feat(talosctl): add --skip-verify flag to skip TLS certificate verification #12652
+124
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
|
As much as I see the problem, I don't like the idea of including this into |
4 tasks
…cation Add global --skip-verify flag that disables TLS server certificate verification while preserving client certificate authentication. This is useful when connecting to nodes via IP addresses not listed in the server certificate's SANs (NAT, VPN, port-forwarding scenarios). Changes: - Add SkipVerify field to global.Args struct - Add WithClientSkipVerify method for TLS with InsecureSkipVerify - Add --skip-verify global flag to all commands - Update commands that support --insecure to also check --skip-verify Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
kvaps
force-pushed
the
feat/skip-verify-flag
branch
from
c0fb51f to
f2c9c7b
Compare
Merged
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add global
--skip-verifyflag that disables TLS server certificate verification while preserving client certificate authentication.This is useful when connecting to nodes via IP addresses not listed in the server certificate's SANs (e.g., NAT, VPN, port-forwarding scenarios).
Changes
SkipVerifyfield toglobal.ArgsstructWithClientSkipVerifymethod that creates TLS connection withInsecureSkipVerify: truebut preserves client certificate--skip-verifyglobal flag to all commands--insecureto also check for--skip-verify:apply-configgetmeta write/deleteresetupgradeversionwipe diskDifference from --insecure
--insecure: Uses maintenance mode API without client authentication--skip-verify: Uses normal authenticated API but skips server certificate verificationTest plan
talosctl get members --skip-verify -n <ip>against a node with mismatched SANtalosctl apply-config --skip-verify -n <ip> -f config.yaml