cloudfoundry / cloudfoundry/cf-deployment
Validate component certs by default
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 315
- Forks
- 315
- Avg merge
- 7d 9h
- Merged PRs (30d)
- 5
Description
What is this issue about?
cf-deployment currently skips verification of certificates for certain inter-component communications by default, with an ops file to stop skipping certificate validation.
We would expect the reverse, that cf-deployment be the most secure by default, with an ops file to make it insecure as desired.
What version of cf-deployment are you using?
cf-deployment v17.1.0
Please include the bosh deploy... command, including all the operations files (plus any experimental operation files you're using):
N/A
Please provide output that helps describe the issue:
N/A
What IaaS is this issue occurring on?
N/A
Is there anything else unique or special about your setup?
N/A
Tag your pair, your PM, and/or team!
@mkocher @acrmp
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the current default certificate-validation settings in cf-deployment and compare them with operations/stop-skipping-tls-validation.yml. Done means certificate verification is enabled by default, while an operations file provides the explicitly insecure behavior described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- yaml
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100