From ab0b43d51c9e52b3fcd2e775a3f9af00579dc94a Mon Sep 17 00:00:00 2001 From: Rahul Bhati Date: Tue, 13 Oct 2020 21:03:19 +0530 Subject: [PATCH] Added flag for insecureSkipVerfiy (#1829) --- charts/fission-all/templates/deployment.yaml | 4 +++- charts/fission-all/values.yaml | 2 ++ pkg/mqtrigger/messageQueue/kafka/kafka.go | 6 +++++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/charts/fission-all/templates/deployment.yaml b/charts/fission-all/templates/deployment.yaml index 36e634f2..e49d4655 100644 --- a/charts/fission-all/templates/deployment.yaml +++ b/charts/fission-all/templates/deployment.yaml @@ -677,7 +677,9 @@ spec: - name: TLS_ENABLED value: "true" - name: MESSAGE_QUEUE_SECRETS - value: /etc/fission/secrets + value: /etc/fission/secrets + - name: INSECURE_SKIP_VERIFY + value: "{{ .Values.kafka.authentication.tls.insecureSkipVerify }}" volumeMounts: - name: kafka-secrets mountPath: /etc/fission/secrets diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index 1b6b36b9..4001600e 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -184,6 +184,8 @@ kafka: authentication: tls: enabled: false + # InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. + insecureSkipVerify: false # Warning: Setting this to true, makes TLS susceptible to man-in-the-middle attacks caCert: "" # path to certificate containing public key of CA authority userCert: "" # path to certificate containing public key of the user signed by CA authority userKey: "" # path to private key of the user diff --git a/pkg/mqtrigger/messageQueue/kafka/kafka.go b/pkg/mqtrigger/messageQueue/kafka/kafka.go index 0214927f..02354b35 100644 --- a/pkg/mqtrigger/messageQueue/kafka/kafka.go +++ b/pkg/mqtrigger/messageQueue/kafka/kafka.go @@ -201,8 +201,12 @@ func (kafka Kafka) getTLSConfig() (*tls.Config, error) { tlsConfig.Certificates = []tls.Certificate{cert} + skipVerify, err := strconv.ParseBool(os.Getenv("INSECURE_SKIP_VERIFY")) if err != nil { - return nil, err + kafka.logger.Error("failed to parse value of env variable INSECURE_SKIP_VERIFY taking default value false, expected boolean value: true/false", + zap.String("received", os.Getenv("INSECURE_SKIP_VERIFY"))) + } else { + tlsConfig.InsecureSkipVerify = skipVerify } caCertPool := x509.NewCertPool()