
targetAwsS3IntegrationAccessKeyId &&
targetAwsS3IntegrationSecretAccessKey
) {
return AwsS3Publish.buildStaticCredentials(
targetAwsS3IntegrationAccessKeyId,
targetAwsS3IntegrationSecretAccessKey,
);
}
}
}
}
return (await credsManager.getCredentialProvider()).sdkCredentialProvider;
}
/**
* Check if the defined bucket exists. Being able to connect means the configuration is good
* and the storage client will work.