cc @lavalamp

We're doing client cert to etcd, right? So I think it's OK, since etcd will be doing the cert checking, not apiserver. But maybe we can get confirmation from @xiang90.

This is about the client verifying the server's serving cert (2-way TLS), and whether the client has to have a way to disable that check.

/cc @hongchaodeng

@liggitt you mean whether the client has a way to enable that check?

no... TLSInfo.ClientConfig() never returns a &tls.Config{} with InsecureSkipVerify set to true, so unless we do something to set it to true, the client will always verify the server TLS

Oh, you're right. That changed since I saw it.

I think admins can add their ca to the system list if they want to use self-signed certs for etcd.

Will raise priority again if I see a bunch of admins here complaining. :)

Issues go stale after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Freeze the issue for 90d with /lifecycle frozen.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle rotten
/remove-lifecycle stale

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close