From acae1553edc3ed7bf970f7dee9afb896443906c3 Mon Sep 17 00:00:00 2001 From: Thomas Krampl Date: Wed, 30 Sep 2026 15:58:59 +0200 Subject: [PATCH] Store static cluster config as secret and enforce TLS Move `KUBERNETES_CLUSTERS_STATIC` from deployment env to Kubernetes Secret, and update feature docs to reflect secret storage and CA/hostname requirements for API server certs. Remove insecure TLS override for static cluster clients so certificate validation is now enforced by default. --- charts/nais-api/templates/deployment.yaml | 4 ---- charts/nais-api/templates/secret.yaml | 3 +++ internal/kubernetes/config.go | 3 --- 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/charts/nais-api/templates/deployment.yaml b/charts/nais-api/templates/deployment.yaml index cb1d0c990..ebe18289f 100644 --- a/charts/nais-api/templates/deployment.yaml +++ b/charts/nais-api/templates/deployment.yaml @@ -28,10 +28,6 @@ spec: env: - name: KUBERNETES_CLUSTERS value: "{{ .Values.kubernetes.clusters }}" - {{- if .Values.kubernetes.static }} - - name: KUBERNETES_CLUSTERS_STATIC - value: "{{ .Values.kubernetes.static }}" - {{- end }} - name: TENANT value: "{{ .Values.fasit.tenant.name }}" - name: TENANT_DOMAIN diff --git a/charts/nais-api/templates/secret.yaml b/charts/nais-api/templates/secret.yaml index 219b79bc0..5e048b9db 100644 --- a/charts/nais-api/templates/secret.yaml +++ b/charts/nais-api/templates/secret.yaml @@ -6,6 +6,9 @@ metadata: app: "{{ .Release.Name }}" type: Opaque stringData: + {{- if .Values.kubernetes.static }} + KUBERNETES_CLUSTERS_STATIC: {{ .Values.kubernetes.static | quote }} + {{- end }} HOOKD_PSK: "{{ .Values.hookd.psk }}" REST_PRE_SHARED_KEY: "{{ .Values.rest.psk }}" OAUTH_CLIENT_SECRET: "{{ .Values.oauth.clientSecret }}" diff --git a/internal/kubernetes/config.go b/internal/kubernetes/config.go index 0c34c0995..e0aa40a3b 100644 --- a/internal/kubernetes/config.go +++ b/internal/kubernetes/config.go @@ -48,9 +48,6 @@ func getStaticClusterConfigs(clusters []StaticCluster) ClusterConfigMap { configs[cluster.Name] = &rest.Config{ Host: cluster.Host, BearerToken: cluster.Token, - TLSClientConfig: rest.TLSClientConfig{ - Insecure: true, - }, WrapTransport: func(rt http.RoundTripper) http.RoundTripper { return otelhttp.NewTransport(rt, otelhttp.WithServerName(cluster.Name)) },