WIP: Support skipping certs verifications#1239
WIP: Support skipping certs verifications#1239moadqassem wants to merge 2 commits intoflatcar:mainfrom
Conversation
Signed-off-by: moadqassem <moad.qassem@gmail.com>
… the helm chart Signed-off-by: moadqassem <moad.qassem@gmail.com>
|
Thanks @moadqassem for your PR! Early next week I will try to find time to review your changes. |
|
Hi @moadqassem, Thank you for the PR and for identifying this real issue with self-signed certificates! However, after thinking for a while if this option would be necessary, I don't think we should merge --oidc-skip-tls-verify because I think it is fundamentally contradictory: if you're using HTTPS but disabling all certificate verification, you're not actually testing HTTPS properly - you're only getting encryption without authentication. Better alternatives:
This maintains real TLS security (hostname verification, expiry checking, chain validation) while trusting your self-signed cert.
Could you share your specific deployment scenario? Understanding why option 2 doesn't work for you would help us decide if option 3 is worth implementing. E.g. I can imagine situations like, where you want one application (Nebraska) to trust certain certificates while the others not. Thanks! |
Hey @ervcz, Thanks a lot for taking a look at this. I completely agree with you regarding the points that you brought up, having skip tls and using https is kinda contradictory. tbh, I already wanted to do the 3rd option, where you can integrate Nebraska with cert-manager and you will generate, mount and run those custom CA automatically when the ingress is created, but I slacked a bit as disabling tls verify in the OIDC provider did the trick :D. Anyway, I will mark this PR as a WIP and add BYOC(bring your own certs) option and update the PR accordingly. Cheers |
[Title: describe the change in one sentence]
Using OIDC provider with an insecure certificates(self-signed certs) for development purposes.
[ describe the change in 1 - 3 paragraphs ]
How to use
Set the
oidc-skip-tls-verifyflag to true or set the fieldskipTlsVerifyin the helm chart[ describe what reviewers need to do in order to validate this PR ]
Testing done
Just deployed the chart and I got the error:
After deploying my change the error is gone.
[Describe the testing you have done before submitting this PR. Please include both the commands you issued as well as the output you got.]
changelog/directory (user-facing change, bug fix, security fix, update)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.