Skip to content

Commit dd26f5d

Browse files
manaswinidasmanaswinidas
authored
Structure MR BFF server to use secure HTTP calls (#1438)
* Structure MR BFF server to use secure HTTP calls Signed-off-by: manaswinidas <[email protected]> * add configurable TLS verification for MR HTTP client Signed-off-by: manaswinidas <[email protected]> * Add instructions to disable TLS for local Signed-off-by: manaswinidas <[email protected]> --------- Signed-off-by: manaswinidas <[email protected]>
1 parent 29ab55c commit dd26f5d

File tree

7 files changed

+51
-12
lines changed

7 files changed

+51
-12
lines changed

‎clients/ui/bff/README.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -468,3 +468,25 @@ Examples:
468468
```shell
469469
./bff --allowed-origins="http://my-domain.com,http://my-other-domain.com"
470470
```
471+
472+
#### 6. How do I disable TLS verification for local Kubeflow installations?
473+
474+
For local Kubeflow installations with self-signed certificates, you may need to disable TLS certificate verification.
475+
476+
**Kubernetes deployment:**
477+
478+
```yaml
479+
env:
480+
- name: INSECURE_SKIP_VERIFY
481+
value: "true"
482+
```
483+
484+
**Local development:**
485+
486+
```shell
487+
./bin/bff --insecure-skip-verify
488+
# or
489+
export INSECURE_SKIP_VERIFY=true
490+
```
491+
492+
> **Warning:** Only use in development. Keep TLS verification enabled in production.

‎clients/ui/bff/cmd/helpers.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,15 @@ func getEnvAsString(name string, defaultVal string) string {
2424
return defaultVal
2525
}
2626

27+
func getEnvAsBool(name string, defaultVal bool) bool {
28+
if value, exists := os.LookupEnv(name); exists {
29+
if boolValue, err := strconv.ParseBool(value); err == nil {
30+
return boolValue
31+
}
32+
}
33+
return defaultVal
34+
}
35+
2736
func parseLevel(s string) slog.Level {
2837
var level slog.Level
2938
err := level.UnmarshalText([]byte(s))

‎clients/ui/bff/cmd/main.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ func main() {
4040
flag.StringVar(&cfg.AuthTokenHeader, "auth-token-header", getEnvAsString("AUTH_TOKEN_HEADER", config.DefaultAuthTokenHeader), "Header used to extract the token (e.g., Authorization)")
4141
flag.StringVar(&cfg.AuthTokenPrefix, "auth-token-prefix", getEnvAsString("AUTH_TOKEN_PREFIX", config.DefaultAuthTokenPrefix), "Prefix used in the token header (e.g., 'Bearer ')")
4242

43+
// TLS configuration flags
44+
flag.BoolVar(&cfg.InsecureSkipVerify, "insecure-skip-verify", getEnvAsBool("INSECURE_SKIP_VERIFY", false), "Skip TLS certificate verification (useful for development, default: false)")
45+
4346
// Deprecated flags - kept for backward compatibility
4447
flag.BoolVar(&cfg.StandaloneMode, "standalone-mode", false, "DEPRECATED: Use -deployment-mode=standalone instead")
4548
flag.BoolVar(&cfg.FederatedPlatform, "federated-platform", false, "DEPRECATED: Use -deployment-mode=federated instead")

‎clients/ui/bff/internal/api/middleware.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,9 +143,9 @@ func (app *App) AttachRESTClient(next func(http.ResponseWriter, *http.Request, h
143143
}
144144
}
145145

146-
restHttpClient, err := mrserver.NewHTTPClient(restClientLogger, modelRegistryID, modelRegistryBaseURL, headers)
146+
restHttpClient, err := mrserver.NewHTTPClient(restClientLogger, modelRegistryID, modelRegistryBaseURL, headers, app.config.InsecureSkipVerify)
147147
if err != nil {
148-
app.serverErrorResponse(w, r, fmt.Errorf("failed to create Kubernetes client: %v", err))
148+
app.serverErrorResponse(w, r, fmt.Errorf("failed to create HTTP client: %v", err))
149149
return
150150
}
151151
ctx := context.WithValue(r.Context(), constants.ModelRegistryHttpClientKey, restHttpClient)

‎clients/ui/bff/internal/config/environment.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,12 @@ type EnvConfig struct {
9696
// Default is "Bearer ", can be set to empty if the token is sent without a prefix.
9797
AuthTokenPrefix string
9898

99+
// ─── TLS ────────────────────────────────────────────────────
100+
// TLS verification settings for HTTP client connections to Model Registry
101+
// InsecureSkipVerify when true, skips TLS certificate verification (useful for development/local setups)
102+
// Default is false (secure) for production environments
103+
InsecureSkipVerify bool
104+
99105
// ─── DEPRECATED ─────────────────────────────────────────────
100106
// The following fields are deprecated and maintained for backward compatibility
101107
// Use DeploymentMode instead

‎clients/ui/bff/internal/integrations/mrserver/http.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,10 @@ func (e *HTTPError) Error() string {
4141
return fmt.Sprintf("HTTP %d: %s - %s", e.StatusCode, e.Code, e.Message)
4242
}
4343

44-
func NewHTTPClient(logger *slog.Logger, modelRegistryID string, baseURL string, headers http.Header) (HTTPClientInterface, error) {
45-
44+
func NewHTTPClient(logger *slog.Logger, modelRegistryID string, baseURL string, headers http.Header, insecureSkipVerify bool) (HTTPClientInterface, error) {
4645
return &HTTPClient{
4746
client: &http.Client{Transport: &http.Transport{
48-
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
47+
TLSClientConfig: &tls.Config{InsecureSkipVerify: insecureSkipVerify},
4948
}},
5049
baseURL: baseURL,
5150
ModelRegistryID: modelRegistryID,

‎clients/ui/bff/internal/integrations/mrserver/http_test.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func TestHTTPClient_GET_Success(t *testing.T) {
3737

3838
// Create http client pointing to test server
3939
logger := setupTestLogger()
40-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
40+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
4141
require.NoError(t, err)
4242

4343
// Make the request
@@ -73,7 +73,7 @@ func TestHTTPClient_GET_Error(t *testing.T) {
7373

7474
// Create http client pointing to test server
7575
logger := setupTestLogger()
76-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
76+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
7777
require.NoError(t, err)
7878

7979
// Make the request
@@ -123,7 +123,7 @@ func TestHTTPClient_POST_Success(t *testing.T) {
123123

124124
// Create http client pointing to test server
125125
logger := setupTestLogger()
126-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
126+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
127127
require.NoError(t, err)
128128

129129
// Prepare request body
@@ -164,7 +164,7 @@ func TestHTTPClient_POST_Error(t *testing.T) {
164164

165165
// Create http client pointing to test server
166166
logger := setupTestLogger()
167-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
167+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
168168
require.NoError(t, err)
169169

170170
// Prepare request body
@@ -218,7 +218,7 @@ func TestHTTPClient_PATCH_Success(t *testing.T) {
218218

219219
// Create http client pointing to test server
220220
logger := setupTestLogger()
221-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
221+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
222222
require.NoError(t, err)
223223

224224
// Prepare request body
@@ -259,7 +259,7 @@ func TestHTTPClient_PATCH_Error(t *testing.T) {
259259

260260
// Create client pointing to test server
261261
logger := setupTestLogger()
262-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
262+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
263263
require.NoError(t, err)
264264

265265
// Prepare request body
@@ -300,7 +300,7 @@ func TestHTTPClient_GET_NonJSONError(t *testing.T) {
300300

301301
// Create http client pointing to test server
302302
logger := setupTestLogger()
303-
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil)
303+
client, err := NewHTTPClient(logger, "test-registry", server.URL, nil, false)
304304
require.NoError(t, err)
305305

306306
// Make the request

0 commit comments

Comments
 (0)