Enforce TLS certificate verification in Helm/OCI Repository controllers #1855
+60
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cappyzawa
force-pushed
the
feat/helm-oci-controllers-runtime-secrets-v076
branch
from
054ef2b to
5729ede
Compare
cappyzawa
changed the title
matheuscscp
reviewed
Jul 28, 2025
| Name: obj.Spec.CertSecretRef.Name, | ||
| } | ||
| return secrets.TLSConfigFromSecretRef(ctx, r.Client, secretName, obj.Spec.URL, obj.Spec.Insecure) | ||
| return secrets.TLSConfigFromSecretRef(ctx, r.Client, secretName, obj.Spec.URL) |
There was a problem hiding this comment.
Indeed, when InsecureSkipVerify: true, we dont even need TLS config from the secret 👍
There was a problem hiding this comment.
What if it has client certs?
There was a problem hiding this comment.
Hmm, for authentication, true
Remove the insecure parameter from TLS configuration function calls to prevent InsecureSkipVerify from being set when using certificate-based authentication. This ensures TLS certificate verification is always performed when certificates are provided, aligning with our security policy. Updated pkg/runtime to v0.76.0 which no longer accepts the insecure parameter in TLS configuration functions. For OCIRepository, maintain backward compatibility by handling the specific case where no certificate is provided and insecure is explicitly set to true. This is the only allowed exception in Flux controllers. Signed-off-by: cappyzawa <[email protected]>
cappyzawa
force-pushed
the
feat/helm-oci-controllers-runtime-secrets-v076
branch
from
e9464fb to
4b1ace6
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ref: