Skip to content

Commit d22e1cf

Browse files
justinsbjustinsb
committed
openstack: pass through InsecureSkipVerify into openstack components
If the user has set InsecureSkipVerify in the kops cluster spec for openstack, we should pass that through to the openstack clients we create, so that they honor that setting. We use a "private" environment variable KOPS_OS_TLS_INSECURE_SKIP_VERIFY, because there is no well-known OpenStack environment variable for this purpose.
1 parent 5b7ecd6 commit d22e1cf

9 files changed

Lines changed: 227 additions & 2 deletions

File tree

‎dnsprovider/pkg/dnsprovider/providers/openstack/designate/designate.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func newDesignate(_ io.Reader) (*Interface, error) {
6363
klog.V(4).Infof("Using user-agent %s", ua.Join())
6464

6565
tlsconfig := &tls.Config{}
66-
tlsconfig.InsecureSkipVerify = true
66+
tlsconfig.InsecureSkipVerify = oc.GetInsecureSkipVerify()
6767
transport := &http.Transport{TLSClientConfig: tlsconfig}
6868
provider.HTTPClient = http.Client{
6969
Transport: transport,

‎nodeup/pkg/bootstrap/install.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,7 @@ func (i *Installation) buildEnvFile() *nodetasks.InstallFile {
108108
"OS_REGION_NAME",
109109
"OS_APPLICATION_CREDENTIAL_ID",
110110
"OS_APPLICATION_CREDENTIAL_SECRET",
111+
openstackconfig.EnvKeyOpenstackTLSInsecureSkipVerify,
111112
} {
112113
envVars[envVar] = os.Getenv(envVar)
113114
}

‎nodeup/pkg/model/protokube.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,7 @@ func (t *ProtokubeBuilder) buildEnvFile() (*nodetasks.File, error) {
268268
"OS_REGION_NAME",
269269
"OS_APPLICATION_CREDENTIAL_ID",
270270
"OS_APPLICATION_CREDENTIAL_SECRET",
271+
openstackconfig.EnvKeyOpenstackTLSInsecureSkipVerify,
271272
} {
272273
envVars[envVar] = os.Getenv(envVar)
273274
}

‎pkg/model/resources/nodeup.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,11 @@ func buildEnvironmentVariables(cluster *kops.Cluster, ig *kops.InstanceGroup) (m
385385
)
386386
}
387387

388+
// Map our Insecure Skip Verify setting
389+
if cluster.Spec.CloudProvider.Openstack != nil && fi.ValueOf(cluster.Spec.CloudProvider.Openstack.InsecureSkipVerify) {
390+
os.Setenv(openstackconfig.EnvKeyOpenstackTLSInsecureSkipVerify, "true")
391+
}
392+
388393
// credentials needed always in control-plane and when using gossip also in nodes
389394
passEnvs := false
390395
if ig.IsControlPlane() || cluster.UsesLegacyGossip() {

‎util/pkg/env/standard.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"k8s.io/kops/pkg/apis/kops"
2525
"k8s.io/kops/upup/pkg/fi"
2626
"k8s.io/kops/upup/pkg/fi/cloudup/scaleway"
27+
"k8s.io/kops/util/pkg/vfs/openstackconfig"
2728
)
2829

2930
type EnvVars map[string]string
@@ -64,6 +65,11 @@ func BuildSystemComponentEnvVars(spec *kops.ClusterSpec) EnvVars {
6465
vars.addEnvVariableIfExist("OS_APPLICATION_CREDENTIAL_ID")
6566
vars.addEnvVariableIfExist("OS_APPLICATION_CREDENTIAL_SECRET")
6667

68+
// Map our Insecure Skip Verify setting
69+
if spec.CloudProvider.Openstack != nil && fi.ValueOf(spec.CloudProvider.Openstack.InsecureSkipVerify) {
70+
vars[openstackconfig.EnvKeyOpenstackTLSInsecureSkipVerify] = "true"
71+
}
72+
6773
// Digital Ocean related values.
6874
vars.addEnvVariableIfExist("DIGITALOCEAN_ACCESS_TOKEN")
6975

‎util/pkg/env/standard_test.go‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/*
2+
Copyright 2026 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package env
18+
19+
import (
20+
"testing"
21+
22+
"k8s.io/kops/pkg/apis/kops"
23+
"k8s.io/kops/upup/pkg/fi"
24+
)
25+
26+
func TestBuildSystemComponentEnvVars(t *testing.T) {
27+
tests := []struct {
28+
name string
29+
spec *kops.ClusterSpec
30+
envVar string
31+
wantVal string
32+
wantExist bool
33+
}{
34+
{
35+
name: "Openstack nil",
36+
spec: &kops.ClusterSpec{
37+
CloudProvider: kops.CloudProviderSpec{},
38+
},
39+
envVar: "KOPS_OS_TLS_INSECURE_SKIP_VERIFY",
40+
wantExist: false,
41+
},
42+
{
43+
name: "Openstack InsecureSkipVerify nil",
44+
spec: &kops.ClusterSpec{
45+
CloudProvider: kops.CloudProviderSpec{
46+
Openstack: &kops.OpenstackSpec{},
47+
},
48+
},
49+
envVar: "KOPS_OS_TLS_INSECURE_SKIP_VERIFY",
50+
wantExist: false,
51+
},
52+
{
53+
name: "Openstack InsecureSkipVerify false",
54+
spec: &kops.ClusterSpec{
55+
CloudProvider: kops.CloudProviderSpec{
56+
Openstack: &kops.OpenstackSpec{
57+
InsecureSkipVerify: fi.PtrTo(false),
58+
},
59+
},
60+
},
61+
envVar: "KOPS_OS_TLS_INSECURE_SKIP_VERIFY",
62+
wantExist: false,
63+
},
64+
{
65+
name: "Openstack InsecureSkipVerify true",
66+
spec: &kops.ClusterSpec{
67+
CloudProvider: kops.CloudProviderSpec{
68+
Openstack: &kops.OpenstackSpec{
69+
InsecureSkipVerify: fi.PtrTo(true),
70+
},
71+
},
72+
},
73+
envVar: "KOPS_OS_TLS_INSECURE_SKIP_VERIFY",
74+
wantVal: "true",
75+
wantExist: true,
76+
},
77+
}
78+
79+
for _, tc := range tests {
80+
t.Run(tc.name, func(t *testing.T) {
81+
vars := BuildSystemComponentEnvVars(tc.spec)
82+
val, ok := vars[tc.envVar]
83+
if ok != tc.wantExist {
84+
t.Errorf("Expected existence of key %q to be %v, but got %v", tc.envVar, tc.wantExist, ok)
85+
}
86+
if tc.wantExist && val != tc.wantVal {
87+
t.Errorf("Expected value of key %q to be %q, but got %q", tc.envVar, tc.wantVal, val)
88+
}
89+
})
90+
}
91+
}

‎util/pkg/vfs/openstackconfig/env.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2026 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package openstackconfig
18+
19+
// KOPS_OS_TLS_INSECURE_SKIP_VERIFY is used to configure skipping TLS verification for OpenStack clients
20+
// Ideally there would be a well-known OpenStack environment variable for this purpose,
21+
// but there isn't one at present.
22+
// Instead we create a KOPS_-specific variable.
23+
const EnvKeyOpenstackTLSInsecureSkipVerify = "KOPS_OS_TLS_INSECURE_SKIP_VERIFY"

‎util/pkg/vfs/swiftfs.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ import (
4141
"k8s.io/client-go/util/homedir"
4242
"k8s.io/klog/v2"
4343
"k8s.io/kops/util/pkg/hashing"
44+
"k8s.io/kops/util/pkg/vfs/openstackconfig"
4445
)
4546

4647
func NewSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {
@@ -62,7 +63,7 @@ func NewSwiftClient(ctx context.Context) (*gophercloud.ServiceClient, error) {
6263
klog.V(4).Infof("Using user-agent %s", ua.Join())
6364

6465
tlsconfig := &tls.Config{}
65-
tlsconfig.InsecureSkipVerify = true
66+
tlsconfig.InsecureSkipVerify = config.GetInsecureSkipVerify()
6667
transport := &http.Transport{TLSClientConfig: tlsconfig}
6768
pc.HTTPClient = http.Client{
6869
Transport: transport,
@@ -150,6 +151,14 @@ func (oc OpenstackConfig) GetCredential() (gophercloud.AuthOptions, error) {
150151
return env, nil
151152
}
152153

154+
func (oc OpenstackConfig) GetInsecureSkipVerify() bool {
155+
s := os.Getenv(openstackconfig.EnvKeyOpenstackTLSInsecureSkipVerify)
156+
if s == "true" || s == "1" {
157+
return true
158+
}
159+
return false
160+
}
161+
153162
func (oc OpenstackConfig) GetRegion() (string, error) {
154163
var region string
155164
if region = os.Getenv("OS_REGION_NAME"); region != "" {

‎util/pkg/vfs/swiftfs_test.go‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
/*
2+
Copyright 2026 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package vfs
18+
19+
import (
20+
"testing"
21+
)
22+
23+
func TestOpenstackConfig_GetInsecureSkipVerify(t *testing.T) {
24+
tests := []struct {
25+
name string
26+
envVal string
27+
envSet bool // if false, don't set the env var (simulate unset)
28+
want bool
29+
}{
30+
{
31+
name: "Not set",
32+
envSet: false,
33+
want: false,
34+
},
35+
{
36+
name: "Set to empty string",
37+
envVal: "",
38+
envSet: true,
39+
want: false,
40+
},
41+
{
42+
name: "Set to true",
43+
envVal: "true",
44+
envSet: true,
45+
want: true,
46+
},
47+
{
48+
name: "Set to 1",
49+
envVal: "1",
50+
envSet: true,
51+
want: true,
52+
},
53+
{
54+
name: "Set to false",
55+
envVal: "false",
56+
envSet: true,
57+
want: false,
58+
},
59+
{
60+
name: "Set to 0",
61+
envVal: "0",
62+
envSet: true,
63+
want: false,
64+
},
65+
{
66+
name: "Set to other",
67+
envVal: "foo",
68+
envSet: true,
69+
want: false,
70+
},
71+
}
72+
73+
for _, tc := range tests {
74+
t.Run(tc.name, func(t *testing.T) {
75+
if tc.envSet {
76+
t.Setenv("KOPS_OS_TLS_INSECURE_SKIP_VERIFY", tc.envVal)
77+
} else {
78+
// Ensure it's not set from the environment where tests are running
79+
t.Setenv("KOPS_OS_TLS_INSECURE_SKIP_VERIFY", "")
80+
}
81+
82+
oc := OpenstackConfig{}
83+
got := oc.GetInsecureSkipVerify()
84+
if got != tc.want {
85+
t.Errorf("GetInsecureSkipVerify() = %v, want %v", got, tc.want)
86+
}
87+
})
88+
}
89+
}

0 commit comments

Comments
 (0)