Is insecure-skip-tls-verify working ?

[maheshrajrp]

Hi,
I have tried
flux bootstrap gitlab --insecure-skip-tls-verify --owner=maheshraj.rp --repository=devops --hostname=https://gitlab.example.com --branch=v1.0.0

Still I am getting x509 Cert Issue.

[stefanprodan]

The --insecure-skip-tls-verify is for the Kubernetes API server's certificate, in your case you need to use --ca-file and provide the TLS CA file.

[ArKam]

Could we get a —insecure-tls option as it would help a lot on scenarios where we bootstrap on a fresh server that don’t get cert-manager yet installed but that traefik or any other ingress controller already provide external connectivity.

when using a k3s/k0s/etc embedded solution within an airgapped environment, this create a situation where you need the following minimum requirements before being able to bootstrap flux:

• cert-manager.
• external-dns.
• a forge provider (gitea/forgejo/gitlab).

which kinda create a sub-optimal bootstrap stack.

The idea would be to at least eliminate cert-manager and external-dns on this requirement list for very early clusters bootstrap.

[stefanprodan]

Is the Git server hosted on the same cluster as Flux? If so, you can use the Flux Operator and set the sync URL to an insecure HTTP repo, pointing to the Kubernetes Service name, docs here: https://fluxcd.control-plane.io/operator/flux-sync/#sync-from-a-git-repository