Kubernetes client TLS verification is now configurable

Verification now defaults to true, where previously it defaulted to false

Signed-off-by: Travis Truman <trumant@gmail.com>

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts

@@ -52,6 +52,7 @@ describe('ConfigClusterLocator', () => {
         serviceAccountToken: undefined,
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
+        skipTLSVerify: false,
       },
     ]);
   });
@@ -64,11 +65,13 @@ describe('ConfigClusterLocator', () => {
           serviceAccountToken: 'token',
           url: 'http://localhost:8080',
           authProvider: 'serviceAccount',
+          skipTLSVerify: false,
         },
         {
           name: 'cluster2',
           url: 'http://localhost:8081',
           authProvider: 'google',
+          skipTLSVerify: true,
         },
       ],
     });
@@ -83,12 +86,14 @@ describe('ConfigClusterLocator', () => {
         serviceAccountToken: 'token',
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
+        skipTLSVerify: false,
       },
       {
         name: 'cluster2',
         serviceAccountToken: undefined,
         url: 'http://localhost:8081',
         authProvider: 'google',
+        skipTLSVerify: true,
       },
     ]);
   });

plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts

@@ -33,6 +33,10 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier {
           name: c.getString('name'),
           url: c.getString('url'),
           serviceAccountToken: c.getOptionalString('serviceAccountToken'),
+          skipTLSVerify:
+            c.getOptionalBoolean('skipTLSVerify') === undefined
+              ? false
+              : c.getOptionalBoolean('skipTLSVerify'),
           authProvider: c.getString('authProvider'),
         };
       }),

plugins/kubernetes-backend/src/cluster-locator/index.test.ts

@@ -53,12 +53,14 @@ describe('getCombinedClusterDetails', () => {
         serviceAccountToken: 'token',
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
+        skipTLSVerify: false,
       },
       {
         name: 'cluster2',
         serviceAccountToken: undefined,
         url: 'http://localhost:8081',
         authProvider: 'google',
+        skipTLSVerify: false,
       },
     ]);
   });

plugins/kubernetes-backend/src/service/KubernetesClientProvider.test.ts

@@ -34,6 +34,7 @@ describe('KubernetesClientProvider', () => {
       url: 'http://localhost:9999',
       serviceAccountToken: 'TOKEN',
       authProvider: 'serviceAccount',
+      skipTLSVerify: false,
     });
 
     expect(result.basePath).toBe('http://localhost:9999');
@@ -41,6 +42,7 @@ describe('KubernetesClientProvider', () => {
     const auth = (result as any).authentications.default;
     expect(auth.users[0].token).toBe('TOKEN');
     expect(auth.clusters[0].name).toBe('cluster-name');
+    expect(auth.clusters[0].skipTLSVerify).toBe(false);
 
     expect(mockGetKubeConfig.mock.calls.length).toBe(1);
   });
@@ -57,6 +59,7 @@ describe('KubernetesClientProvider', () => {
       url: 'http://localhost:9999',
       serviceAccountToken: 'TOKEN',
       authProvider: 'serviceAccount',
+      skipTLSVerify: false,
     });
 
     expect(result.basePath).toBe('http://localhost:9999');

plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts

@@ -30,8 +30,7 @@ export class KubernetesClientProvider {
     const cluster = {
       name: clusterDetails.name,
       server: clusterDetails.url,
-      // TODO configure this
-      skipTLSVerify: true,
+      skipTLSVerify: clusterDetails.skipTLSVerify,
     };
 
     // TODO configure

plugins/kubernetes-backend/src/types/types.ts

@@ -30,6 +30,7 @@ export interface ClusterDetails {
   url: string;
   authProvider: string;
   serviceAccountToken?: string | undefined;
+  skipTLSVerify?: boolean;
 }
 
 export interface KubernetesRequestBody {