Address comments on pr for k8s oidc authProvider

Signed-off-by: Daniel Bravo <dbravo@vmware.com>

docs/features/kubernetes/configuration.md

@@ -85,15 +85,14 @@ array. Users will see this value in the Software Catalog Kubernetes plugin.
 This determines how the Kubernetes client authenticates with the Kubernetes
 cluster. Valid values are:
 
-| Value                  | Description                                                                                                                                                                                                                       |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `serviceAccount`       | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. |
-| `google`               | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API.                                                                                             |
-| `aws`                  | This will use AWS credentials to access resources in EKS clusters                                                                                                                                                                 |
-| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters                                                                                                                                        |
-| `azure`                | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters                                                               |
-| `oidc`                    | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider`                       |
-| field should also be set. |
+| Value                  | Description                                                                                                                                                                                                                           |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `serviceAccount`       | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set.     |
+| `google`               | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API.                                                                                                 |
+| `aws`                  | This will use AWS credentials to access resources in EKS clusters                                                                                                                                                                     |
+| `googleServiceAccount` | This will use the Google Cloud service account credentials to access resources in clusters                                                                                                                                            |
+| `azure`                | This will use [Azure Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to access resources in clusters                                                                   |
+| `oidc`                 | This will use [Oidc Tokens](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) to authenticate to the Kubernetes API. When this is used the `oidcTokenProvider` field should also be set. |
 
 ##### `clusters.\*.skipTLSVerify`
 

plugins/kubernetes-backend/schema.d.ts

@@ -52,7 +52,12 @@ export interface Config {
             /** @visibility secret  */
             serviceAccountToken?: string;
             /** @visibility frontend */
-            authProvider: 'aws' | 'google' | 'serviceAccount' | 'azure' | 'oidc';
+            authProvider:
+              | 'aws'
+              | 'google'
+              | 'serviceAccount'
+              | 'azure'
+              | 'oidc';
             /** @visibility frontend */
             oidcTokenProvider?: string;
             /** @visibility frontend */

plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.test.ts

@@ -38,7 +38,9 @@ describe('OidcKubernetesAuthTranslator tests', () => {
         ...baseClusterDetails,
       },
       {
-        oidc: { okta: 'fakeToken' },
+        auth: {
+          oidc: { okta: 'fakeToken' },
+        },
         entity,
       },
     );

plugins/kubernetes-backend/src/kubernetes-auth-translator/OidcKubernetesAuthTranslator.ts

@@ -36,7 +36,8 @@ export class OidcKubernetesAuthTranslator implements KubernetesAuthTranslator {
       );
     }
 
-    const authToken: string | undefined = requestBody.oidc?.[oidcTokenProvider];
+    const authToken: string | undefined =
+      requestBody.auth?.oidc?.[oidcTokenProvider];
 
     if (authToken) {
       clusterDetailsWithAuthToken.serviceAccountToken = authToken;

plugins/kubernetes-common/api-report.md

@@ -194,14 +194,13 @@ export interface KubernetesFetchError {
 export interface KubernetesRequestBody {
   // (undocumented)
   auth?: {
-    google: string;
+    google?: string;
+    oidc?: {
+      [key: string]: string;
+    };
   };
   // (undocumented)
   entity: Entity;
-  // (undocumented)
-  oidc?: {
-    [key: string]: string;
-  };
 }
 
 // Warning: (ae-missing-release-tag) "ObjectsByEntityResponse" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)

plugins/kubernetes-common/src/types.ts

@@ -30,10 +30,10 @@ import { Entity } from '@backstage/catalog-model';
 
 export interface KubernetesRequestBody {
   auth?: {
-    google: string;
-  };
-  oidc?: {
-    [key: string]: string;
+    google?: string;
+    oidc?: {
+      [key: string]: string;
+    };
   };
   entity: Entity;
 }

plugins/kubernetes/src/kubernetes-auth-provider/KubernetesAuthProviders.test.ts

@@ -58,7 +58,7 @@ describe('KubernetesAuthProviders tests', () => {
       requestBody,
     );
 
-    expect(details.oidc?.okta).toBe('oktaToken');
+    expect(details.auth?.oidc?.okta).toBe('oktaToken');
   });
 
   it('returns error for unknown authProvider', async () => {

plugins/kubernetes/src/kubernetes-auth-provider/OidcKubernetesAuthProvider.ts

@@ -31,11 +31,13 @@ export class OidcKubernetesAuthProvider implements KubernetesAuthProvider {
     requestBody: KubernetesRequestBody,
   ): Promise<KubernetesRequestBody> {
     const authToken: string = await this.authProvider.getIdToken();
-    if ('oidc' in requestBody) {
-      requestBody.oidc![this.providerName] = authToken;
+    const auth = { ...requestBody.auth };
+    if (auth.oidc) {
+      auth.oidc[this.providerName] = authToken;
     } else {
-      requestBody.oidc = { [this.providerName]: authToken };
+      auth.oidc = { [this.providerName]: authToken };
     }
+    requestBody.auth = auth;
     return requestBody;
   }
 }