From bb8cea4a75bf350d03eb15eb072b85321e031954 Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Mon, 11 Oct 2021 21:51:01 +0700 Subject: [PATCH 1/7] Add `caData` support for kubernetes config Signed-off-by: Aldira Putra Raharja --- .../src/cluster-locator/ConfigClusterLocator.test.ts | 6 ++++++ .../src/cluster-locator/ConfigClusterLocator.ts | 1 + .../kubernetes-backend/src/cluster-locator/index.test.ts | 2 ++ .../src/service/KubernetesClientProvider.ts | 1 + plugins/kubernetes-backend/src/types/types.ts | 1 + 5 files changed, 11 insertions(+) diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts index 6d1506c4c7..62346ac6c3 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts @@ -53,6 +53,7 @@ describe('ConfigClusterLocator', () => { url: 'http://localhost:8080', authProvider: 'serviceAccount', skipTLSVerify: false, + caData: undefined, }, ]); }); @@ -89,6 +90,7 @@ describe('ConfigClusterLocator', () => { url: 'http://localhost:8080', authProvider: 'serviceAccount', skipTLSVerify: false, + caData: undefined, }, { name: 'cluster2', @@ -96,6 +98,7 @@ describe('ConfigClusterLocator', () => { url: 'http://localhost:8081', authProvider: 'google', skipTLSVerify: true, + caData: undefined, }, ]); }); @@ -141,6 +144,7 @@ describe('ConfigClusterLocator', () => { url: 'http://localhost:8080', authProvider: 'aws', skipTLSVerify: false, + caData: undefined, }, { assumeRole: 'SomeRole', @@ -150,6 +154,7 @@ describe('ConfigClusterLocator', () => { url: 'http://localhost:8081', authProvider: 'aws', skipTLSVerify: true, + caData: undefined, }, { assumeRole: 'SomeRole', @@ -159,6 +164,7 @@ describe('ConfigClusterLocator', () => { serviceAccountToken: undefined, authProvider: 'aws', skipTLSVerify: true, + caData: undefined, }, ]); }); diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts index 53d3a1d025..bb9dbfe13f 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts @@ -35,6 +35,7 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier { url: c.getString('url'), serviceAccountToken: c.getOptionalString('serviceAccountToken'), skipTLSVerify: c.getOptionalBoolean('skipTLSVerify') ?? false, + caData: c.getOptionalString('caData'), authProvider: authProvider, }; const dashboardUrl = c.getOptionalString('dashboardUrl'); diff --git a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts index 95be99a8a5..dde4dc1d93 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts @@ -54,6 +54,7 @@ describe('getCombinedClusterDetails', () => { url: 'http://localhost:8080', authProvider: 'serviceAccount', skipTLSVerify: false, + caData: undefined, }, { name: 'cluster2', @@ -61,6 +62,7 @@ describe('getCombinedClusterDetails', () => { url: 'http://localhost:8081', authProvider: 'google', skipTLSVerify: false, + caData: undefined, }, ]); }); diff --git a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts index 61b19854c2..4b2848508e 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts @@ -31,6 +31,7 @@ export class KubernetesClientProvider { name: clusterDetails.name, server: clusterDetails.url, skipTLSVerify: clusterDetails.skipTLSVerify, + caData: clusterDetails.caData, }; // TODO configure diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts index cff87f265a..0e78f64f01 100644 --- a/plugins/kubernetes-backend/src/types/types.ts +++ b/plugins/kubernetes-backend/src/types/types.ts @@ -88,6 +88,7 @@ export interface ClusterDetails { authProvider: string; serviceAccountToken?: string | undefined; skipTLSVerify?: boolean; + caData?: string | undefined; /** * Specifies the link to the Kubernetes dashboard managing this cluster. * @remarks From c57b075d18fd39aee83d30c914e3a9aabac0175e Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Mon, 11 Oct 2021 21:54:40 +0700 Subject: [PATCH 2/7] include changeset Signed-off-by: Aldira Putra Raharja --- .changeset/polite-eyes-punch.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/polite-eyes-punch.md diff --git a/.changeset/polite-eyes-punch.md b/.changeset/polite-eyes-punch.md new file mode 100644 index 0000000000..fed1116bb2 --- /dev/null +++ b/.changeset/polite-eyes-punch.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes-backend': patch +--- + +add caData support for kubernetes client config From 17fdd3aea4c1861381d78f527afd35a427540f9e Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Mon, 11 Oct 2021 22:05:04 +0700 Subject: [PATCH 3/7] Update docs regarding caData config Signed-off-by: Aldira Putra Raharja --- docs/features/kubernetes/configuration.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index f48faa202d..6c9bf43da4 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -29,6 +29,7 @@ kubernetes: serviceAccountToken: ${K8S_MINIKUBE_TOKEN} dashboardUrl: http://127.0.0.1:64713 # url copied from running the command: minikube service kubernetes-dashboard -n kubernetes-dashboard dashboardApp: standard + caData: ${K8S_CONFIG_CA_DATA} - url: http://127.0.0.2:9999 name: aws-cluster-1 authProvider: 'aws' @@ -135,6 +136,10 @@ See also https://github.com/backstage/backstage/tree/master/plugins/kubernetes/src/utils/clusterLinks/formatters for real examples. +##### `clusters.\*.caData` (optional) + +PEM-encoded bytes (typically read from a client certificate file). + #### `gke` This cluster locator is designed to work with Kubernetes clusters running in From 2bacec55312dc55a98a47e6a24a9015440c6e7e2 Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Mon, 11 Oct 2021 22:16:02 +0700 Subject: [PATCH 4/7] Rephrase docs to match descriptions from the official docs Signed-off-by: Aldira Putra Raharja --- docs/features/kubernetes/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 6c9bf43da4..fc32f4da70 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -138,7 +138,7 @@ for real examples. ##### `clusters.\*.caData` (optional) -PEM-encoded bytes (typically read from a client certificate file). +PEM-encoded certificate authority certificates. #### `gke` From 26b7943660c11b4cd5724e9a4434f1142986ba2b Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Wed, 13 Oct 2021 20:16:55 +0700 Subject: [PATCH 5/7] update api-report and update docs around caData Signed-off-by: Aldira Putra Raharja --- docs/features/kubernetes/configuration.md | 14 ++++++++++++++ plugins/kubernetes-backend/api-report.md | 2 ++ 2 files changed, 16 insertions(+) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index fc32f4da70..1be1b3471a 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -140,6 +140,20 @@ for real examples. PEM-encoded certificate authority certificates. +This values could be obtained via inspecting the kube config file under +`clusters.cluster.certificate-authority-data`. For GKE, execute the following +command to obtain the value + +``` +gcloud container clusters describe \ + --zone= \ + --format="value(masterAuth.clusterCaCertificate)" +``` + +See also +https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#environments-without-gcloud +for complete docs about GKE without gcloud. + #### `gke` This cluster locator is designed to work with Kubernetes clusters running in diff --git a/plugins/kubernetes-backend/api-report.md b/plugins/kubernetes-backend/api-report.md index 3d52c4ff43..34ab7d4db1 100644 --- a/plugins/kubernetes-backend/api-report.md +++ b/plugins/kubernetes-backend/api-report.md @@ -27,6 +27,8 @@ export interface AWSClusterDetails extends ClusterDetails { export interface ClusterDetails { // (undocumented) authProvider: string; + // (undocumented) + caData?: string | undefined; dashboardApp?: string; dashboardUrl?: string; name: string; From 3e9ce7e952006a9b1b7be8938b58c5364c5a87c9 Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Tue, 19 Oct 2021 16:12:03 +0700 Subject: [PATCH 6/7] fix docs accordingly Signed-off-by: Aldira Putra Raharja --- docs/features/kubernetes/configuration.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index 1be1b3471a..6b3991144b 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -140,9 +140,9 @@ for real examples. PEM-encoded certificate authority certificates. -This values could be obtained via inspecting the kube config file under -`clusters.cluster.certificate-authority-data`. For GKE, execute the following -command to obtain the value +This values could be obtained via inspecting the Kubernetes config file (usually +at `~/.kube/config`) under `clusters.cluster.certificate-authority-data`. For +GKE, execute the following command to obtain the value ``` gcloud container clusters describe \ @@ -152,7 +152,7 @@ gcloud container clusters describe \ See also https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#environments-without-gcloud -for complete docs about GKE without gcloud. +for complete docs about GKE without `gcloud`. #### `gke` From edf89c179e23e768441ce003a120242ec3bcee3b Mon Sep 17 00:00:00 2001 From: Aldira Putra Raharja Date: Wed, 20 Oct 2021 09:56:15 +0700 Subject: [PATCH 7/7] Add TODO on GKE to pass caData into the object Signed-off-by: Aldira Putra Raharja --- .../kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts index 3cc6c216ae..18b8061bde 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts @@ -49,6 +49,7 @@ export class GkeClusterLocator implements KubernetesClustersSupplier { ); } + // TODO pass caData into the object async getClusters(): Promise { const { projectId, region, skipTLSVerify } = this.options; const request = {