fix: verify control-plane TLS certificate by default

api/v1alpha1/gatewayproxy_types.go

@@ -133,7 +133,10 @@ type ControlPlaneProvider struct {
 
 	Service *ProviderService `json:"service,omitempty"`
 	// TlsVerify specifies whether to verify the TLS certificate of the control plane.
+	// Defaults to true. Setting it to false disables certificate verification and
+	// exposes the AdminKey to man-in-the-middle attacks over https endpoints.
 	// +optional
+	// +kubebuilder:default=true
 	TlsVerify *bool `json:"tlsVerify,omitempty"`
 
 	// CaCert specifies the CA certificate used to verify the control plane's TLS

config/crd-nocel/apisix.apache.org_v2.yaml

@@ -2309,8 +2309,11 @@ spec:
                         - name
                         type: object
                       tlsVerify:
-                        description: TlsVerify specifies whether to verify the TLS
-                          certificate of the control plane.
+                        default: true
+                        description: |-
+                          TlsVerify specifies whether to verify the TLS certificate of the control plane.
+                          Defaults to true. Setting it to false disables certificate verification and
+                          exposes the AdminKey to man-in-the-middle attacks over https endpoints.
                         type: boolean
                     required:
                     - auth

config/crd/bases/apisix.apache.org_gatewayproxies.yaml

@@ -164,8 +164,11 @@ spec:
                         - name
                         type: object
                       tlsVerify:
-                        description: TlsVerify specifies whether to verify the TLS
-                          certificate of the control plane.
+                        default: true
+                        description: |-
+                          TlsVerify specifies whether to verify the TLS certificate of the control plane.
+                          Defaults to true. Setting it to false disables certificate verification and
+                          exposes the AdminKey to man-in-the-middle attacks over https endpoints.
                         type: boolean
                     required:
                     - auth

docs/en/latest/reference/api-reference.md

@@ -329,7 +329,7 @@ ControlPlaneProvider defines configuration for control plane provider.
 | `mode` _string_ | Mode specifies the mode of control plane provider. Can be `apisix` or `apisix-standalone`. |
 | `endpoints` _string array_ | Endpoints specifies the list of control plane endpoints. |
 | `service` _[ProviderService](#providerservice)_ |  |
-| `tlsVerify` _boolean_ | TlsVerify specifies whether to verify the TLS certificate of the control plane. |
+| `tlsVerify` _boolean_ | TlsVerify specifies whether to verify the TLS certificate of the control plane. Defaults to true. Setting it to false disables certificate verification and exposes the AdminKey to man-in-the-middle attacks over https endpoints. |
 | `caCert` _[ControlPlaneCaCert](#controlplanecacert)_ | CaCert specifies the CA certificate used to verify the control plane's TLS certificate, in place of the system trust store. Set it when the control plane uses a self-signed or private CA certificate. It has no effect when tlsVerify is false. |
 | `auth` _[ControlPlaneAuth](#controlplaneauth)_ | Auth specifies the authentication configuration. |
 

docs/en/latest/upgrade-guide.md

@@ -25,6 +25,26 @@ keywords:
 #
 -->
 
+## GatewayProxy control-plane TLS verification
+
+TLS certificate verification is enabled by default for HTTPS control-plane
+connections. Kubernetes CRD defaulting also applies to existing `GatewayProxy`
+objects when they are read after the CRD is upgraded. As a result, an existing
+object that omits `spec.provider.controlPlane.tlsVerify` will begin verifying
+the control plane's certificate after upgrading to a release that contains
+this change.
+
+Before upgrading, check every `GatewayProxy` that uses an HTTPS control-plane
+endpoint:
+
+- No change is required when the certificate is trusted by the system trust
+  store.
+- For a self-signed certificate or private CA, configure the PEM-encoded CA
+  certificate or bundle in `spec.provider.controlPlane.caCert.value`.
+- Use `spec.provider.controlPlane.tlsVerify: false` only as a temporary
+  development workaround. It disables certificate verification and exposes
+  the AdminKey to man-in-the-middle attacks.
+
 ## Upgrading from 1.x.x to 2.0.0: Key Changes and Considerations
 
 This document outlines the major updates, configuration compatibility changes, API behavior differences, and critical considerations when upgrading the APISIX Ingress Controller from version 1.x.x to 2.0.0. Please read carefully and assess the impact on your existing system before proceeding with the upgrade.
@@ -128,7 +148,7 @@ spec:
     type: ControlPlane
     controlPlane:
       endpoints:
-      - https://127.0.0.1:9180
+      - http://127.0.0.1:9180
       auth:
         type: AdminKey
         adminKey:

examples/httpbin/httproute.yaml

@@ -34,6 +34,8 @@ spec:
     controlPlane:
       endpoints:
         - ${ADMIN_ENDPOINT}   # https://127.0.0.1:7443
+      # The local quick-start endpoint uses a self-signed development certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey:

examples/httpbin/ingress.yaml

@@ -26,6 +26,8 @@ spec:
     controlPlane:
       endpoints:
         - ${ADMIN_ENDPOINT}   # https://127.0.0.1:7443
+      # The local quick-start endpoint uses a self-signed development certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey:

examples/httpbin/quickstart.yaml

@@ -92,6 +92,8 @@ spec:
     controlPlane:
       endpoints:
         - ${ADMIN_ENDPOINT}   # https://127.0.0.1:7443
+      # The local quick-start endpoint uses a self-signed development certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey:

examples/httpbin/tcproute.yaml

@@ -34,6 +34,8 @@ spec:
     controlPlane:
       endpoints:
         - ${ADMIN_ENDPOINT}   # https://127.0.0.1:7443
+      # The local quick-start endpoint uses a self-signed development certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey:

internal/adc/translator/gatewayproxy.go

@@ -54,6 +54,9 @@ func (t *Translator) TranslateGatewayProxyToConfig(tctx *provider.TranslateConte
 		BackendType: cp.Mode,
 	}
 
+	// Verify the control plane's TLS certificate by default; only an explicit
+	// tlsVerify:false opts out.
+	cfg.TlsVerify = true
 	if cp.TlsVerify != nil {
 		cfg.TlsVerify = *cp.TlsVerify
 	}

internal/adc/translator/gatewayproxy_test.go

@@ -61,6 +61,29 @@ func newGatewayProxy(tlsVerify *bool, caCert string) *v1alpha1.GatewayProxy {
 	}
 }
 
+func TestTranslateGatewayProxyToConfig_TlsVerifyDefault(t *testing.T) {
+	cases := []struct {
+		name      string
+		tlsVerify *bool
+		want      bool
+	}{
+		{"unset defaults to verify", nil, true},
+		{"explicit false opts out", ptr.To(false), false},
+		{"explicit true verifies", ptr.To(true), true},
+	}
+
+	translator := NewTranslator(logr.Discard(), "")
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			tctx := provider.NewDefaultTranslateContext(context.Background())
+			cfg, err := translator.TranslateGatewayProxyToConfig(tctx, newGatewayProxy(c.tlsVerify, ""), false)
+			require.NoError(t, err)
+			require.NotNil(t, cfg)
+			require.Equal(t, c.want, cfg.TlsVerify)
+		})
+	}
+}
+
 func TestTranslateGatewayProxyToConfigCaCert(t *testing.T) {
 	t.Run("carries the CA certificate into the config", func(t *testing.T) {
 		tr := &Translator{Log: logr.Discard()}

test/e2e/api7/route.go

@@ -52,6 +52,8 @@ spec:
     controlPlane:
       endpoints:
         - https://api7ee3-dashboard:7443
+      # The API7 E2E dashboard uses a self-signed test certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey:

test/e2e/scaffold/k8s.go

@@ -337,6 +337,8 @@ spec:
     controlPlane:
       endpoints:
       - %s
+      # The API7 E2E dashboard uses a self-signed test certificate.
+      tlsVerify: false
       auth:
         type: AdminKey
         adminKey: