add aks access token to request body

Signed-off-by: Jamie Klassen <jklassen@vmware.com>

plugins/kubernetes/src/kubernetes-auth-provider/AksKubernetesAuthProvider.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { OAuthApi } from '@backstage/core-plugin-api';
+import { KubernetesRequestBody } from '@backstage/plugin-kubernetes-common';
+import { KubernetesAuthProvider } from './types';
+
+export class AksKubernetesAuthProvider implements KubernetesAuthProvider {
+  constructor(private readonly microsoftAuthApi: OAuthApi) {}
+
+  async decorateRequestBodyForAuth(
+    requestBody: KubernetesRequestBody,
+  ): Promise<KubernetesRequestBody> {
+    return {
+      ...requestBody,
+      auth: { ...requestBody.auth, aks: (await this.getCredentials()).token },
+    };
+  }
+
+  async getCredentials(): Promise<{ token?: string }> {
+    return {
+      token: await this.microsoftAuthApi.getAccessToken(
+        '6dae42f8-4368-4678-94ff-3960e28e3630/user.read',
+      ),
+    };
+  }
+}

plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.test.ts

@@ -39,11 +39,18 @@ const requestBody: KubernetesRequestBody = {
 };
 
 describe('KubernetesAuthProviders tests', () => {
-  const kap = new KubernetesAuthProviders({
-    googleAuthApi: new MockAuthApi('googleToken'),
-    oidcProviders: {
-      okta: new MockAuthApi('oktaToken'),
-    },
+  let microsoftAuthApi: MockAuthApi;
+  let kap: KubernetesAuthProviders;
+
+  beforeEach(() => {
+    microsoftAuthApi = new MockAuthApi('aksToken');
+    kap = new KubernetesAuthProviders({
+      microsoftAuthApi,
+      googleAuthApi: new MockAuthApi('googleToken'),
+      oidcProviders: {
+        okta: new MockAuthApi('oktaToken'),
+      },
+    });
   });
 
   it('adds token to request body for google authProvider', async () => {
@@ -52,6 +59,15 @@ describe('KubernetesAuthProviders tests', () => {
     expect(details.auth?.google).toBe('googleToken');
   });
 
+  it('adds token to request body for aks authProvider', async () => {
+    const details = await kap.decorateRequestBodyForAuth('aks', requestBody);
+
+    expect(details.auth?.aks).toBe('aksToken');
+    expect(microsoftAuthApi.getAccessToken).toHaveBeenCalledWith(
+      '6dae42f8-4368-4678-94ff-3960e28e3630/user.read',
+    );
+  });
+
   it('adds token to request body for oidc authProvider', async () => {
     const details = await kap.decorateRequestBodyForAuth(
       'oidc.okta',

plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.ts

@@ -20,6 +20,7 @@ import { GoogleKubernetesAuthProvider } from './GoogleKubernetesAuthProvider';
 import { ServerSideKubernetesAuthProvider } from './ServerSideAuthProvider';
 import { OAuthApi, OpenIdConnectApi } from '@backstage/core-plugin-api';
 import { OidcKubernetesAuthProvider } from './OidcKubernetesAuthProvider';
+import { AksKubernetesAuthProvider } from './AksKubernetesAuthProvider';
 
 export class KubernetesAuthProviders implements KubernetesAuthProvidersApi {
   private readonly kubernetesAuthProviderMap: Map<
@@ -28,6 +29,7 @@ export class KubernetesAuthProviders implements KubernetesAuthProvidersApi {
   >;
 
   constructor(options: {
+    microsoftAuthApi: OAuthApi;
     googleAuthApi: OAuthApi;
     oidcProviders?: { [key: string]: OpenIdConnectApi };
   }) {
@@ -56,6 +58,10 @@ export class KubernetesAuthProviders implements KubernetesAuthProvidersApi {
       'localKubectlProxy',
       new ServerSideKubernetesAuthProvider(),
     );
+    this.kubernetesAuthProviderMap.set(
+      'aks',
+      new AksKubernetesAuthProvider(options.microsoftAuthApi),
+    );
 
     if (options.oidcProviders) {
       Object.keys(options.oidcProviders).forEach(provider => {

plugins/kubernetes/src/plugin.ts

@@ -87,7 +87,11 @@ export const kubernetesPlugin = createPlugin({
           onelogin: oneloginAuthApi,
         };
 
-        return new KubernetesAuthProviders({ googleAuthApi, oidcProviders });
+        return new KubernetesAuthProviders({
+          microsoftAuthApi,
+          googleAuthApi,
+          oidcProviders,
+        });
       },
     }),
   ],