feat: Set vars when TLS disabled or Dev enabled #2008
Conversation
This is so that the UI can query what has been set on the server and display appropriate warning messages. It will also be logged on each request whether TLS is enabled or not.
Callisto13
added
type/enhancement
| @@ -286,7 +287,10 @@ func runCmd(cmd *cobra.Command, args []string) error { | |||
|
|
|||
| func listenAndServe(log logr.Logger, srv *http.Server, options Options) error { | |||
| if options.Insecure { | |||
| log.Info("TLS connections disabled") | |||
| log.Info( | |||
| "WARNING: TLS connections disabled by the `--insecure` flag. All data INCLUDING AUTH TOKENS will be transmitted without encryption.") | |||
There was a problem hiding this comment.
I'm not sure this makes sense - we expect --insecure to pretty much always be set for security reasons: you'll have a separate ingress to encrypt the data, so you don't need to worry about how to configure allowed ciphers, special-case certificate renewal, and so on. That doesn't mean anything will be transmitted without encryption.
There was a problem hiding this comment.
Oh i didn't realised we did that now. In that case, why do we offer TLS at all?
There was a problem hiding this comment.
looool excellent
i might be closing this one then
There was a problem hiding this comment.
That other ingress is on the user to configure though right? And I assume we'd have no way of knowing whether they have appropriately configured? In which case a warning still feels valid but perhaps the wording changes to more of a "ensure you have an appropriately configured ingress..."
There was a problem hiding this comment.
additionally, if we do indeed expect --insecure to be the default in a secure configuration... maybe we need to think about renaming :)
There was a problem hiding this comment.
Opened #2010 to discuss what we really want to do around this
|
closing for now, may open again later |
This is so that the UI can query what has been set on the server and
display appropriate warning messages.
It will also be logged on each request whether TLS is enabled or not.
Part of #1959