fix: Switch InsecureSkipVerify to true (#5575)

Signed-off-by: Simon Behar <simbeh7@gmail.com>
argoproj · Apr 1, 2021 · 4e450e2 · 4e450e2
1 parent ed54f15
commit 4e450e2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/cmd/argo/commands/server.go b/cmd/argo/commands/server.go
@@ -100,7 +100,7 @@ See %s`, help.ArgoSever),
 				}
 				tlsConfig = &tls.Config{
 					Certificates:       []tls.Certificate{cer},
-					InsecureSkipVerify: false, // InsecureSkipVerify will not impact the TLS listener. It is needed for the server to speak to itself for GRPC.
+					InsecureSkipVerify: true,
 					MinVersion:         uint16(tlsMinVersion),
 				}
 			} else {

diff --git a/server/apiserver/argoserver.go b/server/apiserver/argoserver.go
@@ -16,6 +16,7 @@ import (
 	"github.com/soheilhy/cmux"
 	"golang.org/x/net/context"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/rest"
 
@@ -271,8 +272,13 @@ func (as *argoServer) newHTTPServer(ctx context.Context, port int, artifactServe
 	}
 	dialOpts := []grpc.DialOption{
 		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(MaxGRPCMessageSize)),
-		grpc.WithInsecure(),
 	}
+	if as.tlsConfig != nil {
+		dialOpts = append(dialOpts, grpc.WithTransportCredentials(credentials.NewTLS(as.tlsConfig)))
+	} else {
+		dialOpts = append(dialOpts, grpc.WithInsecure())
+	}
+
 	webhookInterceptor := webhook.Interceptor(as.clients.Kubernetes)
 
 	// HTTP 1.1+JSON Server