User Info Fetcher: Enable TLS with WebPKI trust by default
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- rust
- Domain
- networking, security
Research direction
Start from the TlsVerification configuration and the userInfo Keycloak backend described in the issue, then trace how TLS settings are deserialized and applied to the HTTP client. Verify the default uses WebPKI trust, while explicit null, none, and internal-PKI configurations retain their intended behavior; add or update relevant tests if the repository provides them.
Written by the indexing model from the issue text.
Description
Currently, the following configuration leads to the HTTP client connecting without TLS:
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
name: test-opa
spec:
clusterConfig:
userInfo:
backend:
keycloak:
hostname: keycloak.example.com
clientCredentialsSecret: opa-infofetcher-keycloak-secret
adminRealm: master
userRealm: master
And to enable TLS, you have to jump through a few hoops by adding:
tls:
verification:
server:
caCert:
webPki: {}
In this day-in-age, I think it is expected to default to TLS (and the CRA requires secure-by-default).
So I propose that we impl Default for tls:
impl Default for TlsVerification {
fn default() -> Self {
Self::Server(TlsServerVerification {
ca_cert: CaCert::WebPki {},
})
}
}
... and explicit steps are to be taken to disable TLS or to ignore verification (or set internal PKI), eg:
tls: null
or
tls:
verification:
none: {}
- Dominant language
- Rust
- Stars
- 21
- Forks
- 5
- Avg merge
- 12h 44m
- Merged PRs (30d)
- 11
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/opa-operator
-
type/bug
Difficulty 4/5 3-5 days Newbie friendliness 52/100
stackabletech/opa-operator#823 ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
stackabletech/opa-operator#766 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
stackabletech/opa-operator#733 ·
-
Difficulty 2/5 Half a day Newbie friendliness 50/100
stackabletech/opa-operator#724 ·
-
type/bug
Difficulty 5/5 Over a week Newbie friendliness 20/100
stackabletech/opa-operator#718 ·
All issues in stackabletech/opa-operator
Similar issues
-
todo:perf
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
ACP agents get no MCP servers when the thread is created before the project's first worktree loads Openstate:needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
zed-industries/zed#64611 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
ontola/atomic-server#1625 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
objectionary/phie#154 ·