Update k8s auth impl to be able to test ca, tokenReviewerjwt locally

backend/src/db/migrations/20240512231707_kubernetes-auth.ts

@@ -15,10 +15,10 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("identityId").notNullable().unique();
       t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
       t.string("kubernetesHost").notNullable();
-      t.string("encryptedCaCert").notNullable();
+      t.text("encryptedCaCert").notNullable();
       t.string("caCertIV").notNullable();
       t.string("caCertTag").notNullable();
-      t.string("encryptedTokenReviewerJwt").notNullable();
+      t.text("encryptedTokenReviewerJwt").notNullable();
       t.string("tokenReviewerJwtIV").notNullable();
       t.string("tokenReviewerJwtTag").notNullable();
       t.string("allowedNamespaces").notNullable();

backend/src/server/routes/v1/identity-kubernetes-auth-router.ts

@@ -22,7 +22,7 @@ const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.omit(
 export const registerIdentityKubernetesRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
-    url: "/kubernetes/login",
+    url: "/kubernetes-auth/login",
     config: {
       rateLimit: writeLimit
     },
@@ -88,7 +88,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
       }),
       body: z.object({
         kubernetesHost: z.string().trim().min(1),
-        caCert: z.string().trim().min(1),
+        caCert: z.string().trim().default(""),
         tokenReviewerJwt: z.string().trim().min(1),
         allowedNamespaces: z.string(), // TODO: validation
         allowedNames: z.string(),
@@ -174,7 +174,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
       }),
       body: z.object({
         kubernetesHost: z.string().trim().min(1).optional(),
-        kubernetesCaCert: z.string().trim().min(1).optional(),
+        caCert: z.string().trim().optional(),
         tokenReviewerJwt: z.string().trim().min(1).optional(),
         allowedNamespaces: z.string().optional(), // TODO: validation
         allowedNames: z.string().optional(),

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -115,11 +115,9 @@ export const identityKubernetesAuthServiceFactory = ({
           "Content-Type": "application/json",
           Authorization: `Bearer ${tokenReviewerJwt}`
         },
-        ...(caCert && {
-          httpsAgent: new https.Agent({
-            ca: caCert,
-            rejectUnauthorized: true
-          })
+        httpsAgent: new https.Agent({
+          ca: caCert,
+          rejectUnauthorized: false // TODO: change to [true]
         })
       }
     );