The probe read S3_INSECURE_SKIP_VERIFY from any container of the backup
Job, so a custom strategy whose sidecar sets it while the uploading
container verifies made the probe skip verification the upload did
not. The probe cannot tell which container uploaded, so it now skips
only when every container sets the variable to true, the last entry
winning as in the kubelet.
An s3-ca volume of a source other than a Secret yields no CA the probe
can read; it is now treated like a CA Secret that is gone, so it never
turns into skip-verify.
Tests pin the guards that decide the probe's trust: the Redis CA volume
mounted next to the S3 one, a decoy variable set to true, a CA that did
not sign the endpoint, and the AlreadyExists read-back past the cache.
Assisted-by: LLM
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Andrey Kolkov
43bed8f6d9