Add permission integration router which allows us to list permissions available to the plugin

Signed-off-by: Ruben Vallejo <rvallejo@vmware.com>

plugins/kubernetes-backend/package.json

@@ -42,6 +42,8 @@
     "@backstage/errors": "workspace:^",
     "@backstage/plugin-auth-node": "workspace:^",
     "@backstage/plugin-kubernetes-common": "workspace:^",
+    "@backstage/plugin-permission-common": "workspace:^",
+    "@backstage/plugin-permission-node": "workspace:^",
     "@google-cloud/container": "^4.0.0",
     "@jest-mock/express": "^2.0.1",
     "@kubernetes/client-node": "0.18.1",

plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts

@@ -286,7 +286,6 @@ describe('KubernetesBuilder', () => {
       expect(response.status).toEqual(200);
     });
   });
-
   describe('post /proxy', () => {
     const worker = setupServer();
     setupRequestMockHandlers(worker);
@@ -340,11 +339,11 @@ describe('KubernetesBuilder', () => {
 
     it('supports yaml content type with permission set to allow', async () => {
       const requestBody = `---
-    kind: Namespace
-    apiVersion: v1
-    metadata:
-      name: new-ns
-    `;
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: new-ns
+`;
 
       permissions.authorize.mockReturnValue(
         Promise.resolve([{ result: AuthorizeResult.ALLOW }]),
@@ -389,4 +388,23 @@ describe('KubernetesBuilder', () => {
       expect(response.status).toEqual(403);
     });
   });
+  describe('get /.well-known/backstage/permissions/metadata', () => {
+    it('lists permissions supported by the kubernetes plugin', async () => {
+      const response = await request(app).get(
+        '/.well-known/backstage/permissions/metadata',
+      );
+
+      expect(response.status).toEqual(200);
+      expect(response.body).toMatchObject({
+        permissions: [
+          {
+            type: 'basic',
+            name: 'kubernetes.proxy',
+            attributes: {},
+          },
+        ],
+        rules: [],
+      });
+    });
+  });
 });

plugins/kubernetes-backend/src/service/KubernetesBuilder.ts

@@ -15,7 +15,12 @@
  */
 import { CatalogApi } from '@backstage/catalog-client';
 import { Config } from '@backstage/config';
+import {
+  kubernetesPermissions,
+  RESOURCE_TYPE_KUBERNETES_RESOURCE,
+} from '@backstage/plugin-kubernetes-common';
 import { PermissionEvaluator } from '@backstage/plugin-permission-common';
+import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Duration } from 'luxon';
@@ -272,7 +277,13 @@ export class KubernetesBuilder {
     const router = Router();
     router.use('/proxy', proxy.createRequestHandler(permissionApi));
     router.use(express.json());
-
+    router.use(
+      createPermissionIntegrationRouter({
+        resourceType: RESOURCE_TYPE_KUBERNETES_RESOURCE,
+        permissions: kubernetesPermissions,
+        rules: [],
+      }),
+    );
     // @deprecated
     router.post('/services/:serviceId', async (req, res) => {
       const serviceId = req.params.serviceId;

plugins/kubernetes-common/api-report.md

@@ -207,9 +207,6 @@ export interface JobsFetchResponse {
   type: 'jobs';
 }
 
-// @alpha
-export const kubernetesClusterPermissions: BasicPermission[];
-
 // @public (undocumented)
 export type KubernetesErrorTypes =
   | 'BAD_REQUEST'
@@ -222,10 +219,10 @@ export type KubernetesErrorTypes =
 export type KubernetesFetchError = StatusError | RawFetchError;
 
 // @alpha
-export const kubernetesProxyCreatePermission: BasicPermission;
+export const kubernetesPermissions: BasicPermission[];
 
 // @alpha
-export const kubernetesProxyReadPermission: BasicPermission;
+export const kubernetesProxyPermission: BasicPermission;
 
 // @public (undocumented)
 export interface KubernetesRequestAuth {
@@ -291,6 +288,9 @@ export interface ReplicaSetsFetchResponse {
   type: 'replicasets';
 }
 
+// @alpha
+export const RESOURCE_TYPE_KUBERNETES_RESOURCE = 'kubernetes-resource';
+
 // @public (undocumented)
 export interface ServiceFetchResponse {
   // (undocumented)

plugins/kubernetes-common/src/index.ts

@@ -23,6 +23,7 @@
 export * from './types';
 export * from './catalog-entity-constants';
 export {
+  RESOURCE_TYPE_KUBERNETES_RESOURCE,
   kubernetesProxyPermission,
-  kubernetesClusterPermissions,
+  kubernetesPermissions,
 } from './permissions';

plugins/kubernetes-common/src/permissions.ts

@@ -16,6 +16,12 @@
 
 import { createPermission } from '@backstage/plugin-permission-common';
 
+/**
+ * Permission resource type which corresponds to cluster entities.
+ * @alpha
+ */
+export const RESOURCE_TYPE_KUBERNETES_RESOURCE = 'kubernetes-resource';
+
 /** This permission is used to check access to the proxy endpoint
  * @alpha
  */
@@ -25,7 +31,7 @@ export const kubernetesProxyPermission = createPermission({
 });
 
 /**
- * List of all cluster permissions.
+ * List of all Kubernetes permissions.
  * @alpha
  */
-export const kubernetesClusterPermissions = [kubernetesProxyPermission];
+export const kubernetesPermissions = [kubernetesProxyPermission];

yarn.lock

@@ -6807,6 +6807,8 @@ __metadata:
     "@backstage/errors": "workspace:^"
     "@backstage/plugin-auth-node": "workspace:^"
     "@backstage/plugin-kubernetes-common": "workspace:^"
+    "@backstage/plugin-permission-common": "workspace:^"
+    "@backstage/plugin-permission-node": "workspace:^"
     "@google-cloud/container": ^4.0.0
     "@jest-mock/express": ^2.0.1
     "@kubernetes/client-node": 0.18.1