From da327ce8073ae6f66aa020eda621de1a6495e6be Mon Sep 17 00:00:00 2001 From: Charandas Date: Mon, 11 Mar 2024 16:13:14 -0700 Subject: [PATCH] K8s: enable insecure to skip server cert validation for now (#84038) --- pkg/services/apiserver/aggregator/aggregator.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/services/apiserver/aggregator/aggregator.go b/pkg/services/apiserver/aggregator/aggregator.go index 708efff204e..c25d41d278f 100644 --- a/pkg/services/apiserver/aggregator/aggregator.go +++ b/pkg/services/apiserver/aggregator/aggregator.go @@ -146,7 +146,10 @@ func CreateAggregatorConfig(commandOptions *options.Options, sharedConfig generi } remoteServicesConfig := &RemoteServicesConfig{ - InsecureSkipTLSVerify: commandOptions.ExtraOptions.DevMode, + // TODO: in practice, we should only use the insecure flag when commandOptions.ExtraOptions.DevMode == true + // But given the bug in K8s, we are forced to set it to true until the below PR is merged and available + // https://github.com/kubernetes/kubernetes/pull/123808 + InsecureSkipTLSVerify: true, ExternalNamesNamespace: externalNamesNamespace, CABundle: caBundlePEM, Services: remoteServices,