shreemaan-abhishek opened a new pull request, #2811: URL: https://github.com/apache/apisix-ingress-controller/pull/2811
## What this PR does `GatewayProxy` `spec.provider.controlPlane.tlsVerify` is a `*bool` with no default. When omitted (as the shipped `examples/httpbin` manifests do, while pointing at `https://` Admin API endpoints), it decodes to `nil`, the translator leaves `cfg.TlsVerify` at the Go zero value `false`, and the executor inverts that into `tlsSkipVerify: true`. The result is that a default install skips certificate verification on the connection that carries the AdminKey and the full gateway config. This makes verification the secure default: - `+kubebuilder:default=true` on the CRD field, so an omitted `tlsVerify` becomes `true`. - `cfg.TlsVerify = true` in the translator before honoring an explicit value, so behavior is correct even against an older CRD without the default. Only an explicit `tlsVerify: false` opts out. - Regenerated CRD manifest and API reference docs; documented that setting it to `false` disables certificate verification. ## Testing Added a translator unit test asserting the default: unset -> verify, explicit `false` -> skip, explicit `true` -> verify. ``` go test ./internal/adc/translator/ -run TestTranslateGatewayProxyToConfig_TlsVerifyDefault ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
