Merge pull request #7555 from dirathea/plugins-k8s-caData-support

Plugins k8s ca data support

.changeset/polite-eyes-punch.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+add caData support for kubernetes client config

docs/features/kubernetes/configuration.md

@@ -29,6 +29,7 @@ kubernetes:
           serviceAccountToken: ${K8S_MINIKUBE_TOKEN}
           dashboardUrl: http://127.0.0.1:64713 # url copied from running the command: minikube service kubernetes-dashboard -n kubernetes-dashboard
           dashboardApp: standard
+          caData: ${K8S_CONFIG_CA_DATA}
         - url: http://127.0.0.2:9999
           name: aws-cluster-1
           authProvider: 'aws'
@@ -135,6 +136,24 @@ See also
 https://github.com/backstage/backstage/tree/master/plugins/kubernetes/src/utils/clusterLinks/formatters
 for real examples.
 
+##### `clusters.\*.caData` (optional)
+
+PEM-encoded certificate authority certificates.
+
+This values could be obtained via inspecting the Kubernetes config file (usually
+at `~/.kube/config`) under `clusters.cluster.certificate-authority-data`. For
+GKE, execute the following command to obtain the value
+
+```
+gcloud container clusters describe <YOUR_CLUSTER_NAME> \
+    --zone=<YOUR_COMPUTE_ZONE> \
+    --format="value(masterAuth.clusterCaCertificate)"
+```
+
+See also
+https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#environments-without-gcloud
+for complete docs about GKE without `gcloud`.
+
 #### `gke`
 
 This cluster locator is designed to work with Kubernetes clusters running in

plugins/kubernetes-backend/api-report.md

@@ -27,6 +27,8 @@ export interface AWSClusterDetails extends ClusterDetails {
 export interface ClusterDetails {
   // (undocumented)
   authProvider: string;
+  // (undocumented)
+  caData?: string | undefined;
   dashboardApp?: string;
   dashboardUrl?: string;
   name: string;

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts

@@ -53,6 +53,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
     ]);
   });
@@ -89,6 +90,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         name: 'cluster2',
@@ -96,6 +98,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8081',
         authProvider: 'google',
         skipTLSVerify: true,
+        caData: undefined,
       },
     ]);
   });
@@ -141,6 +144,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'aws',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         assumeRole: 'SomeRole',
@@ -150,6 +154,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8081',
         authProvider: 'aws',
         skipTLSVerify: true,
+        caData: undefined,
       },
       {
         assumeRole: 'SomeRole',
@@ -159,6 +164,7 @@ describe('ConfigClusterLocator', () => {
         serviceAccountToken: undefined,
         authProvider: 'aws',
         skipTLSVerify: true,
+        caData: undefined,
       },
     ]);
   });

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts

@@ -35,6 +35,7 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier {
           url: c.getString('url'),
           serviceAccountToken: c.getOptionalString('serviceAccountToken'),
           skipTLSVerify: c.getOptionalBoolean('skipTLSVerify') ?? false,
+          caData: c.getOptionalString('caData'),
           authProvider: authProvider,
         };
         const dashboardUrl = c.getOptionalString('dashboardUrl');

plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts

@@ -50,6 +50,7 @@ export class GkeClusterLocator implements KubernetesClustersSupplier {
     );
   }
 
+  // TODO pass caData into the object
   async getClusters(): Promise<GKEClusterDetails[]> {
     const { projectId, region, skipTLSVerify } = this.options;
     const request = {

plugins/kubernetes-backend/src/cluster-locator/index.test.ts

@@ -54,6 +54,7 @@ describe('getCombinedClusterDetails', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         name: 'cluster2',
@@ -61,6 +62,7 @@ describe('getCombinedClusterDetails', () => {
         url: 'http://localhost:8081',
         authProvider: 'google',
         skipTLSVerify: false,
+        caData: undefined,
       },
     ]);
   });

plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts

@@ -31,6 +31,7 @@ export class KubernetesClientProvider {
       name: clusterDetails.name,
       server: clusterDetails.url,
       skipTLSVerify: clusterDetails.skipTLSVerify,
+      caData: clusterDetails.caData,
     };
 
     // TODO configure

plugins/kubernetes-backend/src/types/types.ts

@@ -91,6 +91,7 @@ export interface ClusterDetails {
   authProvider: string;
   serviceAccountToken?: string | undefined;
   skipTLSVerify?: boolean;
+  caData?: string | undefined;
   /**
    * Specifies the link to the Kubernetes dashboard managing this cluster.
    * @remarks