From c42cd1daaf45b6fd90e6a8cc06847897b3b2f112 Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Tue, 13 Apr 2021 12:55:28 -0400 Subject: [PATCH 1/2] Kubernetes client TLS verification is now configurable Verification now defaults to true, where previously it defaulted to false Signed-off-by: Travis Truman --- .changeset/rude-items-bow.md | 5 +++++ docs/features/kubernetes/configuration.md | 6 ++++++ .../src/cluster-locator/ConfigClusterLocator.test.ts | 5 +++++ .../src/cluster-locator/ConfigClusterLocator.ts | 4 ++++ .../kubernetes-backend/src/cluster-locator/index.test.ts | 2 ++ .../src/service/KubernetesClientProvider.test.ts | 3 +++ .../src/service/KubernetesClientProvider.ts | 3 +-- plugins/kubernetes-backend/src/types/types.ts | 1 + 8 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 .changeset/rude-items-bow.md diff --git a/.changeset/rude-items-bow.md b/.changeset/rude-items-bow.md new file mode 100644 index 0000000000..69b76d821e --- /dev/null +++ b/.changeset/rude-items-bow.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes-backend': patch +--- + +Kubernetes client TLS verification is now configurable and defaults to true diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index c21ac7e18a..4ac324a430 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -25,6 +25,7 @@ kubernetes: - url: http://127.0.0.1:9999 name: minikube authProvider: 'serviceAccount' + skipTLSVerify: false serviceAccountToken: $env: K8S_MINIKUBE_TOKEN - url: http://127.0.0.2:9999 @@ -79,6 +80,11 @@ cluster. Valid values are: | `serviceAccount` | This will use a Kubernetes [service account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) to access the Kubernetes API. When this is used the `serviceAccountToken` field should also be set. | | `google` | This will use a user's Google auth token from the [Google auth plugin](https://backstage.io/docs/auth/) to access the Kubernetes API. | +##### `clusters.\*.skipTLSVerify` + +This determines whether or not the Kubernetes client verifies the TLS +certificate presented by the API server. + ##### `clusters.\*.serviceAccountToken` (optional) The service account token to be used when using the `serviceAccount` auth diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts index cb79a3020c..6ad8bdd9a1 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts @@ -52,6 +52,7 @@ describe('ConfigClusterLocator', () => { serviceAccountToken: undefined, url: 'http://localhost:8080', authProvider: 'serviceAccount', + skipTLSVerify: false, }, ]); }); @@ -64,11 +65,13 @@ describe('ConfigClusterLocator', () => { serviceAccountToken: 'token', url: 'http://localhost:8080', authProvider: 'serviceAccount', + skipTLSVerify: false, }, { name: 'cluster2', url: 'http://localhost:8081', authProvider: 'google', + skipTLSVerify: true, }, ], }); @@ -83,12 +86,14 @@ describe('ConfigClusterLocator', () => { serviceAccountToken: 'token', url: 'http://localhost:8080', authProvider: 'serviceAccount', + skipTLSVerify: false, }, { name: 'cluster2', serviceAccountToken: undefined, url: 'http://localhost:8081', authProvider: 'google', + skipTLSVerify: true, }, ]); }); diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts index e1016789af..62b127cd60 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts @@ -33,6 +33,10 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier { name: c.getString('name'), url: c.getString('url'), serviceAccountToken: c.getOptionalString('serviceAccountToken'), + skipTLSVerify: + c.getOptionalBoolean('skipTLSVerify') === undefined + ? false + : c.getOptionalBoolean('skipTLSVerify'), authProvider: c.getString('authProvider'), }; }), diff --git a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts index d586f90151..d7eb98719f 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts @@ -53,12 +53,14 @@ describe('getCombinedClusterDetails', () => { serviceAccountToken: 'token', url: 'http://localhost:8080', authProvider: 'serviceAccount', + skipTLSVerify: false, }, { name: 'cluster2', serviceAccountToken: undefined, url: 'http://localhost:8081', authProvider: 'google', + skipTLSVerify: false, }, ]); }); diff --git a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.test.ts b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.test.ts index 4655e5f552..be6fc9c47c 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.test.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.test.ts @@ -34,6 +34,7 @@ describe('KubernetesClientProvider', () => { url: 'http://localhost:9999', serviceAccountToken: 'TOKEN', authProvider: 'serviceAccount', + skipTLSVerify: false, }); expect(result.basePath).toBe('http://localhost:9999'); @@ -41,6 +42,7 @@ describe('KubernetesClientProvider', () => { const auth = (result as any).authentications.default; expect(auth.users[0].token).toBe('TOKEN'); expect(auth.clusters[0].name).toBe('cluster-name'); + expect(auth.clusters[0].skipTLSVerify).toBe(false); expect(mockGetKubeConfig.mock.calls.length).toBe(1); }); @@ -57,6 +59,7 @@ describe('KubernetesClientProvider', () => { url: 'http://localhost:9999', serviceAccountToken: 'TOKEN', authProvider: 'serviceAccount', + skipTLSVerify: false, }); expect(result.basePath).toBe('http://localhost:9999'); diff --git a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts index cd1c6afedf..25ed40322a 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts @@ -30,8 +30,7 @@ export class KubernetesClientProvider { const cluster = { name: clusterDetails.name, server: clusterDetails.url, - // TODO configure this - skipTLSVerify: true, + skipTLSVerify: clusterDetails.skipTLSVerify, }; // TODO configure diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts index 84ca08585b..c597c718c5 100644 --- a/plugins/kubernetes-backend/src/types/types.ts +++ b/plugins/kubernetes-backend/src/types/types.ts @@ -30,6 +30,7 @@ export interface ClusterDetails { url: string; authProvider: string; serviceAccountToken?: string | undefined; + skipTLSVerify?: boolean; } export interface KubernetesRequestBody { From b58eb099f7d349fe7980e98b22c0bca347ba6c51 Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Fri, 16 Apr 2021 08:44:04 -0400 Subject: [PATCH 2/2] Responding to review feedback Signed-off-by: Travis Truman --- docs/features/kubernetes/configuration.md | 2 +- .../src/cluster-locator/ConfigClusterLocator.ts | 5 +---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index b96b1461de..8222fbb400 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -82,7 +82,7 @@ cluster. Valid values are: ##### `clusters.\*.skipTLSVerify` This determines whether or not the Kubernetes client verifies the TLS -certificate presented by the API server. +certificate presented by the API server. Defaults to `false`. ##### `clusters.\*.serviceAccountToken` (optional) diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts index 62b127cd60..169e50534f 100644 --- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts +++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts @@ -33,10 +33,7 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier { name: c.getString('name'), url: c.getString('url'), serviceAccountToken: c.getOptionalString('serviceAccountToken'), - skipTLSVerify: - c.getOptionalBoolean('skipTLSVerify') === undefined - ? false - : c.getOptionalBoolean('skipTLSVerify'), + skipTLSVerify: c.getOptionalBoolean('skipTLSVerify') ?? false, authProvider: c.getString('authProvider'), }; }),