Disable TLS verification k3d cluster

[bindragithub]

My config file:
File name: cluster.yaml

apiVersion: k3d.io/v1alpha5
kind: Simple
metadata:
  name: mycluster

# k3d cluster create mycluster --api-port 6445 --servers 1 --agents 2 -p "80:80@loadbalacer"
servers: 1 # same as `--servers 1`
#-- insecure-skip-tls-verify: true
agents: 1 # same as `--agents 2`, before k3d used to call them worker nodes
kubeAPI:
  host: "localhost"
  hostIP: "127.0.0.1"
  hostPort: "6445"
image: docker.io/rancher/k3s:v1.21.5-k3s1   

ports:
  - port: 80:80 # same as `--port '80:80@loadbalancer'`
    nodeFilters:
      - loadbalancer
registries:
#  create: #same as `--registry-create demo-registry`
#    name: demo-registry
#    host: "0.0.0.0"
    use:
     - k3d-demo-registry:61919
options:
  
  k3d:
    wait: true # wait for cluster to be usable ; same as `--wait` (default: true)
    timeout: "60s" # wait timeout before aborting; same as `--timeout 60s`
    disableLoadbalancer: false # same as `--no-lb`
    
    loadbalancer:
      configOverrides:
        - settings.workerConnections=2048
        
  kubeconfig:
    updateDefaultKubeconfig: true
    switchCurrentContext: true

Question: How and where do I implement insecure-skip-tls-verify: true or --insecure-skip-tls-verify in the above configuration file e to disable TLS?

cluster create -c cluster.yaml

[taemon1337]

+1

[iwilltry42]

Hey there!
Seems I never got around to check this out (nor did anyone else) - sorry for that!

Can one of you @bindragithub or @taemon1337 elaborate on where you want to set this flag or where you want to disable TLS?

If you're referring to a K3s server flag, you can set them all like that in the config file:

options:
  k3s: # options passed on to K3s itself
    extraArgs: # additional arguments passed to the `k3s server|agent` command; same as `--k3s-arg`
      - arg: "--tls-san=my.host.domain"
        nodeFilters:
          - server:*

[taemon1337]

So in my case...

k3d cluster create --api-port 6550 -p "8080:80@loadbalancer" -p "8443:443@loadbalancer"

And created an Ingress like so:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test
  annotations:
    ingress.kubernetes.io/ssl-redirect: "false"
    ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: test-svc
            port:
              number: 443

which listens using self-signed certs on port 8443 (service port is 443 targets 8443) and gets the following error when trying to connect

http: TLS handshake error from 10.42.1.6:42224: remote error: tls: bad certificate

which I'm assuming is because the k3d-proxy cannot verify the self-signed certs from my service. I was hoping for some annotation like tls-skip-verify or insecure-upstream to allow the connection through (assuming the problem is what I suspect)

[iwilltry42]

Thanks for elaborating!
k3d-proxy does not TLS verification whatsoever, it's plain tcp/udp passthrough and doesn't interfere with your ingress traffic in any way (it's just convenient port-forwarding since we cannot do that dynamically on the server container itself).
By default K3s deploys traefik though and I'm not sure it adheres to the ingress.kubernetes.io annotations.
Checkout their docs, maybe that's helpful in your case: https://doc.traefik.io/traefik/routing/providers/kubernetes-ingress/#on-ingress

[taemon1337]

ok awesome, thanks! that makes more sense now

[taemon1337]

Just a follow up for any possible future references...I see now it was traefik that needed updating, so on k3d/k3s I was able to somewhat declaratively using the following HelmChartConfig:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    additionalArguments:
      - "--serverstransport.insecureskipverify"

which allowed connections to my selfsigned backend.