@backstage/plugin-kubernetes-backend 0.11.6-next.2 → 0.12.0

package/dist/index.cjs.js

@@ -6,9 +6,11 @@ var credentialProviders = require('@aws-sdk/credential-providers');
 var signatureV4 = require('@aws-sdk/signature-v4');
 var sha256Js = require('@aws-crypto/sha256-js');
 var integrationAwsNode = require('@backstage/integration-aws-node');
+var pluginKubernetesCommon = require('@backstage/plugin-kubernetes-common');
 var identity = require('@azure/identity');
 var container = require('@google-cloud/container');
-var pluginKubernetesCommon = require('@backstage/plugin-kubernetes-common');
+var clientNode = require('@kubernetes/client-node');
+var fs = require('fs-extra');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
 var Router = require('express-promise-router');
@@ -17,11 +19,9 @@ var errors = require('@backstage/errors');
 var catalogClient = require('@backstage/catalog-client');
 var catalogModel = require('@backstage/catalog-model');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
-var clientNode = require('@kubernetes/client-node');
 var lodash = require('lodash');
 var fetch = require('node-fetch');
 var https = require('https');
-var fs = require('fs-extra');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var httpProxyMiddleware = require('http-proxy-middleware');
 
@@ -46,16 +46,29 @@ function _interopNamespace(e) {
 }
 
 var container__namespace = /*#__PURE__*/_interopNamespace(container);
+var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
 var express__default = /*#__PURE__*/_interopDefaultLegacy(express);
 var Router__default = /*#__PURE__*/_interopDefaultLegacy(Router);
 var lodash__default = /*#__PURE__*/_interopDefaultLegacy(lodash);
 var fetch__default = /*#__PURE__*/_interopDefaultLegacy(fetch);
 var https__namespace = /*#__PURE__*/_interopNamespace(https);
-var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
 
-class AksKubernetesAuthTranslator {
-  async decorateClusterDetailsWithAuth(clusterDetails, auth) {
-    return { ...clusterDetails, serviceAccountToken: auth.aks };
+class AksStrategy {
+  async getCredential(_, requestAuth) {
+    const token = requestAuth.aks;
+    return token ? { type: "bearer token", token } : { type: "anonymous" };
+  }
+  validateCluster() {
+    return [];
+  }
+}
+
+class AnonymousStrategy {
+  async getCredential() {
+    return { type: "anonymous" };
+  }
+  validateCluster() {
+    return [];
   }
 }
 
@@ -66,11 +79,24 @@ var __publicField$a = (obj, key, value) => {
   return value;
 };
 const defaultRegion = "us-east-1";
-class AwsIamKubernetesAuthTranslator {
+class AwsIamStrategy {
   constructor(opts) {
     __publicField$a(this, "credsManager");
     this.credsManager = integrationAwsNode.DefaultAwsCredentialsManager.fromConfig(opts.config);
   }
+  async getCredential(clusterDetails) {
+    return {
+      type: "bearer token",
+      token: await this.getBearerToken(
+        clusterDetails.name,
+        clusterDetails.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_ASSUME_ROLE],
+        clusterDetails.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_EXTERNAL_ID]
+      )
+    };
+  }
+  validateCluster() {
+    return [];
+  }
   async getBearerToken(clusterName, assumeRole, externalId) {
     var _a, _b;
     const region = (_a = process.env.AWS_REGION) != null ? _a : defaultRegion;
@@ -121,18 +147,6 @@ class AwsIamKubernetesAuthTranslator {
     const url = `https://${request.hostname}${request.path}?${query}`;
     return `k8s-aws-v1.${Buffer.from(url).toString("base64url")}`;
   }
-  async decorateClusterDetailsWithAuth(clusterDetails) {
-    const clusterDetailsWithAuthToken = Object.assign(
-      {},
-      clusterDetails
-    );
-    clusterDetailsWithAuthToken.serviceAccountToken = await this.getBearerToken(
-      clusterDetails.name,
-      clusterDetails.assumeRole,
-      clusterDetails.externalId
-    );
-    return clusterDetailsWithAuthToken;
-  }
 }
 
 var __defProp$9 = Object.defineProperty;
@@ -142,29 +156,24 @@ var __publicField$9 = (obj, key, value) => {
   return value;
 };
 const aksScope = "6dae42f8-4368-4678-94ff-3960e28e3630/.default";
-class AzureIdentityKubernetesAuthTranslator {
+class AzureIdentityStrategy {
   constructor(logger, tokenCredential = new identity.DefaultAzureCredential()) {
     this.logger = logger;
     this.tokenCredential = tokenCredential;
     __publicField$9(this, "accessToken", { token: "", expiresOnTimestamp: 0 });
     __publicField$9(this, "newTokenPromise");
   }
-  async decorateClusterDetailsWithAuth(clusterDetails) {
-    const clusterDetailsWithAuthToken = Object.assign(
-      {},
-      clusterDetails
-    );
-    clusterDetailsWithAuthToken.serviceAccountToken = await this.getToken();
-    return clusterDetailsWithAuthToken;
-  }
-  async getToken() {
+  async getCredential() {
     if (!this.tokenRequiresRefresh()) {
-      return this.accessToken.token;
+      return { type: "bearer token", token: this.accessToken.token };
     }
     if (!this.newTokenPromise) {
       this.newTokenPromise = this.fetchNewToken();
     }
-    return this.newTokenPromise;
+    return this.newTokenPromise ? { type: "bearer token", token: await this.newTokenPromise } : { type: "anonymous" };
+  }
+  validateCluster() {
+    return [];
   }
   async fetchNewToken() {
     try {
@@ -195,40 +204,34 @@ class AzureIdentityKubernetesAuthTranslator {
   }
 }
 
-class GoogleKubernetesAuthTranslator {
-  async decorateClusterDetailsWithAuth(clusterDetails, authConfig) {
-    const clusterDetailsWithAuthToken = Object.assign(
-      {},
-      clusterDetails
-    );
-    const authToken = authConfig.google;
-    if (authToken) {
-      clusterDetailsWithAuthToken.serviceAccountToken = authToken;
-    } else {
+class GoogleStrategy {
+  async getCredential(_, requestAuth) {
+    const token = requestAuth.google;
+    if (!token) {
       throw new Error(
         "Google token not found under auth.google in request body"
       );
     }
-    return clusterDetailsWithAuthToken;
+    return { type: "bearer token", token };
+  }
+  validateCluster() {
+    return [];
   }
 }
 
-class GoogleServiceAccountAuthTranslator {
-  async decorateClusterDetailsWithAuth(clusterDetails) {
-    const clusterDetailsWithAuthToken = Object.assign(
-      {},
-      clusterDetails
-    );
+class GoogleServiceAccountStrategy {
+  async getCredential() {
     const client = new container__namespace.v1.ClusterManagerClient();
-    const accessToken = await client.auth.getAccessToken();
-    if (accessToken) {
-      clusterDetailsWithAuthToken.serviceAccountToken = accessToken;
-    } else {
+    const token = await client.auth.getAccessToken();
+    if (!token) {
       throw new Error(
         "Unable to obtain access token for the current Google Application Default Credentials"
       );
     }
-    return clusterDetailsWithAuthToken;
+    return { type: "bearer token", token };
+  }
+  validateCluster() {
+    return [];
   }
 }
 
@@ -238,49 +241,76 @@ var __publicField$8 = (obj, key, value) => {
   __defNormalProp$8(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
-class DispatchingKubernetesAuthTranslator {
+class DispatchStrategy {
   constructor(options) {
-    __publicField$8(this, "translatorMap");
-    this.translatorMap = options.authTranslatorMap;
+    __publicField$8(this, "strategyMap");
+    this.strategyMap = options.authStrategyMap;
   }
-  decorateClusterDetailsWithAuth(clusterDetails, auth) {
-    if (this.translatorMap[clusterDetails.authProvider]) {
-      return this.translatorMap[clusterDetails.authProvider].decorateClusterDetailsWithAuth(clusterDetails, auth);
+  getCredential(clusterDetails, auth) {
+    const authProvider = clusterDetails.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+    if (this.strategyMap[authProvider]) {
+      return this.strategyMap[authProvider].getCredential(clusterDetails, auth);
     }
     throw new Error(
-      `authProvider "${clusterDetails.authProvider}" has no KubernetesAuthTranslator associated with it`
+      `authProvider "${authProvider}" has no AuthenticationStrategy associated with it`
     );
   }
+  validateCluster(authMetadata) {
+    const authProvider = authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+    const strategy = this.strategyMap[authProvider];
+    if (!strategy) {
+      return [
+        new Error(
+          `authProvider "${authProvider}" has no config associated with it`
+        )
+      ];
+    }
+    return strategy.validateCluster(authMetadata);
+  }
 }
 
-class NoopKubernetesAuthTranslator {
-  async decorateClusterDetailsWithAuth(clusterDetails) {
-    return clusterDetails;
+class ServiceAccountStrategy {
+  async getCredential(clusterDetails) {
+    const token = clusterDetails.authMetadata.serviceAccountToken;
+    if (token) {
+      return { type: "bearer token", token };
+    }
+    const kc = new clientNode.KubeConfig();
+    kc.loadFromCluster();
+    const user = kc.getCurrentUser();
+    return {
+      type: "bearer token",
+      token: fs__default["default"].readFileSync(user.authProvider.config.tokenFile).toString()
+    };
+  }
+  validateCluster() {
+    return [];
   }
 }
 
-class OidcKubernetesAuthTranslator {
-  async decorateClusterDetailsWithAuth(clusterDetails, authConfig) {
+class OidcStrategy {
+  async getCredential(clusterDetails, authConfig) {
     var _a;
-    const clusterDetailsWithAuthToken = Object.assign(
-      {},
-      clusterDetails
-    );
-    const { oidcTokenProvider } = clusterDetails;
+    const oidcTokenProvider = clusterDetails.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
     if (!oidcTokenProvider || oidcTokenProvider === "") {
       throw new Error(
         `oidc authProvider requires a configured oidcTokenProvider`
       );
     }
-    const authToken = (_a = authConfig.oidc) == null ? void 0 : _a[oidcTokenProvider];
-    if (authToken) {
-      clusterDetailsWithAuthToken.serviceAccountToken = authToken;
-    } else {
+    const token = (_a = authConfig.oidc) == null ? void 0 : _a[oidcTokenProvider];
+    if (!token) {
       throw new Error(
         `Auth token not found under oidc.${oidcTokenProvider} in request body`
       );
     }
-    return clusterDetailsWithAuthToken;
+    return { type: "bearer token", token };
+  }
+  validateCluster(authMetadata) {
+    const oidcTokenProvider = authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
+    if (!oidcTokenProvider || oidcTokenProvider === "") {
+      return [new Error(`Must specify a token provider for 'oidc' strategy`)];
+    }
+    return [];
   }
 }
 
@@ -295,7 +325,7 @@ class ConfigClusterLocator {
     __publicField$7(this, "clusterDetails");
     this.clusterDetails = clusterDetails;
   }
-  static fromConfig(config) {
+  static fromConfig(config, authStrategy) {
     return new ConfigClusterLocator(
       config.getConfigArray("clusters").map((c) => {
         var _a, _b;
@@ -303,12 +333,14 @@ class ConfigClusterLocator {
         const clusterDetails = {
           name: c.getString("name"),
           url: c.getString("url"),
-          serviceAccountToken: c.getOptionalString("serviceAccountToken"),
           skipTLSVerify: (_a = c.getOptionalBoolean("skipTLSVerify")) != null ? _a : false,
           skipMetricsLookup: (_b = c.getOptionalBoolean("skipMetricsLookup")) != null ? _b : false,
           caData: c.getOptionalString("caData"),
           caFile: c.getOptionalString("caFile"),
-          authProvider
+          authMetadata: {
+            [pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER]: authProvider,
+            ...ConfigClusterLocator.parseAuthMetadata(c)
+          }
         };
         const customResources = c.getOptionalConfigArray("customResources");
         if (customResources) {
@@ -331,40 +363,38 @@ class ConfigClusterLocator {
         if (c.has("dashboardParameters")) {
           clusterDetails.dashboardParameters = c.get("dashboardParameters");
         }
-        switch (authProvider) {
-          case "google": {
-            return clusterDetails;
-          }
-          case "aws": {
-            const assumeRole = c.getOptionalString("assumeRole");
-            const externalId = c.getOptionalString("externalId");
-            return { assumeRole, externalId, ...clusterDetails };
-          }
-          case "azure": {
-            return clusterDetails;
-          }
-          case "oidc": {
-            const oidcTokenProvider = c.getString("oidcTokenProvider");
-            return { oidcTokenProvider, ...clusterDetails };
-          }
-          case "serviceAccount": {
-            return clusterDetails;
-          }
-          case "googleServiceAccount": {
-            return clusterDetails;
-          }
-          case "aks": {
-            return clusterDetails;
-          }
-          default: {
-            throw new Error(
-              `authProvider "${authProvider}" has no config associated with it`
-            );
-          }
+        const validationErrors = authStrategy.validateCluster(
+          clusterDetails.authMetadata
+        );
+        if (validationErrors.length !== 0) {
+          throw new Error(
+            `Invalid cluster '${clusterDetails.name}': ${validationErrors.map((e) => e.message).join(", ")}`
+          );
         }
+        return clusterDetails;
       })
     );
   }
+  static parseAuthMetadata(clusterConfig) {
+    const serviceAccountToken = clusterConfig.getOptionalString(
+      "serviceAccountToken"
+    );
+    const assumeRole = clusterConfig.getOptionalString("assumeRole");
+    const externalId = clusterConfig.getOptionalString("externalId");
+    const oidcTokenProvider = clusterConfig.getOptionalString("oidcTokenProvider");
+    return serviceAccountToken || assumeRole || externalId || oidcTokenProvider ? {
+      ...serviceAccountToken && { serviceAccountToken },
+      ...assumeRole && {
+        [pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_ASSUME_ROLE]: assumeRole
+      },
+      ...externalId && {
+        [pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_EXTERNAL_ID]: externalId
+      },
+      ...oidcTokenProvider && {
+        [pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER]: oidcTokenProvider
+      }
+    } : void 0;
+  }
   async getClusters() {
     return this.clusterDetails;
   }
@@ -467,7 +497,7 @@ class GkeClusterLocator {
           // TODO filter out clusters which don't have name or endpoint
           name: (_a2 = r.name) != null ? _a2 : "unknown",
           url: `https://${(_b = r.endpoint) != null ? _b : ""}`,
-          authProvider: "google",
+          authMetadata: { [pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER]: "google" },
           skipTLSVerify,
           skipMetricsLookup,
           ...exposeDashboard ? {
@@ -522,21 +552,13 @@ class CatalogClusterLocator {
       const clusterDetails = {
         name: entity.metadata.name,
         url: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_API_SERVER],
+        authMetadata: entity.metadata.annotations,
         caData: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_API_SERVER_CA],
-        authProvider: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER],
-        oidcTokenProvider: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER],
         skipMetricsLookup: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_SKIP_METRICS_LOOKUP] === "true",
         skipTLSVerify: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_SKIP_TLS_VERIFY] === "true",
         dashboardUrl: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_DASHBOARD_URL],
         dashboardApp: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_DASHBOARD_APP]
       };
-      if (clusterDetails.authProvider === "aws") {
-        return {
-          ...clusterDetails,
-          assumeRole: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_ASSUME_ROLE],
-          externalId: entity.metadata.annotations[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AWS_EXTERNAL_ID]
-        };
-      }
       return clusterDetails;
     });
   }
@@ -555,7 +577,9 @@ class LocalKubectlProxyClusterLocator {
       {
         name: "local",
         url: "http:/localhost:8001",
-        authProvider: "localKubectlProxy",
+        authMetadata: {
+          [pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER]: "localKubectlProxy"
+        },
         skipMetricsLookup: true
       }
     ];
@@ -579,7 +603,7 @@ class CombinedClustersSupplier {
     });
   }
 }
-const getCombinedClusterSupplier = (rootConfig, catalogClient, refreshInterval = void 0) => {
+const getCombinedClusterSupplier = (rootConfig, catalogClient, authStrategy, refreshInterval = void 0) => {
   const clusterSuppliers = rootConfig.getConfigArray("kubernetes.clusterLocatorMethods").map((clusterLocatorMethod) => {
     const type = clusterLocatorMethod.getString("type");
     switch (type) {
@@ -588,7 +612,10 @@ const getCombinedClusterSupplier = (rootConfig, catalogClient, refreshInterval =
       case "localKubectlProxy":
         return new LocalKubectlProxyClusterLocator();
       case "config":
-        return ConfigClusterLocator.fromConfig(clusterLocatorMethod);
+        return ConfigClusterLocator.fromConfig(
+          clusterLocatorMethod,
+          authStrategy
+        );
       case "gke":
         return GkeClusterLocator.fromConfig(
           clusterLocatorMethod,
@@ -682,8 +709,6 @@ var __publicField$3 = (obj, key, value) => {
   __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
-const isRejected = (input) => input.status === "rejected";
-const isFulfilled = (input) => input.status === "fulfilled";
 const DEFAULT_OBJECTS = [
   {
     group: "",
@@ -794,20 +819,20 @@ class KubernetesFanOutHandler {
     serviceLocator,
     customResources,
     objectTypesToFetch = DEFAULT_OBJECTS,
-    authTranslator
+    authStrategy
   }) {
     __publicField$3(this, "logger");
     __publicField$3(this, "fetcher");
     __publicField$3(this, "serviceLocator");
     __publicField$3(this, "customResources");
     __publicField$3(this, "objectTypesToFetch");
-    __publicField$3(this, "authTranslator");
+    __publicField$3(this, "authStrategy");
     this.logger = logger;
     this.fetcher = fetcher;
     this.serviceLocator = serviceLocator;
     this.customResources = customResources;
     this.objectTypesToFetch = new Set(objectTypesToFetch);
-    this.authTranslator = authTranslator;
+    this.authStrategy = authStrategy;
   }
   async getCustomResourcesByEntity({
     entity,
@@ -830,29 +855,39 @@ class KubernetesFanOutHandler {
   async fanOutRequests(entity, auth, objectTypesToFetch, customResources) {
     var _a, _b, _c, _d, _e, _f, _g;
     const entityName = ((_b = (_a = entity.metadata) == null ? void 0 : _a.annotations) == null ? void 0 : _b["backstage.io/kubernetes-id"]) || ((_c = entity.metadata) == null ? void 0 : _c.name);
-    const clusterDetailsDecoratedForAuth = await this.decorateClusterDetailsWithAuth(entity, auth, {
+    const { clusters } = await this.serviceLocator.getClustersByEntity(entity, {
       objectTypesToFetch,
       customResources: customResources != null ? customResources : []
     });
     this.logger.info(
-      `entity.metadata.name=${entityName} clusterDetails=[${clusterDetailsDecoratedForAuth.map((c) => c.name).join(", ")}]`
+      `entity.metadata.name=${entityName} clusterDetails=[${clusters.map((c) => c.name).join(", ")}]`
     );
     const labelSelector = ((_e = (_d = entity.metadata) == null ? void 0 : _d.annotations) == null ? void 0 : _e["backstage.io/kubernetes-label-selector"]) || `backstage.io/kubernetes-id=${entityName}`;
     const namespace = (_g = (_f = entity.metadata) == null ? void 0 : _f.annotations) == null ? void 0 : _g["backstage.io/kubernetes-namespace"];
     return Promise.all(
-      clusterDetailsDecoratedForAuth.map((clusterDetailsItem) => {
+      clusters.map(async (clusterDetails) => {
+        const credential = await this.authStrategy.getCredential(
+          clusterDetails,
+          auth
+        );
         return this.fetcher.fetchObjectsForService({
           serviceId: entityName,
-          clusterDetails: clusterDetailsItem,
+          clusterDetails,
+          credential,
           objectTypesToFetch,
           labelSelector,
-          customResources: (customResources || clusterDetailsItem.customResources || this.customResources).map((c) => ({
+          customResources: (customResources || clusterDetails.customResources || this.customResources).map((c) => ({
             ...c,
             objectType: "customresources"
           })),
           namespace
         }).then(
-          (result) => this.getMetricsForPods(clusterDetailsItem, labelSelector, result)
+          (result) => this.getMetricsForPods(
+            clusterDetails,
+            credential,
+            labelSelector,
+            result
+          )
         ).catch(
           (e) => e.name === "FetchError" ? Promise.resolve([
             {
@@ -863,22 +898,10 @@ class KubernetesFanOutHandler {
             },
             []
           ]) : Promise.reject(e)
-        ).then((r) => this.toClusterObjects(clusterDetailsItem, r));
+        ).then((r) => this.toClusterObjects(clusterDetails, r));
       })
     ).then(this.toObjectsByEntityResponse);
   }
-  async decorateClusterDetailsWithAuth(entity, auth, requestContext) {
-    const clusterDetails = (await this.serviceLocator.getClustersByEntity(entity, requestContext)).clusters;
-    const promiseResults = await Promise.allSettled(
-      clusterDetails.map((cd) => {
-        return this.authTranslator.decorateClusterDetailsWithAuth(cd, auth);
-      })
-    );
-    promiseResults.filter(isRejected).map((item) => {
-      this.logger.info(`Failed to decorate cluster details: ${item.reason}`);
-    });
-    return promiseResults.filter(isFulfilled).map((item) => item.value);
-  }
   toObjectsByEntityResponse(clusterObjects) {
     return {
       items: clusterObjects.filter(
@@ -909,7 +932,7 @@ class KubernetesFanOutHandler {
     }
     return objects;
   }
-  async getMetricsForPods(clusterDetails, labelSelector, result) {
+  async getMetricsForPods(clusterDetails, credential, labelSelector, result) {
     if (clusterDetails.skipMetricsLookup) {
       return [result, []];
     }
@@ -924,6 +947,7 @@ class KubernetesFanOutHandler {
     }
     const podMetrics = await this.fetcher.fetchPodMetricsByNamespaces(
       clusterDetails,
+      credential,
       namespaces,
       labelSelector
     );
@@ -972,6 +996,7 @@ class KubernetesClientBasedFetcher {
     const fetchResults = Array.from(params.objectTypesToFetch).concat(params.customResources).map(
       ({ objectType, group, apiVersion, plural }) => this.fetchResource(
         params.clusterDetails,
+        params.credential,
         group,
         apiVersion,
         plural,
@@ -991,18 +1016,27 @@ class KubernetesClientBasedFetcher {
     );
     return Promise.all(fetchResults).then(fetchResultsToResponseWrapper);
   }
-  fetchPodMetricsByNamespaces(clusterDetails, namespaces, labelSelector) {
+  fetchPodMetricsByNamespaces(clusterDetails, credential, namespaces, labelSelector) {
     const fetchResults = Array.from(namespaces).map(async (ns) => {
       const [podMetrics, podList] = await Promise.all([
         this.fetchResource(
           clusterDetails,
+          credential,
           "metrics.k8s.io",
           "v1beta1",
           "pods",
           ns,
           labelSelector
         ),
-        this.fetchResource(clusterDetails, "", "v1", "pods", ns, labelSelector)
+        this.fetchResource(
+          clusterDetails,
+          credential,
+          "",
+          "v1",
+          "pods",
+          ns,
+          labelSelector
+        )
       ]);
       if (podMetrics.ok && podList.ok) {
         return clientNode.topPods(
@@ -1036,7 +1070,7 @@ class KubernetesClientBasedFetcher {
       resourcePath
     };
   }
-  fetchResource(clusterDetails, group, apiVersion, plural, namespace, labelSelector) {
+  fetchResource(clusterDetails, credential, group, apiVersion, plural, namespace, labelSelector) {
     const encode = (s) => encodeURIComponent(s);
     let resourcePath = group ? `/apis/${encode(group)}/${encode(apiVersion)}` : `/api/${encode(apiVersion)}`;
     if (namespace) {
@@ -1045,10 +1079,11 @@ class KubernetesClientBasedFetcher {
     resourcePath += `/${encode(plural)}`;
     let url;
     let requestInit;
-    if (clusterDetails.serviceAccountToken || clusterDetails.authProvider === "localKubectlProxy") {
-      [url, requestInit] = this.fetchArgsFromClusterDetails(clusterDetails);
-    } else if (fs__default["default"].pathExistsSync(clientNode.Config.SERVICEACCOUNT_TOKEN_PATH)) {
-      [url, requestInit] = this.fetchArgsInCluster();
+    const authProvider = clusterDetails.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+    if (authProvider === "serviceAccount" && !clusterDetails.authMetadata.serviceAccountToken && fs__default["default"].pathExistsSync(clientNode.Config.SERVICEACCOUNT_CA_PATH)) {
+      [url, requestInit] = this.fetchArgsInCluster(credential);
+    } else if (credential.type === "bearer token" || authProvider === "localKubectlProxy") {
+      [url, requestInit] = this.fetchArgs(clusterDetails, credential);
     } else {
       return Promise.reject(
         new Error(
@@ -1066,14 +1101,16 @@ class KubernetesClientBasedFetcher {
     }
     return fetch__default["default"](url, requestInit);
   }
-  fetchArgsFromClusterDetails(clusterDetails) {
+  fetchArgs(clusterDetails, credential) {
     var _a;
     const requestInit = {
       method: "GET",
       headers: {
         Accept: "application/json",
         "Content-Type": "application/json",
-        Authorization: `Bearer ${clusterDetails.serviceAccountToken}`
+        ...credential.type === "bearer token" && {
+          Authorization: `Bearer ${credential.token}`
+        }
       }
     };
     const url = new URL(clusterDetails.url);
@@ -1088,20 +1125,20 @@ class KubernetesClientBasedFetcher {
     }
     return [url, requestInit];
   }
-  fetchArgsInCluster() {
-    const kc = new clientNode.KubeConfig();
-    kc.loadFromCluster();
-    const cluster = kc.getCurrentCluster();
-    const user = kc.getCurrentUser();
-    const token = fs__default["default"].readFileSync(user.authProvider.config.tokenFile);
+  fetchArgsInCluster(credential) {
     const requestInit = {
       method: "GET",
       headers: {
         Accept: "application/json",
         "Content-Type": "application/json",
-        Authorization: `Bearer ${token}`
+        ...credential.type === "bearer token" && {
+          Authorization: `Bearer ${credential.token}`
+        }
       }
     };
+    const kc = new clientNode.KubeConfig();
+    kc.loadFromCluster();
+    const cluster = kc.getCurrentCluster();
     const url = new URL(cluster.server);
     if (url.protocol === "https:") {
       requestInit.agent = new https__namespace.Agent({
@@ -1125,14 +1162,15 @@ class KubernetesProxy {
     __publicField$1(this, "middlewareForClusterName", /* @__PURE__ */ new Map());
     __publicField$1(this, "logger");
     __publicField$1(this, "clusterSupplier");
-    __publicField$1(this, "authTranslator");
+    __publicField$1(this, "authStrategy");
     this.logger = options.logger;
     this.clusterSupplier = options.clusterSupplier;
-    this.authTranslator = options.authTranslator;
+    this.authStrategy = options.authStrategy;
   }
   createRequestHandler(options) {
     const { permissionApi } = options;
     return async (req, res, next) => {
+      var _a, _b;
       const authorizeResponse = await permissionApi.authorize(
         [{ permission: pluginKubernetesCommon.kubernetesProxyPermission }],
         {
@@ -1150,17 +1188,19 @@ class KubernetesProxy {
       if (authHeader) {
         req.headers.authorization = authHeader;
       } else {
-        const { serviceAccountToken } = await this.getClusterForRequest(
-          req
-        ).then(
-          (cd) => this.authTranslator.decorateClusterDetailsWithAuth(cd, {})
-        );
-        if (serviceAccountToken) {
-          req.headers.authorization = `Bearer ${serviceAccountToken}`;
+        const credential = await this.getClusterForRequest(req).then((cd) => {
+          return this.authStrategy.getCredential(cd, {});
+        });
+        if (credential.type === "bearer token") {
+          req.headers.authorization = `Bearer ${credential.token}`;
         }
       }
       const middleware = await this.getMiddleware(req);
-      middleware(req, res, next);
+      if (((_a = req.header("connection")) == null ? void 0 : _a.toLowerCase()) === "upgrade" && ((_b = req.header("upgrade")) == null ? void 0 : _b.toLowerCase()) === "websocket") {
+        middleware.upgrade(req, req.socket, void 0);
+      } else {
+        middleware(req, res, next);
+      }
     };
   }
   // We create one middleware per remote cluster and hold on to them, because
@@ -1192,7 +1232,10 @@ class KubernetesProxy {
             protocol: url.protocol,
             host: url.hostname,
             port: url.port,
-            ca: (_a = clientNode.bufferFromFileOrString("", cluster.caData)) == null ? void 0 : _a.toString()
+            ca: (_a = clientNode.bufferFromFileOrString(
+              cluster.caFile,
+              cluster.caData
+            )) == null ? void 0 : _a.toString()
           };
         },
         onError: (error, req, res) => {
@@ -1252,7 +1295,7 @@ class KubernetesBuilder {
     __publicField(this, "fetcher");
     __publicField(this, "serviceLocator");
     __publicField(this, "proxy");
-    __publicField(this, "authTranslatorMap");
+    __publicField(this, "authStrategyMap");
   }
   static createBuilder(env) {
     return new KubernetesBuilder(env);
@@ -1276,7 +1319,7 @@ class KubernetesBuilder {
     const customResources = this.buildCustomResources();
     const fetcher = this.getFetcher();
     const clusterSupplier = this.getClusterSupplier();
-    const authTranslatorMap = this.getAuthTranslatorMap();
+    const authStrategyMap = this.getAuthStrategyMap();
     const proxy = this.getProxy(logger, clusterSupplier);
     const serviceLocator = this.getServiceLocator();
     const objectsProvider = this.getObjectsProvider({
@@ -1302,7 +1345,7 @@ class KubernetesBuilder {
       objectsProvider,
       router,
       serviceLocator,
-      authTranslatorMap
+      authStrategyMap
     };
   }
   setClusterSupplier(clusterSupplier) {
@@ -1329,8 +1372,12 @@ class KubernetesBuilder {
     this.proxy = proxy;
     return this;
   }
-  setAuthTranslatorMap(authTranslatorMap) {
-    this.authTranslatorMap = authTranslatorMap;
+  setAuthStrategyMap(authStrategyMap) {
+    this.authStrategyMap = authStrategyMap;
+  }
+  addAuthStrategy(key, strategy) {
+    this.getAuthStrategyMap()[key] = strategy;
+    return this;
   }
   buildCustomResources() {
     var _a;
@@ -1352,16 +1399,17 @@ class KubernetesBuilder {
     this.clusterSupplier = getCombinedClusterSupplier(
       config,
       this.env.catalogApi,
+      new DispatchStrategy({ authStrategyMap: this.getAuthStrategyMap() }),
       refreshInterval
     );
     return this.clusterSupplier;
   }
   buildObjectsProvider(options) {
-    const authTranslatorMap = this.getAuthTranslatorMap();
+    const authStrategyMap = this.getAuthStrategyMap();
     this.objectsProvider = new KubernetesFanOutHandler({
       ...options,
-      authTranslator: new DispatchingKubernetesAuthTranslator({
-        authTranslatorMap
+      authStrategy: new DispatchStrategy({
+        authStrategyMap
       })
     });
     return this.objectsProvider;
@@ -1394,14 +1442,14 @@ class KubernetesBuilder {
     throw new Error("not implemented");
   }
   buildProxy(logger, clusterSupplier) {
-    const authTranslatorMap = this.getAuthTranslatorMap();
-    const authTranslator = new DispatchingKubernetesAuthTranslator({
-      authTranslatorMap
+    const authStrategyMap = this.getAuthStrategyMap();
+    const authStrategy = new DispatchStrategy({
+      authStrategyMap
     });
     this.proxy = new KubernetesProxy({
       logger,
       clusterSupplier,
-      authTranslator
+      authStrategy
     });
     return this.proxy;
   }
@@ -1434,29 +1482,32 @@ class KubernetesBuilder {
     router.get("/clusters", async (_, res) => {
       const clusterDetails = await this.fetchClusterDetails(clusterSupplier);
       res.json({
-        items: clusterDetails.map((cd) => ({
-          name: cd.name,
-          dashboardUrl: cd.dashboardUrl,
-          authProvider: cd.authProvider,
-          oidcTokenProvider: cd.oidcTokenProvider
-        }))
+        items: clusterDetails.map((cd) => {
+          const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
+          return {
+            name: cd.name,
+            dashboardUrl: cd.dashboardUrl,
+            authProvider: cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER],
+            ...oidcTokenProvider && { oidcTokenProvider }
+          };
+        })
       });
     });
     addResourceRoutesToRouter(router, catalogApi, objectsProvider);
     return router;
   }
-  buildAuthTranslatorMap() {
-    this.authTranslatorMap = {
-      google: new GoogleKubernetesAuthTranslator(),
-      aks: new AksKubernetesAuthTranslator(),
-      aws: new AwsIamKubernetesAuthTranslator({ config: this.env.config }),
-      azure: new AzureIdentityKubernetesAuthTranslator(this.env.logger),
-      serviceAccount: new NoopKubernetesAuthTranslator(),
-      googleServiceAccount: new GoogleServiceAccountAuthTranslator(),
-      oidc: new OidcKubernetesAuthTranslator(),
-      localKubectlProxy: new NoopKubernetesAuthTranslator()
+  buildAuthStrategyMap() {
+    this.authStrategyMap = {
+      aks: new AksStrategy(),
+      aws: new AwsIamStrategy({ config: this.env.config }),
+      azure: new AzureIdentityStrategy(this.env.logger),
+      google: new GoogleStrategy(),
+      googleServiceAccount: new GoogleServiceAccountStrategy(),
+      localKubectlProxy: new AnonymousStrategy(),
+      oidc: new OidcStrategy(),
+      serviceAccount: new ServiceAccountStrategy()
     };
-    return this.authTranslatorMap;
+    return this.authStrategyMap;
   }
   async fetchClusterDetails(clusterSupplier) {
     const clusterDetails = await clusterSupplier.getClusters();
@@ -1516,9 +1567,9 @@ class KubernetesBuilder {
     var _a;
     return (_a = this.proxy) != null ? _a : this.buildProxy(logger, clusterSupplier);
   }
-  getAuthTranslatorMap() {
+  getAuthStrategyMap() {
     var _a;
-    return (_a = this.authTranslatorMap) != null ? _a : this.buildAuthTranslatorMap();
+    return (_a = this.authStrategyMap) != null ? _a : this.buildAuthStrategyMap();
   }
 }
 
@@ -1527,18 +1578,19 @@ async function createRouter(options) {
   return router;
 }
 
-exports.AksKubernetesAuthTranslator = AksKubernetesAuthTranslator;
-exports.AwsIamKubernetesAuthTranslator = AwsIamKubernetesAuthTranslator;
-exports.AzureIdentityKubernetesAuthTranslator = AzureIdentityKubernetesAuthTranslator;
+exports.AksStrategy = AksStrategy;
+exports.AnonymousStrategy = AnonymousStrategy;
+exports.AwsIamStrategy = AwsIamStrategy;
+exports.AzureIdentityStrategy = AzureIdentityStrategy;
 exports.DEFAULT_OBJECTS = DEFAULT_OBJECTS;
-exports.DispatchingKubernetesAuthTranslator = DispatchingKubernetesAuthTranslator;
-exports.GoogleKubernetesAuthTranslator = GoogleKubernetesAuthTranslator;
-exports.GoogleServiceAccountAuthTranslator = GoogleServiceAccountAuthTranslator;
+exports.DispatchStrategy = DispatchStrategy;
+exports.GoogleServiceAccountStrategy = GoogleServiceAccountStrategy;
+exports.GoogleStrategy = GoogleStrategy;
 exports.HEADER_KUBERNETES_AUTH = HEADER_KUBERNETES_AUTH;
 exports.HEADER_KUBERNETES_CLUSTER = HEADER_KUBERNETES_CLUSTER;
 exports.KubernetesBuilder = KubernetesBuilder;
 exports.KubernetesProxy = KubernetesProxy;
-exports.NoopKubernetesAuthTranslator = NoopKubernetesAuthTranslator;
-exports.OidcKubernetesAuthTranslator = OidcKubernetesAuthTranslator;
+exports.OidcStrategy = OidcStrategy;
+exports.ServiceAccountStrategy = ServiceAccountStrategy;
 exports.createRouter = createRouter;
 //# sourceMappingURL=index.cjs.js.map