Skip to content

fix: set TLS MinVersion to 1.2 in ping handler HTTP client#3859

Merged
clubanderson merged 1 commit intomainfrom
fix/issue-3853-gosec-tls-minversion
Mar 29, 2026
Merged

fix: set TLS MinVersion to 1.2 in ping handler HTTP client#3859
clubanderson merged 1 commit intomainfrom
fix/issue-3853-gosec-tls-minversion

Conversation

@clubanderson
Copy link
Copy Markdown
Collaborator

@clubanderson clubanderson commented Mar 29, 2026

Closes #3853

Summary

  • Set MinVersion: tls.VersionTLS12 on the tls.Config in pkg/api/handlers/ping.go to fix the gosec finding "TLS MinVersion too low"
  • Removed the redundant InsecureSkipVerify: false (it's the zero-value default)
  • Verified with scripts/gosec-test.sh — no HIGH findings remain

Test plan

  • go build ./... passes
  • scripts/gosec-test.sh reports no security issues
  • cd web && npm run build passes

@claude
fix: set TLS MinVersion to 1.2 in ping handler HTTP client (#3853)
f4a624f 
The gosec scanner flagged the TLS config in ping.go because MinVersion
was not explicitly set, defaulting to TLS 1.0. Set MinVersion to
tls.VersionTLS12 to satisfy the security requirement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 29, 2026 07:46
@kubestellar-prow
Copy link
Copy Markdown
Contributor

kubestellar-prow bot commented Mar 29, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow kubestellar-prow bot added the dco-signoff: no Indicates the PR's author has not signed the DCO. label Mar 29, 2026
@kubestellar-prow
Copy link
Copy Markdown
Contributor

kubestellar-prow bot commented Mar 29, 2026

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@clubanderson clubanderson merged commit 39c52b4 into main Mar 29, 2026
1 check failed
@netlify
Copy link
Copy Markdown

netlify bot commented Mar 29, 2026 •
edited
Loading

✅ Deploy Preview for kubestellarconsole canceled.

Name Link
🔨 Latest commit f4a624f
🔍 Latest deploy log https://app.netlify.com/projects/kubestellarconsole/deploys/69c8d8ef2997270008c639ba

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 29, 2026

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

@kubestellar-prow kubestellar-prow bot deleted the fix/issue-3853-gosec-tls-minversion branch March 29, 2026 07:46
@kubestellar-prow kubestellar-prow bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Mar 29, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 29, 2026

Thank you for your contribution! Your PR has been merged.

Check out what's new:

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Copilot AI reviewed Mar 29, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the ping handler’s shared HTTP client TLS configuration to satisfy gosec’s minimum TLS requirements.

Changes:

  • Set tls.Config.MinVersion to tls.VersionTLS12 for the ping handler HTTP client transport.
  • Removed the redundant InsecureSkipVerify: false assignment.

pkg/api/handlers/ping.go
Timeout: 5 * time.Second,
Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12},
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Repository PR workflow requires the PR body to start with Fixes #<issue> so GitHub auto-closes the issue on merge. The current PR description starts with Closes #3853; please change it to Fixes #3853 as the first line.

Copilot uses AI. Check for mistakes.
@clubanderson
Copy link
Copy Markdown
Collaborator Author

clubanderson commented Mar 29, 2026

🔄 Auto-Applying Copilot Code Review

Copilot code review found 0 code suggestion(s) and 1 general comment(s).

Also address these general comments:

  • pkg/api/handlers/ping.go (line 21): Repository PR workflow requires the PR body to start with Fixes #<issue> so GitHub auto-closes the issue on merge. The

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

@github-actions github-actions bot mentioned this pull request Mar 29, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

Copilot code review Copilot

Labels

dco-signoff: no Indicates the PR's author has not signed the DCO. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Nightly regression: gosec-test

3 participants

@clubanderson