Remove inscure tls option for quota client (#568)

cloudfoundry · Apr 20, 2022 · deb50f4 · deb50f4
1 parent 9767d64
commit deb50f4
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 11 deletions.
diff --git a/src/autoscaler/api/brokerserver/broker_handler.go b/src/autoscaler/api/brokerserver/broker_handler.go
@@ -58,7 +58,7 @@ func NewBrokerHandler(logger lager.Logger, conf *config.Config, bindingdb db.Bin
 		catalog:               catalog,
 		policyValidator:       policyvalidator.NewPolicyValidator(conf.PolicySchemaPath, conf.ScalingRules.CPU.LowerThreshold, conf.ScalingRules.CPU.UpperThreshold),
 		schedulerUtil:         schedulerutil.NewSchedulerUtil(conf, logger),
-		quotaManagementClient: quota.NewClient(conf, logger, cfClient),
+		quotaManagementClient: quota.NewClient(conf, logger),
 		planChecker:           plancheck.NewPlanChecker(conf.PlanCheck, logger),
 		cfClient:              cfClient,
 		credentials:           credentials,

diff --git a/src/autoscaler/api/quota/quota_management_client.go b/src/autoscaler/api/quota/quota_management_client.go
@@ -2,7 +2,6 @@ package quota
 
 import (
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -24,14 +23,14 @@ type Client struct {
 	logger   lager.Logger
 }
 
-func NewClient(config *config.Config, logger lager.Logger, cfClient cf.CFClient) *Client {
+func NewClient(config *config.Config, logger lager.Logger) *Client {
 	qmc := &Client{conf: config, logger: logger.Session("quota-management-client")}
 
 	if config.QuotaManagement != nil {
 		qmc.logger.Info("creating-client")
 		hc := &http.Client{
 			Timeout:   15 * time.Second,
-			Transport: newTransport(true),
+			Transport: newTransport(),
 		}
 		ctx := context.WithValue(context.Background(), oauth2.HTTPClient, hc)
 		conf := &clientcredentials.Config{ClientID: config.QuotaManagement.ClientID, ClientSecret: config.QuotaManagement.Secret, TokenURL: config.QuotaManagement.TokenURL}
@@ -41,22 +40,18 @@ func NewClient(config *config.Config, logger lager.Logger, cfClient cf.CFClient)
 	return qmc
 }
 
-func newTransport(shouldSkipTLSValidation bool) *http.Transport {
+func newTransport() *http.Transport {
 	return &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		DialContext: (&net.Dialer{
 			Timeout:   5 * time.Second,
 			KeepAlive: 30 * time.Second,
-			DualStack: true,
 		}).DialContext,
 		ForceAttemptHTTP2:     true,
 		MaxIdleConns:          100,
 		IdleConnTimeout:       90 * time.Second,
 		TLSHandshakeTimeout:   5 * time.Second,
 		ExpectContinueTimeout: 1 * time.Second,
-		//TODO we should not be turning of SkipSSLValidation on the default transport
-		//#nosec G402
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: shouldSkipTLSValidation},
 	}
 }
 

diff --git a/src/autoscaler/api/quota/quota_management_client_test.go b/src/autoscaler/api/quota/quota_management_client_test.go
@@ -27,7 +27,7 @@ var _ = Describe("Quota", func() {
 	Context("GetQuota", func() {
 		Context("when not configured", func() {
 			BeforeEach(func() {
-				qmc = quota.NewClient(quotaConfig, lagertest.NewTestLogger("Quota"), nil)
+				qmc = quota.NewClient(quotaConfig, lagertest.NewTestLogger("Quota"))
 			})
 			It("returns -1", func() {
 				quotaSize, err = qmc.GetQuota("test-org", "test-service", "test-plan")
@@ -40,7 +40,7 @@ var _ = Describe("Quota", func() {
 				quotaServer = ghttp.NewServer()
 				quotaConfig.QuotaManagement = &config.QuotaManagementConfig{}
 				quotaConfig.QuotaManagement.API = quotaServer.URL()
-				qmc = quota.NewClient(quotaConfig, lagertest.NewTestLogger("Quota"), nil)
+				qmc = quota.NewClient(quotaConfig, lagertest.NewTestLogger("Quota"))
 				qmc.SetClient(&http.Client{})
 
 				quotaServer.AppendHandlers(