Operator assumes security plugin to be enabled always

[gaurav-05]

Hi.. Currently operator assumes that security plugin is always enabled in the image being used, but we can have a case when we do not want security plugin to be enabled, is there a way right now we can disable the TLS logic from being called and use HTTP instead.

[swoehrl-mw]

Hi @gaurav-05. There is currently no way to disable TLS via the operator and, as you've already deduced, the operator assumes in several places that TLS and the securityplugin are always enabled. So even if you build a custom image without the securityplugin it would not work.

To be honest I don't see this being supported in the future. One of the main goals of the operator is to provide (nearly) production-ready clusters, and TLS and authentication is a must-have for that.

[swoehrl-mw]

Hi @gaurav-05. As I already stated, disabling TLS is currently not possible with the operator and I don't know of any workarounds.
If you want to use Keycloak for authentication, I don't see why you would need to disable the security plugin? The normal way to integrate keycloak would be via Oauth/OIDC and have only some technical users in the internal_users list. Both is possible with the operator.

[gaurav-05]

Sure and would you allow any PR that provides option to disable TLS.

[swoehrl-mw]

I can accept an option that allows disabling TLS on the REST layer (with the default being TLS enabled and a clear warning not to do it unless other measures are in place). Completely disabling TLS and/or the security plugin is something we IMO should not support.

[roelandvanbatenburg]

We are not exposing the cluster in anyway and run OS with both DISABLE_INSTALL_DEMO_CONFIG and DISABLE_SECURITY_PLUGIN. The first thing we are experiencing is that the readinessProbe only communicates via https and thus none of the pods are marked as ready.

[swoehrl-mw]

Hi @roelandvanbatenburg. As already discussed above the operator does not support disabling TLS or the entire security plugin. As such the behaviour you describe is expected.