AlinsRan commented on code in PR #2811:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2811#discussion_r3654031187
##########
api/v1alpha1/gatewayproxy_types.go:
##########
@@ -133,7 +133,10 @@ type ControlPlaneProvider struct {
Service *ProviderService `json:"service,omitempty"`
// TlsVerify specifies whether to verify the TLS certificate of the
control plane.
+ // Defaults to true. Setting it to false disables certificate
verification and
+ // exposes the AdminKey to man-in-the-middle attacks over https
endpoints.
// +optional
+ // +kubebuilder:default=true
Review Comment:
Blocking: `ControlPlaneProvider` has no way to supply a CA — only
Endpoints/Service/TlsVerify/Auth — and the ADC executor exposes just
`TlsSkipVerify` (internal/adc/client/executor.go:81,337). With a self-signed or
private-CA control plane, the only escape from verify=true is `tlsVerify:
false`.
The likely outcome is that everyone hits the error and pastes `tlsVerify:
false` into their manifests, which leaves us worse off than today: the opt-out
becomes boilerplate nobody thinks about, and changing the default is no longer
available as a lever.
Suggest landing `controlPlane.caBundle` (inline PEM or a Secret ref) first,
then flipping the default in a release with an upgrade note.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
