paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 40 Packages Projects Releases Wiki Activity

Add support to the new backend system, including customization

Browse Source 
Signed-off-by: ivgo <ivgo@spreadgroup.com>
This commit is contained in:
ivgo
2023-10-02 15:46:54 +02:00
parent 7a41bcf2af
commit a873a32a1f
11 changed files with 205 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/vault-backend/README.md
+24 -1
View File
@@ -68,6 +68,9 @@ To get started, first you need a running instance of Vault. You can follow [this
token: <VAULT_TOKEN>
secretEngine: 'customSecretEngine' # Optional. By default it uses 'secrets'. Can be overwritten by the annotation of the entity
kvVersion: <kv-version> # Optional. The K/V version that your instance is using. The available options are '1' or '2'
schedule: # Optional. If the token renewal is enabled this schedule will be used instead of the hourly one
frequency: { hours: 1 }
timeout: { hours: 1 }
```
4. Get a `VAULT_TOKEN` with **LIST** permissions, as it's enough for the plugin. You can check [this tutorial](https://learn.hashicorp.com/tutorials/vault/tokens) for more info.
@@ -80,6 +83,24 @@ To get started, first you need a running instance of Vault. You can follow [this
}
```
## New Backend System
The Vault backend plugin has support for the [new backend system](https://backstage.io/docs/backend-system/), here's how you can set that up:
In your `packages/backend/src/index.ts` make the following changes:
```diff
import { createBackend } from '@backstage/backend-defaults';
const backend = createBackend();
// ... other feature additions
+ backend.add(import('@backstage/plugin-vault-backend');
backend.start();
```
The token renewal is enabled automatically in the new backend system depending on the `app-config.yaml`. If the `schedule` is not defined there, no
task will be executed. If you want to use the default renewal scheduler (which runs hourly), set `schedule: true`. In case you want a custom schedule
just use a configuration like the one set above.
## Integration with the Catalog
The plugin can be integrated into each Component in the catalog. To allow listing the available secrets a new annotation must be added to the `catalog-info.yaml`:
@@ -122,7 +143,7 @@ That will overwrite the default secret engine from the configuration.
## Renew token
In a secure Vault instance, it's usual that the tokens are refreshed after some time. In order to always have a valid token to fetch the secrets, it might be necessary to execute a renew action after some time. By default this is deactivated, but it can be easily activated and configured to be executed periodically (hourly by default, but customizable by the user). In order to do that, modify your `src/plugins/vault.ts` file to look like this one:
In a secure Vault instance, it's usual that the tokens are refreshed after some time. In order to always have a valid token to fetch the secrets, it might be necessary to execute a renew action after some time. By default this is deactivated, but it can be easily activated and configured to be executed periodically (hourly by default, but customizable by the user within the app-config.yaml file). In order to do that, modify your `src/plugins/vault.ts` file to look like this one:
```typescript
import { VaultBuilder } from '@backstage/plugin-vault-backend';
@@ -149,6 +170,8 @@ export default async function createPlugin(
}
```
If the `taskRunner` is not set when calling the `enableTokenRenew`, the plugin will automatically check what is set in the `app-config.yaml` file. Refer to [the new backend system setup](#new-backend-system) for more information about it.
## Features
- List the secrets present in a certain path