bitnami/sealed-secrets

--insecure-skip-tls-verify works only for K8s API connections

Open

#596 opened on May 28, 2021

View on GitHubContributor guide
 (0 comments) (1 reaction) (0 assignees)Go (771 forks)auto 404
backlogbuggood first issue

Repository metrics

Stars
 (9,222 stars)
PR merge metrics
 (PR metrics pending)

Description

I am fetching a cert from the sealed secrets like this:

 kubeseal --raw --insecure-skip-tls-verify=true --from-file=foo.secret --cert https://sealed-secrets.my-ingress.com/v1/cert.pem --namespace team-a --name team-a-foo

The ingresses certificate is self signed. I expected --insecure-skip-tls-verify to ignore tls verification, but looking at the code of sealed-secrets, this flag is never used inside this project and is probably only passed down to K8s Go client.

I believe it should be an easy fix though - should this flag be used for both use cases? If yes, I can try to submit a quick fix.

Contributor guide

Research direction
Inspect the codebase to find where the insecure skip tls verify flag is handled. Currently it only applies to Kubernetes API connections. Extend it to also skip TLS verification when fetching the certificate from the HTTPS URL. Look for HTTP client creation and add the insecure skip verify option based on that flag.
Tech stack
go
Domain
clisecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Gokubeseal usage
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75