shreemaan-abhishek commented on code in PR #2811:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2811#discussion_r4003117612
##########
api/v1alpha1/gatewayproxy_types.go:
##########
@@ -133,7 +133,10 @@ type ControlPlaneProvider struct {
Service *ProviderService `json:"service,omitempty"`
// TlsVerify specifies whether to verify the TLS certificate of the
control plane.
+ // Defaults to true. Setting it to false disables certificate
verification and
+ // exposes the AdminKey to man-in-the-middle attacks over https
endpoints.
// +optional
+ // +kubebuilder:default=true
Review Comment:
Addressed in the latest push:
- Control-plane CA support has landed in #2826, the ADC-side support has
landed in api7/adc#552, and the controller now pins ADC 0.29.0.
- All four self-signed local examples explicitly set tlsVerify: false and
label it as a development-only certificate.
- The upgrade guide now explains that CRD defaulting affects existing
GatewayProxy objects and documents the system-CA, caCert, and temporary
development opt-out migration paths.
- The branch is merged with current master and the focused translator tests
pass.
apache/apisix-helm-chart#994 remains the coordinated release-packaging
follow-up; no controller release containing this new default exists yet.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
