Security Misconfiguration: Use of HTTP Without TLS

[akondasif]

[akondasif]

We also have noticed an instance of HTTP without TLS/SSL in one of your Kubernetes manifests. The recommended practice is use of secure HTTP for each team's development and production environment. Enabling TLS ensures secure communication between cluster components.. For examples of Kubernetes security anti-patterns we are following our peer-reviewed publication on Kubernetes security best practices (https://arxiv.org/pdf/2006.15275.pdf).

Location:

IngressMonitorController/config/default/manager_auth_proxy_patch.yaml

Line 16 in a180b75

- "--upstream=http://127.0.0.1:8080/"

Please use SSL/TLS to fix this misconfiguration. We would like to hear if you agree to fix this misconfiguration or have fixed the misconfiguration.

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[github-actions]

This issue was closed because it has been inactive for 30 days since being marked as stale.

[karl-johan-grahn]

Reopening issues that inadvertently were closed as stale

[github-actions]

This issue is stale because it has been open for 60 days with no activity.