Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add insecure-allow-http flag to block HTTP traffic #531

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aryan9600
Copy link
Member

@aryan9600 aryan9600 commented May 22, 2023

Add a new flag insecure-allow-http that blocks the controller from reaching any HTTP endpoints. Its set to true by default to avoid making a breaking change. If HTTP traffic is disabled and a Provider specifies an address with the http scheme, the reconciler errors out and uses the InsecureConnectionsDisallowed reason for the object's conditions.

Ref: https://github.com/fluxcd/flux2/tree/main/rfcs/0004-insecure-http
Fixes: #386

main.go Outdated Show resolved Hide resolved
Add a new flag `insecure-allow-http` that blocks the controller from
reaching any HTTP endpoints. Its set to true by default to avoid making
a breaking change. If HTTP traffic is disabled and a `Provider` specifies
an address with the `http` scheme, the reconciler errors out and uses
the `InsecureConnectionsDisallowed` reason for the object's conditions.

Ref: https://github.com/fluxcd/flux2/tree/main/rfcs/0004-insecure-http

Signed-off-by: Sanskar Jaiswal <[email protected]>
@@ -253,6 +273,10 @@ func (r *ProviderReconciler) validateCredentials(ctx context.Context, provider *
}
}

if err := parseURLs(address, proxy, r.BlockInsecureHTTP); err != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this PR wait until #540 which is trying to remove the provider and alert reconcilers as a whole ?
validateCredentials() is doing more than just validating the credentials and there's a copy of it in the event handler as well. With #540, this implementation will change. Instead of setting a status, it'll become a dispatch failed warning event on the respective alert object, and maybe on the provider object too. Maybe RFC-0004 can be updated to mention how this should be reflected on status-less objects via k8s events.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Create a new flag to block use of HTTP endpoints for provider
3 participants