From fb09a59a3f8aca12cd5da2c8d2fa7b5513381bd3 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Wed, 16 Feb 2022 19:32:58 +0100
Subject: [PATCH] kubernetes-backend: fixed potential AWS token generation
 issue

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/dirty-ears-wash.md                 |  5 ++++
 .../AwsIamKubernetesAuthTranslator.ts         | 29 +++++--------------
 2 files changed, 13 insertions(+), 21 deletions(-)
 create mode 100644 .changeset/dirty-ears-wash.md

diff --git a/.changeset/dirty-ears-wash.md b/.changeset/dirty-ears-wash.md
new file mode 100644
index 0000000000..060dc808f1
--- /dev/null
+++ b/.changeset/dirty-ears-wash.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+Fixed a potential issue in AWS token encoding, where they might not always be properly converted to URL-safe base64.
diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts
index 4af39d4f26..9f1353ca5c 100644
--- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts
+++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts
@@ -18,19 +18,6 @@ import { sign } from 'aws4';
 import { AWSClusterDetails } from '../types/types';
 import { KubernetesAuthTranslator } from './types';
 
-const base64 = (str: string) =>
-  Buffer.from(str.toString(), 'binary').toString('base64');
-const prepend = (prep: string) => (str: string) => prep + str;
-const replace =
-  (search: string | RegExp, substitution: string) => (str: string) =>
-    str.replace(search, substitution);
-const pipe =
-  (fns: ReadonlyArray<any>) =>
-  (thing: string): string =>
-    fns.reduce((val, fn) => fn(val), thing);
-const removePadding = replace(/=+$/, '');
-const makeUrlSafe = pipe([replace('+', '-'), replace('/', '_')]);
-
 type SigningCreds = {
   accessKeyId: string | undefined;
   secretAccessKey: string | undefined;
@@ -117,15 +104,15 @@ export class AwsIamKubernetesAuthTranslator
       signQuery: true,
     };
 
-    const signedRequest = sign(request, credentials);
+    const signed = sign(request, credentials);
+    const url = `https://${signed.host}${signed.path}`;
+    const base64Url = Buffer.from(url, 'binary').toString('base64');
+    const urlSafeBase64Url = base64Url
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=+$/, '');
 
-    return pipe([
-      (signed: any) => `https://${signed.host}${signed.path}`,
-      base64,
-      removePadding,
-      makeUrlSafe,
-      prepend('k8s-aws-v1.'),
-    ])(signedRequest);
+    return `k8s-aws-v1.${urlSafeBase64Url}`;
   }
 
   async decorateClusterDetailsWithAuth(