@backstage/plugin-kubernetes-backend 0.21.7-next.1 → 0.21.8

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @backstage/plugin-kubernetes-backend
 
+## 0.21.8
+
+### Patch Changes
+
+- 9d950fa: Improved entity resolution on the deprecated services endpoint.
+
+## 0.21.7
+
+### Patch Changes
+
+- 684c9b9: Fixed `AwsIamStrategy` to resolve account-specific AWS credentials when an assume role ARN is configured, enabling support for `webIdentityTokenFile` and `accountDefaults` in environments without default AWS credentials.
+- c6af8ac: Added audit logging for kubernetes-backend routes. The plugin now emits auditor events for cluster list, cluster proxy, entity workload queries, custom resource queries, and the deprecated services endpoint. Administrators can filter audit logs by `eventId` values `cluster-fetch` and `resource-fetch`, and by `queryType` in event metadata.
+
+  `KubernetesProxyOptions` accepts an optional `auditor` for adopters that construct the proxy directly. When omitted, proxy requests are handled as before without audit events.
+
+- bac00a5: The Kubernetes API proxy now refreshes cached middleware when cluster details change, after a configurable TTL, or when the cache reaches its size limit. At startup, the backend logs a warning for each cluster configured with `skipTLSVerify: true`. Invalid cache configuration values fall back to defaults. Optional configuration is available under `kubernetes.proxy.middlewareCache`.
+- f0834bd: Added a `kubernetes.clusterLocatorContinueOnError` configuration option. When set to `true`, a failing cluster locator no longer causes the entire cluster list request to fail — errors are logged and clusters from the remaining successful locators are still returned. The default is `false`, preserving the existing behavior.
+- Updated dependencies
+  - @backstage/catalog-model@1.10.0
+  - @backstage/backend-plugin-api@1.10.0
+  - @backstage/integration-aws-node@0.2.1
+  - @backstage/plugin-permission-common@0.9.10
+  - @backstage/plugin-permission-node@0.11.3
+  - @backstage/plugin-catalog-node@2.2.4
+  - @backstage/plugin-kubernetes-node@0.4.7
+
 ## 0.22.0-next.1
 
 ### Minor Changes

package/config.schema.json

@@ -289,6 +289,30 @@
             }
           },
           "description": "(Optional) API Version Overrides If set, the specified api version will be used to make requests for the corresponding object. If running a legacy Kubernetes version, you may use this to override the default api versions that are not supported in your cluster."
+        },
+        "proxy": {
+          "type": "object",
+          "properties": {
+            "middlewareCache": {
+              "type": "object",
+              "properties": {
+                "maxSize": {
+                  "type": "number",
+                  "description": "Maximum number of cached middleware instances. Defaults to 100."
+                },
+                "ttl": {
+                  "type": "object",
+                  "properties": {
+                    "milliseconds": {
+                      "type": "number",
+                      "description": "Time-to-live for cached middleware in milliseconds. Defaults to 60000."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "description": "Options for the Kubernetes API proxy middleware cache."
         }
       },
       "required": [

package/dist/index.d.ts

@@ -223,6 +223,10 @@ type KubernetesProxyOptions = {
     discovery: DiscoveryService;
     httpAuth: HttpAuthService;
     auditor?: AuditorService;
+    middlewareCache?: {
+        ttlMs?: number;
+        maxSize?: number;
+    };
 };
 /**
  * A proxy that routes requests to the Kubernetes API.
@@ -230,7 +234,7 @@ type KubernetesProxyOptions = {
  * @public
  */
 declare class KubernetesProxy {
-    private readonly middlewareForClusterName;
+    private readonly middlewareCache;
     private readonly logger;
     private readonly clusterSupplier;
     private readonly authStrategy;

package/dist/package.json.cjs.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "0.21.7-next.1";
+var version = "0.21.8";
 var packageinfo = {
 	version: version};
 

package/dist/service/KubernetesProxy.cjs.js

@@ -5,6 +5,7 @@ var pluginKubernetesCommon = require('@backstage/plugin-kubernetes-common');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var httpProxyMiddleware = require('http-proxy-middleware');
 var fs = require('fs-extra');
+var ProxyMiddlewareCache = require('./ProxyMiddlewareCache.cjs.js');
 var ProxyAuditSession = require('./ProxyAuditSession.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -15,7 +16,7 @@ const PROXY_PREPARED_TARGET = /* @__PURE__ */ Symbol("kubernetesProxyPreparedTar
 const HEADER_KUBERNETES_CLUSTER = "Backstage-Kubernetes-Cluster";
 const HEADER_KUBERNETES_AUTH = "Backstage-Kubernetes-Authorization";
 class KubernetesProxy {
-  middlewareForClusterName = /* @__PURE__ */ new Map();
+  middlewareCache;
   logger;
   clusterSupplier;
   authStrategy;
@@ -27,6 +28,9 @@ class KubernetesProxy {
     this.authStrategy = options.authStrategy;
     this.httpAuth = options.httpAuth;
     this.auditor = options.auditor;
+    this.middlewareCache = new ProxyMiddlewareCache.ProxyMiddlewareCache(
+      ProxyMiddlewareCache.resolveProxyMiddlewareCacheOptions(options.middlewareCache)
+    );
   }
   createRequestHandler(options) {
     const { permissionApi } = options;
@@ -147,18 +151,21 @@ class KubernetesProxy {
     }
     const requestPath = req.originalUrl || req.url || "";
     const rewrittenPath = requestPath.replace(
-      new RegExp(`^${req.baseUrl || ""}`),
+      new RegExp(
+        `^${(req.baseUrl || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`
+      ),
       url.pathname || ""
     );
     return { proxyTarget: target, rewrittenPath, cluster };
   }
   // We create one middleware per remote cluster and hold on to them, because
   // the secure property isn't possible to decide on a per-request basis with a
-  // single middleware instance - and we don't expect it to change over time.
-  // Target resolution and path rewriting are handled per-request via the
-  // PROXY_PREPARED_TARGET symbol stashed on each req by prepareProxyTarget.
+  // single middleware instance. Target resolution and path rewriting are handled
+  // per-request via the PROXY_PREPARED_TARGET symbol stashed on each req by
+  // prepareProxyTarget. Entries are refreshed after a TTL or when cluster details
+  // change.
   getOrCreateMiddleware(cluster) {
-    let middleware = this.middlewareForClusterName.get(cluster.name);
+    let middleware = this.middlewareCache.get(cluster);
     if (!middleware) {
       const logger = this.logger.child({ cluster: cluster.name });
       middleware = httpProxyMiddleware.createProxyMiddleware({
@@ -201,7 +208,7 @@ class KubernetesProxy {
         },
         onProxyReqWs: ProxyAuditSession.ProxyAuditSession.handleWebSocketProxyReq
       });
-      this.middlewareForClusterName.set(cluster.name, middleware);
+      this.middlewareCache.set(cluster, middleware);
     }
     return middleware;
   }

package/dist/service/KubernetesProxy.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport type { NextFunction, Request, Response } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  AuditorService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport { ProxyAuditSession } from './ProxyAuditSession';\n\nconst PROXY_PREPARED_TARGET = Symbol('kubernetesProxyPreparedTarget');\n\ntype PreparedProxyTarget = {\n  proxyTarget: any;\n  rewrittenPath: string;\n  cluster: ClusterDetails;\n};\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n  auditor?: AuditorService;\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareForClusterName = new Map<string, RequestHandler>();\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auditor?: AuditorService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n    this.auditor = options.auditor;\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const clusterNameHeader =\n        req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n      const clusterName =\n        typeof clusterNameHeader === 'string' && clusterNameHeader.length > 0\n          ? clusterNameHeader\n          : 'unknown';\n      const path = req.path || req.url.split('?')[0] || '';\n\n      let clientDisconnected = false;\n      const onSocketClose = () => {\n        clientDisconnected = true;\n      };\n      req.socket.once('close', onSocketClose);\n\n      let auditSession: ProxyAuditSession | undefined;\n      let finishListenerAttached = false;\n      try {\n        auditSession = await ProxyAuditSession.start(this.auditor, {\n          req,\n          clusterName,\n          method: req.method,\n          path,\n          logger: this.logger,\n        });\n\n        finishListenerAttached = await this.authorizeAndDispatch(\n          req,\n          res,\n          next,\n          permissionApi,\n          auditSession,\n          onSocketClose,\n          () => clientDisconnected,\n        );\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        const err = error instanceof Error ? error : new Error(String(error));\n        if (auditSession && !finishListenerAttached) {\n          auditSession.finalize(err);\n        }\n        throw error;\n      }\n    };\n  }\n\n  /**\n   * Authorizes the request, resolves the target cluster, and dispatches\n   * to either the HTTP or WebSocket proxy path. Returns `true` when\n   * HTTP finish listeners have been attached.\n   */\n  private async authorizeAndDispatch(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    permissionApi: PermissionsService,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n    isClientDisconnected: () => boolean,\n  ): Promise<boolean> {\n    const authorizeResponse = await permissionApi.authorize(\n      [{ permission: kubernetesProxyPermission }],\n      { credentials: await this.httpAuth.credentials(req) },\n    );\n\n    if (authorizeResponse[0].result === AuthorizeResult.DENY) {\n      req.socket.removeListener('close', onSocketClose);\n      auditSession.finalize(new NotAllowedError('Unauthorized'));\n      res.status(403).json({\n        error: serializeError(new NotAllowedError('Unauthorized')),\n      });\n      return false;\n    }\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    const prepared = await this.prepareProxyTarget(req);\n    auditSession.setResolvedClusterName(prepared.cluster.name);\n    (req as any)[PROXY_PREPARED_TARGET] = prepared;\n    const middleware = this.getOrCreateMiddleware(prepared.cluster);\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    return KubernetesProxy.dispatchToProxy(\n      req,\n      res,\n      next,\n      middleware,\n      auditSession,\n      onSocketClose,\n    );\n  }\n\n  /**\n   * Resolves the cluster, credentials, and target URL for a proxy request\n   * before dispatching to the middleware. This ensures all async preparation\n   * completes under the caller's try/catch, avoiding unhandled rejections\n   * from http-proxy-middleware's fire-and-forget upgrade() path.\n   */\n  private async prepareProxyTarget(req: Request): Promise<PreparedProxyTarget> {\n    const cluster = await this.getClusterForRequest(req);\n    const url = new URL(cluster.url);\n\n    const { bufferFromFileOrString } = await import('@kubernetes/client-node');\n\n    const target: any = {\n      protocol: url.protocol,\n      host: url.hostname,\n      port: url.port,\n      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString(),\n    };\n\n    const authHeader =\n      req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n    if (typeof authHeader === 'string') {\n      req.headers.authorization = authHeader;\n    } else {\n      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n        req.headers,\n      );\n\n      const credential = await this.authStrategy.getCredential(\n        cluster,\n        authObj,\n      );\n\n      if (credential.type === 'bearer token') {\n        req.headers.authorization = `Bearer ${credential.token}`;\n      } else if (credential.type === 'x509 client certificate') {\n        target.key = credential.key;\n        target.cert = credential.cert;\n      }\n    }\n\n    const requestPath = req.originalUrl || req.url || '';\n    const rewrittenPath = requestPath.replace(\n      new RegExp(`^${req.baseUrl || ''}`),\n      url.pathname || '',\n    );\n\n    return { proxyTarget: target, rewrittenPath, cluster };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance - and we don't expect it to change over time.\n  // Target resolution and path rewriting are handled per-request via the\n  // PROXY_PREPARED_TARGET symbol stashed on each req by prepareProxyTarget.\n  private getOrCreateMiddleware(cluster: ClusterDetails): RequestHandler {\n    let middleware = this.middlewareForClusterName.get(cluster.name);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: cluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        // ws must be false to prevent http-proxy-middleware from auto-subscribing\n        // to the server's 'upgrade' event, which would bypass Express routing and\n        // skip audit event creation for WebSocket requests.\n        ws: false,\n        secure: !cluster.skipTLSVerify,\n        changeOrigin: true,\n        router: req => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.proxyTarget;\n        },\n        pathRewrite: (_path, req) => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${cluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          if (typeof (res as { status?: unknown }).status !== 'function') {\n            return;\n          }\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n        onProxyReqWs: ProxyAuditSession.handleWebSocketProxyReq,\n      });\n      this.middlewareForClusterName.set(cluster.name, middleware);\n    }\n    return middleware;\n  }\n\n  /**\n   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires\n   * up the appropriate audit listeners. Returns `true` when HTTP finish\n   * listeners have been attached (used by the caller's catch block to\n   * avoid double-finalizing).\n   */\n  private static dispatchToProxy(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    middleware: RequestHandler,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n  ): boolean {\n    const isWebSocketUpgrade =\n      (req.header('connection') ?? '')\n        .toLowerCase()\n        .split(',')\n        .some(t => t.trim() === 'upgrade') &&\n      req.header('upgrade')?.toLowerCase() === 'websocket';\n\n    if (isWebSocketUpgrade) {\n      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);\n\n      try {\n        middleware.upgrade!(req, req.socket, undefined);\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        auditSession.finalize(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        throw error;\n      }\n      return false;\n    }\n\n    // HTTP path: remove the early close listener; HTTP audit listeners\n    // on the response take over from here.\n    req.socket.removeListener('close', onSocketClose);\n    auditSession.attachToHttpResponse(res);\n    middleware(req, res, next);\n    return true;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["ProxyAuditSession","kubernetesProxyPermission","AuthorizeResult","NotAllowedError","serializeError","createProxyMiddleware","ForwardedError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;;AAkDA,MAAM,qBAAA,0BAA+B,+BAA+B,CAAA;AAa7D,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AA8BK,MAAM,eAAA,CAAgB;AAAA,EACV,wBAAA,uBAA+B,GAAA,EAA4B;AAAA,EAC3D,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AAAA,EACzB;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACrD,MAAA,MAAM,cACJ,OAAO,iBAAA,KAAsB,YAAY,iBAAA,CAAkB,MAAA,GAAS,IAChE,iBAAA,GACA,SAAA;AACN,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,IAAQ,GAAA,CAAI,IAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAElD,MAAA,IAAI,kBAAA,GAAqB,KAAA;AACzB,MAAA,MAAM,gBAAgB,MAAM;AAC1B,QAAA,kBAAA,GAAqB,IAAA;AAAA,MACvB,CAAA;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAEtC,MAAA,IAAI,YAAA;AACJ,MAAA,IAAI,sBAAA,GAAyB,KAAA;AAC7B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAMA,mCAAA,CAAkB,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS;AAAA,UACzD,GAAA;AAAA,UACA,WAAA;AAAA,UACA,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,sBAAA,GAAyB,MAAM,IAAA,CAAK,oBAAA;AAAA,UAClC,GAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA;AAAA,UACA,aAAA;AAAA,UACA,YAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAM;AAAA,SACR;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,QAAA,IAAI,YAAA,IAAgB,CAAC,sBAAA,EAAwB;AAC3C,UAAA,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,QAC3B;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,qBACZ,GAAA,EACA,GAAA,EACA,MACA,aAAA,EACA,YAAA,EACA,eACA,oBAAA,EACkB;AAClB,IAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,MAC5C,CAAC,EAAE,UAAA,EAAYC,gDAAA,EAA2B,CAAA;AAAA,MAC1C,EAAE,WAAA,EAAa,MAAM,KAAK,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,KACtD;AAEA,IAAA,IAAI,iBAAA,CAAkB,CAAC,CAAA,CAAE,MAAA,KAAWC,uCAAgB,IAAA,EAAM;AACxD,MAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,MAAA,YAAA,CAAa,QAAA,CAAS,IAAIC,sBAAA,CAAgB,cAAc,CAAC,CAAA;AACzD,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,KAAA,EAAOC,qBAAA,CAAe,IAAID,sBAAA,CAAgB,cAAc,CAAC;AAAA,OAC1D,CAAA;AACD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,kBAAA,CAAmB,GAAG,CAAA;AAClD,IAAA,YAAA,CAAa,sBAAA,CAAuB,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AACzD,IAAC,GAAA,CAAY,qBAAqB,CAAA,GAAI,QAAA;AACtC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,qBAAA,CAAsB,QAAA,CAAS,OAAO,CAAA;AAE9D,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,eAAA,CAAgB,eAAA;AAAA,MACrB,GAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,mBAAmB,GAAA,EAA4C;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,IAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAEzE,IAAA,MAAM,MAAA,GAAc;AAAA,MAClB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI,QAAA;AAAA,MACV,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,IAAI,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAM,GAAG,QAAA;AAAS,KACvE;AAEA,IAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,QAC9B,GAAA,CAAI;AAAA,OACN;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA;AAAA,QACzC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,QAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,QAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,QAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,MAC3B;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,EAAA;AAClD,IAAA,MAAM,gBAAgB,WAAA,CAAY,OAAA;AAAA,MAChC,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,CAAE,CAAA;AAAA,MAClC,IAAI,QAAA,IAAY;AAAA,KAClB;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAA,EAAe,OAAA,EAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,sBAAsB,OAAA,EAAyC;AACrE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC/D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAA;AAC1D,MAAA,UAAA,GAAaE,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA;AAAA;AAAA;AAAA,QAIA,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,OAAA,CAAQ,aAAA;AAAA,QACjB,YAAA,EAAc,IAAA;AAAA,QACd,QAAQ,CAAA,GAAA,KAAO;AACb,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,WAAA;AAAA,QAC9C,CAAA;AAAA,QACA,WAAA,EAAa,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC3B,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,aAAA,IAAiB,KAAA;AAAA,QAC/D,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,QAAQ,IAAI,CAAA,eAAA,CAAA;AAAA,YACxB;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,IAAI,OAAQ,GAAA,CAA6B,MAAA,KAAW,UAAA,EAAY;AAC9D,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOF,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B,CAAA;AAAA,QACA,cAAcJ,mCAAA,CAAkB;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,UAAU,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAe,eAAA,CACb,GAAA,EACA,KACA,IAAA,EACA,UAAA,EACA,cACA,aAAA,EACS;AACT,IAAA,MAAM,kBAAA,GAAA,CACH,IAAI,MAAA,CAAO,YAAY,KAAK,EAAA,EAC1B,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA,CACT,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAK,KAAM,SAAS,CAAA,IACnC,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,EAAY,KAAM,WAAA;AAE3C,IAAA,IAAI,kBAAA,EAAoB;AACtB,MAAA,YAAA,CAAa,0BAAA,CAA2B,KAAK,aAAa,CAAA;AAE1D,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAS,CAAA;AAAA,MAChD,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,YAAA,CAAa,QAAA;AAAA,UACX,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,SAC1D;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,IAAA,YAAA,CAAa,qBAAqB,GAAG,CAAA;AACrC,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIO,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}
+{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport {\n  ProxyMiddlewareCache,\n  resolveProxyMiddlewareCacheOptions,\n} from './ProxyMiddlewareCache';\n\nimport type { NextFunction, Request, Response } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  AuditorService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport { ProxyAuditSession } from './ProxyAuditSession';\n\nconst PROXY_PREPARED_TARGET = Symbol('kubernetesProxyPreparedTarget');\n\ntype PreparedProxyTarget = {\n  proxyTarget: any;\n  rewrittenPath: string;\n  cluster: ClusterDetails;\n};\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n  auditor?: AuditorService;\n  middlewareCache?: {\n    ttlMs?: number;\n    maxSize?: number;\n  };\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareCache: ProxyMiddlewareCache;\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auditor?: AuditorService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n    this.auditor = options.auditor;\n    this.middlewareCache = new ProxyMiddlewareCache(\n      resolveProxyMiddlewareCacheOptions(options.middlewareCache),\n    );\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const clusterNameHeader =\n        req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n      const clusterName =\n        typeof clusterNameHeader === 'string' && clusterNameHeader.length > 0\n          ? clusterNameHeader\n          : 'unknown';\n      const path = req.path || req.url.split('?')[0] || '';\n\n      let clientDisconnected = false;\n      const onSocketClose = () => {\n        clientDisconnected = true;\n      };\n      req.socket.once('close', onSocketClose);\n\n      let auditSession: ProxyAuditSession | undefined;\n      let finishListenerAttached = false;\n      try {\n        auditSession = await ProxyAuditSession.start(this.auditor, {\n          req,\n          clusterName,\n          method: req.method,\n          path,\n          logger: this.logger,\n        });\n\n        finishListenerAttached = await this.authorizeAndDispatch(\n          req,\n          res,\n          next,\n          permissionApi,\n          auditSession,\n          onSocketClose,\n          () => clientDisconnected,\n        );\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        const err = error instanceof Error ? error : new Error(String(error));\n        if (auditSession && !finishListenerAttached) {\n          auditSession.finalize(err);\n        }\n        throw error;\n      }\n    };\n  }\n\n  /**\n   * Authorizes the request, resolves the target cluster, and dispatches\n   * to either the HTTP or WebSocket proxy path. Returns `true` when\n   * HTTP finish listeners have been attached.\n   */\n  private async authorizeAndDispatch(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    permissionApi: PermissionsService,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n    isClientDisconnected: () => boolean,\n  ): Promise<boolean> {\n    const authorizeResponse = await permissionApi.authorize(\n      [{ permission: kubernetesProxyPermission }],\n      { credentials: await this.httpAuth.credentials(req) },\n    );\n\n    if (authorizeResponse[0].result === AuthorizeResult.DENY) {\n      req.socket.removeListener('close', onSocketClose);\n      auditSession.finalize(new NotAllowedError('Unauthorized'));\n      res.status(403).json({\n        error: serializeError(new NotAllowedError('Unauthorized')),\n      });\n      return false;\n    }\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    const prepared = await this.prepareProxyTarget(req);\n    auditSession.setResolvedClusterName(prepared.cluster.name);\n    (req as any)[PROXY_PREPARED_TARGET] = prepared;\n    const middleware = this.getOrCreateMiddleware(prepared.cluster);\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    return KubernetesProxy.dispatchToProxy(\n      req,\n      res,\n      next,\n      middleware,\n      auditSession,\n      onSocketClose,\n    );\n  }\n\n  /**\n   * Resolves the cluster, credentials, and target URL for a proxy request\n   * before dispatching to the middleware. This ensures all async preparation\n   * completes under the caller's try/catch, avoiding unhandled rejections\n   * from http-proxy-middleware's fire-and-forget upgrade() path.\n   */\n  private async prepareProxyTarget(req: Request): Promise<PreparedProxyTarget> {\n    const cluster = await this.getClusterForRequest(req);\n    const url = new URL(cluster.url);\n\n    const { bufferFromFileOrString } = await import('@kubernetes/client-node');\n\n    const target: any = {\n      protocol: url.protocol,\n      host: url.hostname,\n      port: url.port,\n      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString(),\n    };\n\n    const authHeader =\n      req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n    if (typeof authHeader === 'string') {\n      req.headers.authorization = authHeader;\n    } else {\n      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n        req.headers,\n      );\n\n      const credential = await this.authStrategy.getCredential(\n        cluster,\n        authObj,\n      );\n\n      if (credential.type === 'bearer token') {\n        req.headers.authorization = `Bearer ${credential.token}`;\n      } else if (credential.type === 'x509 client certificate') {\n        target.key = credential.key;\n        target.cert = credential.cert;\n      }\n    }\n\n    const requestPath = req.originalUrl || req.url || '';\n    const rewrittenPath = requestPath.replace(\n      new RegExp(\n        `^${(req.baseUrl || '').replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}`,\n      ),\n      url.pathname || '',\n    );\n\n    return { proxyTarget: target, rewrittenPath, cluster };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance. Target resolution and path rewriting are handled\n  // per-request via the PROXY_PREPARED_TARGET symbol stashed on each req by\n  // prepareProxyTarget. Entries are refreshed after a TTL or when cluster details\n  // change.\n  private getOrCreateMiddleware(cluster: ClusterDetails): RequestHandler {\n    let middleware = this.middlewareCache.get(cluster);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: cluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        // ws must be false to prevent http-proxy-middleware from auto-subscribing\n        // to the server's 'upgrade' event, which would bypass Express routing and\n        // skip audit event creation for WebSocket requests.\n        ws: false,\n        secure: !cluster.skipTLSVerify,\n        changeOrigin: true,\n        router: req => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.proxyTarget;\n        },\n        pathRewrite: (_path, req) => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${cluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          if (typeof (res as { status?: unknown }).status !== 'function') {\n            return;\n          }\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n        onProxyReqWs: ProxyAuditSession.handleWebSocketProxyReq,\n      });\n      this.middlewareCache.set(cluster, middleware);\n    }\n    return middleware;\n  }\n\n  /**\n   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires\n   * up the appropriate audit listeners. Returns `true` when HTTP finish\n   * listeners have been attached (used by the caller's catch block to\n   * avoid double-finalizing).\n   */\n  private static dispatchToProxy(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    middleware: RequestHandler,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n  ): boolean {\n    const isWebSocketUpgrade =\n      (req.header('connection') ?? '')\n        .toLowerCase()\n        .split(',')\n        .some(t => t.trim() === 'upgrade') &&\n      req.header('upgrade')?.toLowerCase() === 'websocket';\n\n    if (isWebSocketUpgrade) {\n      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);\n\n      try {\n        middleware.upgrade!(req, req.socket, undefined);\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        auditSession.finalize(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        throw error;\n      }\n      return false;\n    }\n\n    // HTTP path: remove the early close listener; HTTP audit listeners\n    // on the response take over from here.\n    req.socket.removeListener('close', onSocketClose);\n    auditSession.attachToHttpResponse(res);\n    middleware(req, res, next);\n    return true;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["ProxyMiddlewareCache","resolveProxyMiddlewareCacheOptions","ProxyAuditSession","kubernetesProxyPermission","AuthorizeResult","NotAllowedError","serializeError","createProxyMiddleware","ForwardedError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;;;AAuDA,MAAM,qBAAA,0BAA+B,+BAA+B,CAAA;AAa7D,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AAkCK,MAAM,eAAA,CAAgB;AAAA,EACV,eAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,kBAAkB,IAAIA,yCAAA;AAAA,MACzBC,uDAAA,CAAmC,QAAQ,eAAe;AAAA,KAC5D;AAAA,EACF;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACrD,MAAA,MAAM,cACJ,OAAO,iBAAA,KAAsB,YAAY,iBAAA,CAAkB,MAAA,GAAS,IAChE,iBAAA,GACA,SAAA;AACN,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,IAAQ,GAAA,CAAI,IAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAElD,MAAA,IAAI,kBAAA,GAAqB,KAAA;AACzB,MAAA,MAAM,gBAAgB,MAAM;AAC1B,QAAA,kBAAA,GAAqB,IAAA;AAAA,MACvB,CAAA;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAEtC,MAAA,IAAI,YAAA;AACJ,MAAA,IAAI,sBAAA,GAAyB,KAAA;AAC7B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAMC,mCAAA,CAAkB,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS;AAAA,UACzD,GAAA;AAAA,UACA,WAAA;AAAA,UACA,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,sBAAA,GAAyB,MAAM,IAAA,CAAK,oBAAA;AAAA,UAClC,GAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA;AAAA,UACA,aAAA;AAAA,UACA,YAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAM;AAAA,SACR;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,QAAA,IAAI,YAAA,IAAgB,CAAC,sBAAA,EAAwB;AAC3C,UAAA,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,QAC3B;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,qBACZ,GAAA,EACA,GAAA,EACA,MACA,aAAA,EACA,YAAA,EACA,eACA,oBAAA,EACkB;AAClB,IAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,MAC5C,CAAC,EAAE,UAAA,EAAYC,gDAAA,EAA2B,CAAA;AAAA,MAC1C,EAAE,WAAA,EAAa,MAAM,KAAK,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,KACtD;AAEA,IAAA,IAAI,iBAAA,CAAkB,CAAC,CAAA,CAAE,MAAA,KAAWC,uCAAgB,IAAA,EAAM;AACxD,MAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,MAAA,YAAA,CAAa,QAAA,CAAS,IAAIC,sBAAA,CAAgB,cAAc,CAAC,CAAA;AACzD,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,KAAA,EAAOC,qBAAA,CAAe,IAAID,sBAAA,CAAgB,cAAc,CAAC;AAAA,OAC1D,CAAA;AACD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,kBAAA,CAAmB,GAAG,CAAA;AAClD,IAAA,YAAA,CAAa,sBAAA,CAAuB,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AACzD,IAAC,GAAA,CAAY,qBAAqB,CAAA,GAAI,QAAA;AACtC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,qBAAA,CAAsB,QAAA,CAAS,OAAO,CAAA;AAE9D,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,eAAA,CAAgB,eAAA;AAAA,MACrB,GAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,mBAAmB,GAAA,EAA4C;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,IAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAEzE,IAAA,MAAM,MAAA,GAAc;AAAA,MAClB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI,QAAA;AAAA,MACV,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,IAAI,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAM,GAAG,QAAA;AAAS,KACvE;AAEA,IAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,QAC9B,GAAA,CAAI;AAAA,OACN;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA;AAAA,QACzC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,QAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,QAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,QAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,MAC3B;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,EAAA;AAClD,IAAA,MAAM,gBAAgB,WAAA,CAAY,OAAA;AAAA,MAChC,IAAI,MAAA;AAAA,QACF,KAAK,GAAA,CAAI,OAAA,IAAW,IAAI,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAC,CAAA;AAAA,OAChE;AAAA,MACA,IAAI,QAAA,IAAY;AAAA,KAClB;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAA,EAAe,OAAA,EAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,sBAAsB,OAAA,EAAyC;AACrE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAA;AAC1D,MAAA,UAAA,GAAaE,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA;AAAA;AAAA;AAAA,QAIA,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,OAAA,CAAQ,aAAA;AAAA,QACjB,YAAA,EAAc,IAAA;AAAA,QACd,QAAQ,CAAA,GAAA,KAAO;AACb,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,WAAA;AAAA,QAC9C,CAAA;AAAA,QACA,WAAA,EAAa,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC3B,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,aAAA,IAAiB,KAAA;AAAA,QAC/D,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,QAAQ,IAAI,CAAA,eAAA,CAAA;AAAA,YACxB;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,IAAI,OAAQ,GAAA,CAA6B,MAAA,KAAW,UAAA,EAAY;AAC9D,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOF,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B,CAAA;AAAA,QACA,cAAcJ,mCAAA,CAAkB;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAA,EAAS,UAAU,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAe,eAAA,CACb,GAAA,EACA,KACA,IAAA,EACA,UAAA,EACA,cACA,aAAA,EACS;AACT,IAAA,MAAM,kBAAA,GAAA,CACH,IAAI,MAAA,CAAO,YAAY,KAAK,EAAA,EAC1B,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA,CACT,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAK,KAAM,SAAS,CAAA,IACnC,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,EAAY,KAAM,WAAA;AAE3C,IAAA,IAAI,kBAAA,EAAoB;AACtB,MAAA,YAAA,CAAa,0BAAA,CAA2B,KAAK,aAAa,CAAA;AAE1D,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAS,CAAA;AAAA,MAChD,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,YAAA,CAAa,QAAA;AAAA,UACX,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,SAC1D;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,IAAA,YAAA,CAAa,qBAAqB,GAAG,CAAA;AACrC,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIO,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}

package/dist/service/KubernetesRouter.cjs.js

@@ -17,6 +17,7 @@ var resourcesRoutes = require('../routes/resourcesRoutes.cjs.js');
 var KubernetesProxy = require('./KubernetesProxy.cjs.js');
 var requirePermission = require('../auth/requirePermission.cjs.js');
 var catalogModel = require('@backstage/catalog-model');
+var ProxyMiddlewareCache = require('./ProxyMiddlewareCache.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -54,6 +55,7 @@ class KubernetesRouter {
       );
       return Router__default.default();
     }
+    await this.warnForClustersWithSkipTLSVerify(logger, clusterSupplier);
     const proxy = this.buildProxy(
       logger,
       clusterSupplier,
@@ -88,13 +90,21 @@ class KubernetesRouter {
     const authStrategy = new DispatchStrategy.DispatchStrategy({
       authStrategyMap
     });
+    const middlewareCacheConfig = this.env.config.getOptionalConfig(
+      "kubernetes.proxy.middlewareCache"
+    );
+    const { ttlMs, maxSize } = ProxyMiddlewareCache.resolveProxyMiddlewareCacheOptions({
+      ttlMs: middlewareCacheConfig?.getOptionalNumber("ttl.milliseconds"),
+      maxSize: middlewareCacheConfig?.getOptionalNumber("maxSize")
+    });
     return new KubernetesProxy.KubernetesProxy({
       logger,
       clusterSupplier,
       authStrategy,
       discovery,
       httpAuth,
-      auditor: this.env.auditor
+      auditor: this.env.auditor,
+      middlewareCache: { ttlMs, maxSize }
     });
   }
   buildDefaultRouter(objectsProvider, clusterSupplier, catalog, proxy, permissionApi, httpAuth, authStrategyMap) {
@@ -131,12 +141,27 @@ class KubernetesRouter {
           httpAuth,
           req
         );
+        const credentials = await httpAuth.credentials(req);
+        let resolvedEntity = requestBody?.entity;
+        if (requestBody?.entity) {
+          if (!entityRef) {
+            throw new errors.NotAllowedError("Invalid entity reference");
+          }
+          const parsedRef = catalogModel.parseEntityRef(entityRef);
+          const catalogEntity = await catalog.getEntityByRef(parsedRef, {
+            credentials
+          });
+          if (!catalogEntity) {
+            throw new errors.NotAllowedError(`Entity not found, ${entityRef}`);
+          }
+          resolvedEntity = catalogEntity;
+        }
         const response = await objectsProvider.getKubernetesObjectsByEntity(
           {
-            entity: requestBody?.entity,
+            entity: resolvedEntity,
             auth: requestBody?.auth || {}
           },
-          { credentials: await httpAuth.credentials(req) }
+          { credentials }
         );
         res.json(response);
         auditorEvent.success().catch(
@@ -225,6 +250,23 @@ class KubernetesRouter {
     );
     return clusterDetails;
   }
+  async warnForClustersWithSkipTLSVerify(logger, clusterSupplier) {
+    try {
+      const credentials = await this.env.auth.getOwnServiceCredentials();
+      const clusters = await clusterSupplier.getClusters({ credentials });
+      for (const cluster of clusters) {
+        if (cluster.skipTLSVerify) {
+          logger.warn(
+            `Cluster '${cluster.name}' is configured with skipTLSVerify: true; TLS certificate verification is disabled for Kubernetes API traffic to this cluster`
+          );
+        }
+      }
+    } catch (error) {
+      logger.warn(
+        `Failed to log skipTLSVerify warnings at startup: ${errors.toError(error).message}`
+      );
+    }
+  }
 }
 
 exports.KubernetesRouter = KubernetesRouter;

package/dist/service/KubernetesRouter.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\nimport { NotAllowedError } from '@backstage/errors';\n\nimport {\n  AuthService,\n  AuditorService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { stringifyEntityRef } from '@backstage/catalog-model';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  auditor: AuditorService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n      auditor: this.env.auditor,\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const auditor = this.env.auditor;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      let entityRef: string | undefined;\n      if (requestBody?.entity) {\n        try {\n          entityRef = stringifyEntityRef(requestBody.entity);\n        } catch {\n          entityRef = undefined;\n        }\n      }\n\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'resource-fetch',\n        request: req,\n        meta: { queryType: 'services', entityRef, serviceId },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesResourcesReadPermission,\n          httpAuth,\n          req,\n        );\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: requestBody?.entity,\n            auth: requestBody?.auth || {},\n          },\n          { credentials: await httpAuth.credentials(req) },\n        );\n        res.json(response);\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event resource-fetch (services)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        if (e instanceof NotAllowedError) {\n          throw e;\n        }\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`,\n        );\n        if (!res.headersSent) {\n          res.status(500).json({ error: err.message });\n        }\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'cluster-fetch',\n        request: req,\n        meta: { queryType: 'list' },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesClustersReadPermission,\n          httpAuth,\n          req,\n        );\n        const credentials = await httpAuth.credentials(req);\n        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n          credentials,\n        });\n        res.json({\n          items: clusterDetails.map(cd => {\n            const oidcTokenProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n            const authProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n            const strategy = authStrategyMap[authProvider];\n            let auth: AuthMetadata = {};\n            if (strategy) {\n              auth = strategy.presentAuthMetadata(cd.authMetadata);\n            }\n\n            return {\n              name: cd.name,\n              title: cd.title,\n              dashboardUrl: cd.dashboardUrl,\n              authProvider,\n              ...(oidcTokenProvider && { oidcTokenProvider }),\n              ...(auth && Object.keys(auth).length !== 0 && { auth }),\n            };\n          }),\n        });\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event cluster-fetch (list)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        throw e;\n      }\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n      auditor,\n      logger,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n}\n"],"names":["Router","DispatchStrategy","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","stringifyEntityRef","requirePermission","kubernetesResourcesReadPermission","NotAllowedError","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA,EAAS,KAAK,GAAA,CAAI;AAAA,KACnB,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,OAAA;AACzB,IAAA,MAAM,SAASF,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAIG,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,QAAA,IAAI;AACF,UAAA,SAAA,GAAYC,+BAAA,CAAmB,YAAY,MAAM,CAAA;AAAA,QACnD,CAAA,CAAA,MAAQ;AACN,UAAA,SAAA,GAAY,MAAA;AAAA,QACd;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,gBAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,UAAA,EAAY,WAAW,SAAA;AAAU,OACrD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMC,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAC,wDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,QAAQ,WAAA,EAAa,MAAA;AAAA,YACrB,IAAA,EAAM,WAAA,EAAa,IAAA,IAAQ;AAAC,WAC9B;AAAA,UACA,EAAE,WAAA,EAAa,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,SACjD;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AACjB,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,sDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,IAAI,aAAaC,sBAAA,EAAiB;AAChC,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,SAAA,EAAY,GAAG,CAAA;AAAA,SACvE;AACA,QAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,SAAS,CAAA;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,eAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,MAAA;AAAO,OAC3B,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMF,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAG,uDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,UACrE;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,YAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,YAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,YAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,YAAA,IAAI,OAAqB,EAAC;AAC1B,YAAA,IAAI,QAAA,EAAU;AACZ,cAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,YACrD;AAEA,YAAA,OAAO;AAAA,cACL,MAAM,EAAA,CAAG,IAAA;AAAA,cACT,OAAO,EAAA,CAAG,KAAA;AAAA,cACV,cAAc,EAAA,CAAG,YAAA;AAAA,cACjB,YAAA;AAAA,cACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,cAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,aACvD;AAAA,UACF,CAAC;AAAA,SACF,CAAA;AACD,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,iDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\nimport { NotAllowedError, toError } from '@backstage/errors';\n\nimport {\n  AuthService,\n  AuditorService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { parseEntityRef, stringifyEntityRef } from '@backstage/catalog-model';\nimport { resolveProxyMiddlewareCacheOptions } from './ProxyMiddlewareCache';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  auditor: AuditorService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    await this.warnForClustersWithSkipTLSVerify(logger, clusterSupplier);\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    const middlewareCacheConfig = this.env.config.getOptionalConfig(\n      'kubernetes.proxy.middlewareCache',\n    );\n    const { ttlMs, maxSize } = resolveProxyMiddlewareCacheOptions({\n      ttlMs: middlewareCacheConfig?.getOptionalNumber('ttl.milliseconds'),\n      maxSize: middlewareCacheConfig?.getOptionalNumber('maxSize'),\n    });\n\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n      auditor: this.env.auditor,\n      middlewareCache: { ttlMs, maxSize },\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const auditor = this.env.auditor;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      let entityRef: string | undefined;\n      if (requestBody?.entity) {\n        try {\n          entityRef = stringifyEntityRef(requestBody.entity);\n        } catch {\n          entityRef = undefined;\n        }\n      }\n\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'resource-fetch',\n        request: req,\n        meta: { queryType: 'services', entityRef, serviceId },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesResourcesReadPermission,\n          httpAuth,\n          req,\n        );\n\n        const credentials = await httpAuth.credentials(req);\n\n        let resolvedEntity = requestBody?.entity;\n        if (requestBody?.entity) {\n          if (!entityRef) {\n            throw new NotAllowedError('Invalid entity reference');\n          }\n          const parsedRef = parseEntityRef(entityRef);\n          const catalogEntity = await catalog.getEntityByRef(parsedRef, {\n            credentials,\n          });\n          if (!catalogEntity) {\n            throw new NotAllowedError(`Entity not found, ${entityRef}`);\n          }\n          resolvedEntity = catalogEntity;\n        }\n\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: resolvedEntity,\n            auth: requestBody?.auth || {},\n          },\n          { credentials },\n        );\n        res.json(response);\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event resource-fetch (services)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        if (e instanceof NotAllowedError) {\n          throw e;\n        }\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`,\n        );\n        if (!res.headersSent) {\n          res.status(500).json({ error: err.message });\n        }\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'cluster-fetch',\n        request: req,\n        meta: { queryType: 'list' },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesClustersReadPermission,\n          httpAuth,\n          req,\n        );\n        const credentials = await httpAuth.credentials(req);\n        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n          credentials,\n        });\n        res.json({\n          items: clusterDetails.map(cd => {\n            const oidcTokenProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n            const authProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n            const strategy = authStrategyMap[authProvider];\n            let auth: AuthMetadata = {};\n            if (strategy) {\n              auth = strategy.presentAuthMetadata(cd.authMetadata);\n            }\n\n            return {\n              name: cd.name,\n              title: cd.title,\n              dashboardUrl: cd.dashboardUrl,\n              authProvider,\n              ...(oidcTokenProvider && { oidcTokenProvider }),\n              ...(auth && Object.keys(auth).length !== 0 && { auth }),\n            };\n          }),\n        });\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event cluster-fetch (list)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        throw e;\n      }\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n      auditor,\n      logger,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n\n  private async warnForClustersWithSkipTLSVerify(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n  ): Promise<void> {\n    try {\n      const credentials = await this.env.auth.getOwnServiceCredentials();\n      const clusters = await clusterSupplier.getClusters({ credentials });\n\n      for (const cluster of clusters) {\n        if (cluster.skipTLSVerify) {\n          logger.warn(\n            `Cluster '${cluster.name}' is configured with skipTLSVerify: true; TLS certificate verification is disabled for Kubernetes API traffic to this cluster`,\n          );\n        }\n      }\n    } catch (error) {\n      logger.warn(\n        `Failed to log skipTLSVerify warnings at startup: ${\n          toError(error).message\n        }`,\n      );\n    }\n  }\n}\n"],"names":["Router","DispatchStrategy","resolveProxyMiddlewareCacheOptions","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","stringifyEntityRef","requirePermission","kubernetesResourcesReadPermission","NotAllowedError","parseEntityRef","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter","toError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,IAAA,CAAK,gCAAA,CAAiC,MAAA,EAAQ,eAAe,CAAA;AAEnE,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,MAAM,qBAAA,GAAwB,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,iBAAA;AAAA,MAC5C;AAAA,KACF;AACA,IAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAIC,uDAAA,CAAmC;AAAA,MAC5D,KAAA,EAAO,qBAAA,EAAuB,iBAAA,CAAkB,kBAAkB,CAAA;AAAA,MAClE,OAAA,EAAS,qBAAA,EAAuB,iBAAA,CAAkB,SAAS;AAAA,KAC5D,CAAA;AAED,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA,EAAS,KAAK,GAAA,CAAI,OAAA;AAAA,MAClB,eAAA,EAAiB,EAAE,KAAA,EAAO,OAAA;AAAQ,KACnC,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,OAAA;AACzB,IAAA,MAAM,SAASH,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAII,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,QAAA,IAAI;AACF,UAAA,SAAA,GAAYC,+BAAA,CAAmB,YAAY,MAAM,CAAA;AAAA,QACnD,CAAA,CAAA,MAAQ;AACN,UAAA,SAAA,GAAY,MAAA;AAAA,QACd;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,gBAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,UAAA,EAAY,WAAW,SAAA;AAAU,OACrD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMC,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAC,wDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,QAAA,IAAI,iBAAiB,WAAA,EAAa,MAAA;AAClC,QAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,UAAA,IAAI,CAAC,SAAA,EAAW;AACd,YAAA,MAAM,IAAIC,uBAAgB,0BAA0B,CAAA;AAAA,UACtD;AACA,UAAA,MAAM,SAAA,GAAYC,4BAAe,SAAS,CAAA;AAC1C,UAAA,MAAM,aAAA,GAAgB,MAAM,OAAA,CAAQ,cAAA,CAAe,SAAA,EAAW;AAAA,YAC5D;AAAA,WACD,CAAA;AACD,UAAA,IAAI,CAAC,aAAA,EAAe;AAClB,YAAA,MAAM,IAAID,sBAAA,CAAgB,CAAA,kBAAA,EAAqB,SAAS,CAAA,CAAE,CAAA;AAAA,UAC5D;AACA,UAAA,cAAA,GAAiB,aAAA;AAAA,QACnB;AAEA,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,MAAA,EAAQ,cAAA;AAAA,YACR,IAAA,EAAM,WAAA,EAAa,IAAA,IAAQ;AAAC,WAC9B;AAAA,UACA,EAAE,WAAA;AAAY,SAChB;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AACjB,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,sDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,IAAI,aAAaA,sBAAA,EAAiB;AAChC,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,SAAA,EAAY,GAAG,CAAA;AAAA,SACvE;AACA,QAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,SAAS,CAAA;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,eAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,MAAA;AAAO,OAC3B,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMF,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAI,uDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,UACrE;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,YAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,YAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,YAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,YAAA,IAAI,OAAqB,EAAC;AAC1B,YAAA,IAAI,QAAA,EAAU;AACZ,cAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,YACrD;AAEA,YAAA,OAAO;AAAA,cACL,MAAM,EAAA,CAAG,IAAA;AAAA,cACT,OAAO,EAAA,CAAG,KAAA;AAAA,cACV,cAAc,EAAA,CAAG,YAAA;AAAA,cACjB,YAAA;AAAA,cACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,cAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,aACvD;AAAA,UACF,CAAC;AAAA,SACF,CAAA;AACD,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,iDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AAAA,EAEA,MAAc,gCAAA,CACZ,MAAA,EACA,eAAA,EACe;AACf,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,wBAAA,EAAyB;AACjE,MAAA,MAAM,WAAW,MAAM,eAAA,CAAgB,WAAA,CAAY,EAAE,aAAa,CAAA;AAElE,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,SAAA,EAAY,QAAQ,IAAI,CAAA,6HAAA;AAAA,WAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,CAAA,iDAAA,EACEC,cAAA,CAAQ,KAAK,CAAA,CAAE,OACjB,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;;;;"}

package/dist/service/ProxyMiddlewareCache.cjs.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS = 6e4;
+const DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE = 100;
+function resolveProxyMiddlewareCacheOptions(options) {
+  const ttlMs = options?.ttlMs !== void 0 && options.ttlMs > 0 ? options.ttlMs : DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS;
+  const maxSize = options?.maxSize !== void 0 && options.maxSize >= 1 ? options.maxSize : DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE;
+  return { ttlMs, maxSize };
+}
+function buildProxyMiddlewareFingerprint(cluster) {
+  return `${cluster.url}|${cluster.skipTLSVerify ?? false}|${cluster.caData ?? ""}|${cluster.caFile ?? ""}`;
+}
+class ProxyMiddlewareCache {
+  #ttlMs;
+  #maxSize;
+  #entries = /* @__PURE__ */ new Map();
+  #now;
+  constructor(options) {
+    const resolved = resolveProxyMiddlewareCacheOptions(options);
+    this.#ttlMs = resolved.ttlMs;
+    this.#maxSize = resolved.maxSize;
+    this.#now = options.now ?? (() => Date.now());
+  }
+  get(cluster) {
+    const entry = this.#entries.get(cluster.name);
+    if (!entry) {
+      return void 0;
+    }
+    const fingerprint = buildProxyMiddlewareFingerprint(cluster);
+    if (entry.fingerprint !== fingerprint || this.#now() - entry.createdAtMs > this.#ttlMs) {
+      this.#entries.delete(cluster.name);
+      return void 0;
+    }
+    return entry.middleware;
+  }
+  set(cluster, middleware) {
+    this.#entries.delete(cluster.name);
+    while (this.#entries.size >= this.#maxSize) {
+      const oldestKey = this.#findOldestKey();
+      if (!oldestKey) {
+        break;
+      }
+      this.#entries.delete(oldestKey);
+    }
+    this.#entries.set(cluster.name, {
+      middleware,
+      fingerprint: buildProxyMiddlewareFingerprint(cluster),
+      createdAtMs: this.#now()
+    });
+  }
+  #findOldestKey() {
+    let oldestKey;
+    let oldestTime = Number.POSITIVE_INFINITY;
+    for (const [key, entry] of this.#entries) {
+      if (entry.createdAtMs < oldestTime) {
+        oldestTime = entry.createdAtMs;
+        oldestKey = key;
+      }
+    }
+    return oldestKey;
+  }
+}
+
+exports.DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE = DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE;
+exports.DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS = DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS;
+exports.ProxyMiddlewareCache = ProxyMiddlewareCache;
+exports.buildProxyMiddlewareFingerprint = buildProxyMiddlewareFingerprint;
+exports.resolveProxyMiddlewareCacheOptions = resolveProxyMiddlewareCacheOptions;
+//# sourceMappingURL=ProxyMiddlewareCache.cjs.js.map

package/dist/service/ProxyMiddlewareCache.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyMiddlewareCache.cjs.js","sources":["../../src/service/ProxyMiddlewareCache.ts"],"sourcesContent":["/*\n * Copyright 2026 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { RequestHandler } from 'http-proxy-middleware';\nimport type { ClusterDetails } from '@backstage/plugin-kubernetes-node';\n\nexport const DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS = 60_000;\nexport const DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE = 100;\n\n/**\n * @internal\n */\nexport function resolveProxyMiddlewareCacheOptions(options?: {\n  ttlMs?: number;\n  maxSize?: number;\n}): { ttlMs: number; maxSize: number } {\n  const ttlMs =\n    options?.ttlMs !== undefined && options.ttlMs > 0\n      ? options.ttlMs\n      : DEFAULT_PROXY_MIDDLEWARE_CACHE_TTL_MS;\n  const maxSize =\n    options?.maxSize !== undefined && options.maxSize >= 1\n      ? options.maxSize\n      : DEFAULT_PROXY_MIDDLEWARE_CACHE_MAX_SIZE;\n\n  return { ttlMs, maxSize };\n}\n\ntype CacheEntry = {\n  middleware: RequestHandler;\n  fingerprint: string;\n  createdAtMs: number;\n};\n\n/**\n * Builds a cache fingerprint from cluster details that affect cached proxy middleware.\n *\n * @internal\n */\nexport function buildProxyMiddlewareFingerprint(\n  cluster: ClusterDetails,\n): string {\n  return `${cluster.url}|${cluster.skipTLSVerify ?? false}|${\n    cluster.caData ?? ''\n  }|${cluster.caFile ?? ''}`;\n}\n\n/**\n * Bounded TTL cache for per-cluster http-proxy-middleware instances.\n *\n * @internal\n */\nexport class ProxyMiddlewareCache {\n  readonly #ttlMs: number;\n  readonly #maxSize: number;\n  readonly #entries = new Map<string, CacheEntry>();\n  readonly #now: () => number;\n\n  constructor(options: {\n    ttlMs?: number;\n    maxSize?: number;\n    now?: () => number;\n  }) {\n    const resolved = resolveProxyMiddlewareCacheOptions(options);\n    this.#ttlMs = resolved.ttlMs;\n    this.#maxSize = resolved.maxSize;\n    this.#now = options.now ?? (() => Date.now());\n  }\n\n  get(cluster: ClusterDetails): RequestHandler | undefined {\n    const entry = this.#entries.get(cluster.name);\n    if (!entry) {\n      return undefined;\n    }\n\n    const fingerprint = buildProxyMiddlewareFingerprint(cluster);\n    if (\n      entry.fingerprint !== fingerprint ||\n      this.#now() - entry.createdAtMs > this.#ttlMs\n    ) {\n      this.#entries.delete(cluster.name);\n      return undefined;\n    }\n\n    return entry.middleware;\n  }\n\n  set(cluster: ClusterDetails, middleware: RequestHandler): void {\n    this.#entries.delete(cluster.name);\n\n    while (this.#entries.size >= this.#maxSize) {\n      const oldestKey = this.#findOldestKey();\n      if (!oldestKey) {\n        break;\n      }\n      this.#entries.delete(oldestKey);\n    }\n\n    this.#entries.set(cluster.name, {\n      middleware,\n      fingerprint: buildProxyMiddlewareFingerprint(cluster),\n      createdAtMs: this.#now(),\n    });\n  }\n\n  #findOldestKey(): string | undefined {\n    let oldestKey: string | undefined;\n    let oldestTime = Number.POSITIVE_INFINITY;\n\n    for (const [key, entry] of this.#entries) {\n      if (entry.createdAtMs < oldestTime) {\n        oldestTime = entry.createdAtMs;\n        oldestKey = key;\n      }\n    }\n\n    return oldestKey;\n  }\n}\n"],"names":[],"mappings":";;AAmBO,MAAM,qCAAA,GAAwC;AAC9C,MAAM,uCAAA,GAA0C;AAKhD,SAAS,mCAAmC,OAAA,EAGZ;AACrC,EAAA,MAAM,KAAA,GACJ,SAAS,KAAA,KAAU,MAAA,IAAa,QAAQ,KAAA,GAAQ,CAAA,GAC5C,QAAQ,KAAA,GACR,qCAAA;AACN,EAAA,MAAM,OAAA,GACJ,SAAS,OAAA,KAAY,MAAA,IAAa,QAAQ,OAAA,IAAW,CAAA,GACjD,QAAQ,OAAA,GACR,uCAAA;AAEN,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAaO,SAAS,gCACd,OAAA,EACQ;AACR,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,QAAQ,aAAA,IAAiB,KAAK,CAAA,CAAA,EACrD,OAAA,CAAQ,MAAA,IAAU,EACpB,CAAA,CAAA,EAAI,OAAA,CAAQ,UAAU,EAAE,CAAA,CAAA;AAC1B;AAOO,MAAM,oBAAA,CAAqB;AAAA,EACvB,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA,uBAAe,GAAA,EAAwB;AAAA,EACvC,IAAA;AAAA,EAET,YAAY,OAAA,EAIT;AACD,IAAA,MAAM,QAAA,GAAW,mCAAmC,OAAO,CAAA;AAC3D,IAAA,IAAA,CAAK,SAAS,QAAA,CAAS,KAAA;AACvB,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAAA,EAC7C;AAAA,EAEA,IAAI,OAAA,EAAqD;AACvD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAA,GAAc,gCAAgC,OAAO,CAAA;AAC3D,IAAA,IACE,KAAA,CAAM,gBAAgB,WAAA,IACtB,IAAA,CAAK,MAAK,GAAI,KAAA,CAAM,WAAA,GAAc,IAAA,CAAK,MAAA,EACvC;AACA,MAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA,CAAM,UAAA;AAAA,EACf;AAAA,EAEA,GAAA,CAAI,SAAyB,UAAA,EAAkC;AAC7D,IAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA;AAEjC,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,IAAA,IAAQ,IAAA,CAAK,QAAA,EAAU;AAC1C,MAAA,MAAM,SAAA,GAAY,KAAK,cAAA,EAAe;AACtC,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,SAAS,CAAA;AAAA,IAChC;AAEA,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM;AAAA,MAC9B,UAAA;AAAA,MACA,WAAA,EAAa,gCAAgC,OAAO,CAAA;AAAA,MACpD,WAAA,EAAa,KAAK,IAAA;AAAK,KACxB,CAAA;AAAA,EACH;AAAA,EAEA,cAAA,GAAqC;AACnC,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,aAAa,MAAA,CAAO,iBAAA;AAExB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,QAAA,EAAU;AACxC,MAAA,IAAI,KAAA,CAAM,cAAc,UAAA,EAAY;AAClC,QAAA,UAAA,GAAa,KAAA,CAAM,WAAA;AACnB,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-kubernetes-backend",
-  "version": "0.21.7-next.1",
+  "version": "0.21.8",
   "description": "A Backstage backend plugin that integrates towards Kubernetes",
   "backstage": {
     "role": "backend-plugin",
@@ -49,18 +49,18 @@
     "@aws-crypto/sha256-js": "^5.0.0",
     "@aws-sdk/credential-providers": "^3.350.0",
     "@azure/identity": "^4.0.0",
-    "@backstage/backend-plugin-api": "1.10.0-next.1",
-    "@backstage/catalog-client": "1.16.1",
-    "@backstage/catalog-model": "1.9.0",
-    "@backstage/config": "1.3.8",
-    "@backstage/errors": "1.3.1",
-    "@backstage/integration-aws-node": "0.2.0",
-    "@backstage/plugin-catalog-node": "2.2.4-next.0",
-    "@backstage/plugin-kubernetes-common": "0.9.12",
-    "@backstage/plugin-kubernetes-node": "0.4.7-next.0",
-    "@backstage/plugin-permission-common": "0.9.9",
-    "@backstage/plugin-permission-node": "0.11.3-next.0",
-    "@backstage/types": "1.2.2",
+    "@backstage/backend-plugin-api": "^1.10.0",
+    "@backstage/catalog-client": "^1.16.1",
+    "@backstage/catalog-model": "^1.10.0",
+    "@backstage/config": "^1.3.8",
+    "@backstage/errors": "^1.3.1",
+    "@backstage/integration-aws-node": "^0.2.1",
+    "@backstage/plugin-catalog-node": "^2.2.4",
+    "@backstage/plugin-kubernetes-common": "^0.9.12",
+    "@backstage/plugin-kubernetes-node": "^0.4.7",
+    "@backstage/plugin-permission-common": "^0.9.10",
+    "@backstage/plugin-permission-node": "^0.11.3",
+    "@backstage/types": "^1.2.2",
     "@google-cloud/container": "^5.0.0",
     "@jest-mock/express": "^2.0.1",
     "@kubernetes/client-node": "1.4.0",
@@ -75,11 +75,11 @@
     "node-fetch": "^2.7.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.17.7-next.2",
-    "@backstage/backend-test-utils": "1.11.6-next.1",
-    "@backstage/cli": "0.36.5-next.1",
-    "@backstage/plugin-permission-backend": "0.7.15-next.0",
-    "@backstage/plugin-permission-backend-module-allow-all-policy": "0.2.22-next.0",
+    "@backstage/backend-defaults": "^0.17.7",
+    "@backstage/backend-test-utils": "^1.11.6",
+    "@backstage/cli": "^0.36.5",
+    "@backstage/plugin-permission-backend": "^0.7.15",
+    "@backstage/plugin-permission-backend-module-allow-all-policy": "^0.2.22",
     "@types/express": "^4.17.6",
     "msw": "^1.0.0",
     "supertest": "^7.0.0",