Skip to content

feat: Support PlainHTTP and InsecureSkipTLSVerify for PolicyRef/KustomizationRef RemoteURL #1913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gianlucam76 merged 1 commit into from
Aug 11, 2026
Merged

feat: Support PlainHTTP and InsecureSkipTLSVerify for PolicyRef/KustomizationRef RemoteURL #1913

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions api/v1beta1/spec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -718,6 +718,18 @@ type RemoteKustomizeURL struct {
// "caFile" — PEM-encoded CA certificate for TLS verification
// +optional
SecretRef *corev1.SecretReference `json:"secretRef,omitempty"`

// InsecureSkipTLSVerify controls server certificate verification.
// Ignored if the referenced SecretRef provides a "caFile".
// +kubebuilder:default:=false
// +optional
InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`

// PlainHTTP indicates to use insecure HTTP connections when URL uses the
// "oci://" scheme. Ignored for "http://"/"https://" URLs.
// +kubebuilder:default:=false
// +optional
PlainHTTP bool `json:"plainHTTP,omitempty"`
}

// StopMatchingBehavior indicates what will happen when Cluster stops matching
Expand Down Expand Up @@ -893,6 +905,18 @@ type RemoteURL struct {
// on a ConfigMap or Secret.
// +optional
Template bool `json:"template,omitempty"`

// InsecureSkipTLSVerify controls server certificate verification.
// Ignored if the referenced SecretRef provides a "caFile".
// +kubebuilder:default:=false
// +optional
InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`

// PlainHTTP indicates to use insecure HTTP connections when URL uses the
// "oci://" scheme. Ignored for "http://"/"https://" URLs.
// +kubebuilder:default:=false
// +optional
PlainHTTP bool `json:"plainHTTP,omitempty"`
}

type Clusters struct {
Expand Down
24 changes: 24 additions & 0 deletions config/crd/bases/config.projectsveltos.io_clusterprofiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -829,11 +829,23 @@ spec:
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -1184,11 +1196,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down
48 changes: 48 additions & 0 deletions config/crd/bases/config.projectsveltos.io_clusterpromotions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,11 +731,23 @@ spec:
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -1086,11 +1098,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -2536,11 +2560,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -2959,11 +2995,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down
24 changes: 24 additions & 0 deletions config/crd/bases/config.projectsveltos.io_clustersummaries.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -868,11 +868,23 @@ spec:
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -1223,11 +1235,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down
24 changes: 24 additions & 0 deletions config/crd/bases/config.projectsveltos.io_profiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -829,11 +829,23 @@ spec:
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down Expand Up @@ -1184,11 +1196,23 @@ spec:
RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry.
When set, Kind/Name/Namespace must be omitted.
properties:
insecureSkipTLSVerify:
default: false
description: |-
InsecureSkipTLSVerify controls server certificate verification.
Ignored if the referenced SecretRef provides a "caFile".
type: boolean
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
plainHTTP:
default: false
description: |-
PlainHTTP indicates to use insecure HTTP connections when URL uses the
"oci://" scheme. Ignored for "http://"/"https://" URLs.
type: boolean
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
Expand Down
14 changes: 12 additions & 2 deletions controllers/handlers_kustomize.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -488,7 +488,12 @@ func getHashFromKustomizationRef(ctx context.Context, c client.Client, clusterSu
func getHashFromRemoteKustomizeURL(ctx context.Context, remoteURL *configv1beta1.RemoteKustomizeURL,
clusterSummary *configv1beta1.ClusterSummary, logger logr.Logger) ([]byte, error) {

body, err := fetchContentForHash(ctx, remoteURL.URL, remoteURL.SecretRef,
opts := remoteFetchOptions{
secretRef: remoteURL.SecretRef,
insecureSkipTLSVerify: remoteURL.InsecureSkipTLSVerify,
plainHTTP: remoteURL.PlainHTTP,
}
body, err := fetchContentForHash(ctx, remoteURL.URL, opts,
clusterSummary.Spec.ClusterNamespace, clusterSummary.Spec.ClusterName,
clusterSummary.Spec.ClusterType, logger)
if err != nil {
Expand Down Expand Up @@ -860,7 +865,12 @@ func prepareFileSystemWithRemoteURL(ctx context.Context, kustomizationRef *confi
return "", fmt.Errorf("tmp dir error: %w", err)
}

err = fetchContentToDir(ctx, kustomizationRef.RemoteURL.URL, kustomizationRef.RemoteURL.SecretRef,
opts := remoteFetchOptions{
secretRef: kustomizationRef.RemoteURL.SecretRef,
insecureSkipTLSVerify: kustomizationRef.RemoteURL.InsecureSkipTLSVerify,
plainHTTP: kustomizationRef.RemoteURL.PlainHTTP,
}
err = fetchContentToDir(ctx, kustomizationRef.RemoteURL.URL, opts,
clusterSummary.Spec.ClusterNamespace, clusterSummary.Spec.ClusterName, clusterSummary.Spec.ClusterType,
tmpDir, logger)
if err != nil {
Expand Down
7 changes: 6 additions & 1 deletion controllers/handlers_resources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -630,7 +630,12 @@ func urlPolicyRefsHash(ctx context.Context, clusterSummary *configv1beta1.Cluste
if ref.RemoteURL == nil {
continue
}
body, err := fetchContent(ctx, ref.RemoteURL.URL, ref.RemoteURL.SecretRef,
opts := remoteFetchOptions{
secretRef: ref.RemoteURL.SecretRef,
insecureSkipTLSVerify: ref.RemoteURL.InsecureSkipTLSVerify,
plainHTTP: ref.RemoteURL.PlainHTTP,
}
body, err := fetchContent(ctx, ref.RemoteURL.URL, opts,
clusterSummary.Spec.ClusterNamespace, clusterSummary.Spec.ClusterName,
clusterSummary.Spec.ClusterType, logger)
if err != nil {
Expand Down
10 changes: 7 additions & 3 deletions controllers/handlers_utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,9 +78,11 @@ type referencedObject struct {
Optional bool
Path string
// URL and related fields are set only for URL-based PolicyRefs (Kind == urlSourceKind).
URL string
IsTemplate bool
SecretRef *corev1.SecretReference
URL string
IsTemplate bool
SecretRef *corev1.SecretReference
InsecureSkipTLSVerify bool
PlainHTTP bool
}

func getClusterSummaryAnnotationValue(clusterSummary *configv1beta1.ClusterSummary) string {
Expand Down Expand Up @@ -787,6 +789,8 @@ func collectReferencedObjects(references []configv1beta1.PolicyRef) (local, remo
object.URL = reference.RemoteURL.URL
object.IsTemplate = reference.RemoteURL.Template
object.SecretRef = reference.RemoteURL.SecretRef
object.InsecureSkipTLSVerify = reference.RemoteURL.InsecureSkipTLSVerify
object.PlainHTTP = reference.RemoteURL.PlainHTTP
setCommonReferencedObjectFields(&object, reference)

if reference.DeploymentType == configv1beta1.DeploymentTypeLocal {
Expand Down
Loading