From cc27fa4a1aac57244baebc5d7a6e2b1b6995bac5 Mon Sep 17 00:00:00 2001 From: avkudryashov <41747012+avkudryashov@users.noreply.github.com> Date: Thu, 22 Jun 2023 09:31:40 +0200 Subject: [PATCH] Decrease access level to read-only Signed-off-by: avkudryashov <41747012+avkudryashov@users.noreply.github.com> Signed-off-by: Anatoly Kudriashov --- .changeset/tame-carpets-smell.md | 5 +++++ .../kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/tame-carpets-smell.md diff --git a/.changeset/tame-carpets-smell.md b/.changeset/tame-carpets-smell.md new file mode 100644 index 0000000000..099e720783 --- /dev/null +++ b/.changeset/tame-carpets-smell.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes': patch +--- + +Changed Gcloud auth scope to read-only diff --git a/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts index 5652549b8a..fbce644a89 100644 --- a/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts +++ b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts @@ -39,7 +39,7 @@ export class GoogleKubernetesAuthProvider implements KubernetesAuthProvider { async getCredentials(): Promise<{ token: string }> { return { token: await this.authProvider.getAccessToken( - 'https://www.googleapis.com/auth/cloud-platform', + 'https://www.googleapis.com/auth/cloud-platform.read-only', ), }; }