Skip to content

Add tls_ca_file and tls_insecure configuration settings to infrahubctl #580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: stable
Choose a base branch
from
Open

Add tls_ca_file and tls_insecure configuration settings to infrahubctl #580

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c56b5a
add tls_insecure & tls_ca_file configuration settings to infrahubctl
wvandeun Oct 14, 2025
9d54d32
update documentation
wvandeun Oct 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/docs/infrahubctl/infrahubctl.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ The `infrahubctl` command line utility is installed as a part of the [Infrahub S
| `INFRAHUB_ADDRESS` | http://localhost:8000 |
| `INFRAHUB_API_TOKEN` | `06438eb2-8019-4776-878c-0941b1f1d1ec` |
| `INFRAHUB_DEFAULT_BRANCH` | main |
| `INFRAHUB_TLS_CA_FILE` | /path/to/ca.crt |
| `INFRAHUB_TLS_INSECURE` | true |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be an exact replica of what we support in the SDK as we reuse the existing environment variables. As such I think that instead of adding options here we can have the INFRAHUB_ADDRESS one as an example and then link to the config page for all of the SDK environment variables.


> You can also provide the location of a configuration file via the environment variable `INFRAHUBCTL_CONFIG`.

Expand All @@ -39,4 +41,7 @@ The `infrahubctl` command line utility is installed as a part of the [Infrahub S
```toml title="infrahubctl.toml"
server_address="http://localhost:8000"
api_token="06438eb2-8019-4776-878c-0941b1f1d1ec"
default_branch="main"
tls_ca_file="/path/to/ca.crt"
tls_insecure=true
```
6 changes: 6 additions & 0 deletions infrahub_sdk/ctl/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,12 @@ def _define_config(
if config.SETTINGS.active.api_token:
client_config["api_token"] = config.SETTINGS.active.api_token

if config.SETTINGS.active.tls_ca_file:
client_config["tls_ca_file"] = config.SETTINGS.active.tls_ca_file

if config.SETTINGS.active.tls_insecure:
client_config["tls_insecure"] = config.SETTINGS.active.tls_insecure

if timeout:
client_config["timeout"] = timeout

Expand Down
8 changes: 8 additions & 0 deletions infrahub_sdk/ctl/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,14 @@ class Settings(BaseSettings):
server_address: str = Field(default="http://localhost:8000", validation_alias="infrahub_address")
api_token: str | None = Field(default=None)
default_branch: str = Field(default="main")
tls_insecure: bool = Field(
default=False,
description="""
Indicates if TLS certificates are verified.
Enabling this option will disable: CA verification, expiry date verification, hostname verification).
Can be useful to test with self-signed certificates.""",
)
tls_ca_file: str | None = Field(default=None, description="File path to CA cert or bundle in PEM format")

@field_validator("server_address")
@classmethod
Expand Down