paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 40 Packages Projects Releases Wiki Activity

Merge pull request #16649 from RubenV-dev/server-side-auth-proxy

Browse Source 
Enable Server Side Authentication when using the Kubernetes Proxy
This commit is contained in:
Ben Lambert
2023-04-04 14:00:56 +02:00
committed by GitHub
parent 9ef74b461d a3439ddac5
commit b9327d6c1a
14 changed files with 491 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/kubernetes/proxy.md
+2 -8
View File
@@ -69,15 +69,9 @@ Overall, the only changes to each request are:
- the endpoint's base URL prefix is stripped.
- the `Backstage-Kubernetes-Authorization` header becomes the `Authorization` header that is used when forwarding the request.
## Authentication
The proxy expects a `KubernetesAuthTranslator` to be provided that is used to decorate all requests with `Auth` by default. It does this by supplying a `serviceAccountToken` field into `clusterDetails` using the defined `authProvider` in `clusterDetails`.
Until some security and permission decisions are made (see [this
conversation](https://github.com/backstage/backstage/pull/13026/files#r1029376939)
for context), contributors consuming the proxy endpoint in their plugin code are
responsible for negotiating their own bearer token out-of-band. This requires
knowing some auth details about the cluster being contacted -- in practice, only
clusters with [client side auth
providers](https://backstage.io/docs/features/kubernetes/authentication#client-side-providers) can reasonably be reached.
## Authentication
The proxy has no provisions for mTLS, so it cannot be used to connect to
clusters using the [x509 Client