From c0ec2fc7aba2239f6853a72fc5fac3f35ee91732 Mon Sep 17 00:00:00 2001
From: "W. Trevor King" <wking@tremily.us>
Date: Tue, 15 Sep 2020 12:00:34 -0700
Subject: [PATCH] pkg/controller/cincinnati: Use
 InsecureEdgeTerminationPolicyNone

We had used InsecureEdgeTerminationPolicyAllow since the route landed
in 1fdf865825 (Create a route for Cincinnati service, 2020-05-01,
commit message, but from discussion in the GitHub pull request [1], it
was:

* InsecureEdgeTerminationPolicyAllow is the default termination
  policy.
* Cincinnati's docs have no preference [2].

However, we really, really want HTTPS security for cluster-version
operators making upstream requests for update recommendations.  There
are long-term plans for tightening down guards against malicious,
compromised, or man-in-the-middled update recommendation services, but
today we have yet to land even guards as basic as "upstream is lying
about the version string associated with a given release image" [3].

By removing HTTP termination [4], we force consumers to configure
their clients, including the cluster-version operator, with https://
URIs (or do something else explicit like setting up their own HTTP
termination) before they can access the policy-engine output, which
reduces the risk that they will recieve and trust compromised update
graphs.  This may be a breaking change, but:

* We're still in beta, and not yet in general-availability with
  backwards-compatability requirements.
* Folks who have configured their cluster-version operators and other
  clients with http:// upstreams should *want* to be broken.  We are
  protecting them from all sorts of compromised-upstream failure
  modes.
* The cluster-version operator, and other well-behaved clients, will
  report understandable error messages for "I tried to connect over
  HTTP and there was nobody there", which will lead users into
  auditing and fixing their upstream URIs, so recovering from the
  breakage should not be to onerous.

[1]: https://github.com/openshift/cincinnati-operator/pull/30#discussion_r418741486
[2]: https://github.com/openshift/cincinnati/blame/0bb5f6f3228858f9e5d1807bd6f45f46e537cdea/docs/user/running-cincinnati.md#L87-L88
[3]: https://github.com/openshift/cluster-version-operator/pull/431
[4]: https://github.com/openshift/api/blob/346618ed7d5e6396191efe6f10b2c36f1e95d8b7/route/v1/types.go#L258-L259
---
 docs/disconnected-cincinnati-operator.md | 6 +++---
 pkg/controller/cincinnati/new.go         | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/disconnected-cincinnati-operator.md b/docs/disconnected-cincinnati-operator.md
index 98492b29..a89323be 100644
--- a/docs/disconnected-cincinnati-operator.md
+++ b/docs/disconnected-cincinnati-operator.md
@@ -237,7 +237,7 @@ You might want to review the documentation around disconnected registries to lea
 3. Check the cincinnati service
 
     ~~~sh
-    curl --header 'Accept:application/json' http://$(oc -n "${NAMESPACE}" get route example-name-policy-engine-route -o jsonpath='{.spec.host}')/api/upgrades_info/v1/graph\?channel=stable-4.5 | jq
+    curl --header 'Accept:application/json' https://$(oc -n "${NAMESPACE}" get route example-name-policy-engine-route -o jsonpath='{.spec.host}')/api/upgrades_info/v1/graph\?channel=stable-4.5 | jq
     ~~~
 
     > **OUTPUT**
@@ -281,7 +281,7 @@ You might want to review the documentation around disconnected registries to lea
 5. Patch the ClusterVersion to use our Cincinnati instance rather than the public one
 
     ~~~sh
-    CINCINNATI_ROUTE=$(oc -n "${NAMESPACE}" get route example-name-policy-engine-route -o jsonpath=http://'{.spec.host}'/api/upgrades_info/v1/graph)
+    CINCINNATI_ROUTE=$(oc -n "${NAMESPACE}" get route example-name-policy-engine-route -o jsonpath=https://'{.spec.host}'/api/upgrades_info/v1/graph)
     PATCH="{\"spec\":{\"upstream\":\"${CINCINNATI_ROUTE}\"}}"
     oc patch clusterversion version -p $PATCH --type merge
     ~~~
@@ -313,7 +313,7 @@ You can print the graph for a specific channel in your Cincinnati instance using
 sudo dnf install -y graphviz
 curl -O https://raw.githubusercontent.com/openshift/cincinnati/master/hack/graph.sh
 chmod +x graph.sh
-curl --header 'Accept:application/json' "http://example-name-policy-engine-${NAMESPACE}.apps.mgmt-hub.e2e.bos.redhat.com/api/upgrades_info/v1/graph?channel=stable-4.5" | ./graph.sh | dot -Tpng > graph.png
+curl --header 'Accept:application/json' "https://example-name-policy-engine-${NAMESPACE}.apps.mgmt-hub.e2e.bos.redhat.com/api/upgrades_info/v1/graph?channel=stable-4.5" | ./graph.sh | dot -Tpng > graph.png
 ~~~
 
 ## Mirror the release images
diff --git a/pkg/controller/cincinnati/new.go b/pkg/controller/cincinnati/new.go
index 93542257..d9814de2 100644
--- a/pkg/controller/cincinnati/new.go
+++ b/pkg/controller/cincinnati/new.go
@@ -227,7 +227,7 @@ func (k *kubeResources) newPolicyEngineRoute(instance *cv1beta1.Cincinnati) *rou
 			},
 			TLS: &routev1.TLSConfig{
 				Termination:                   routev1.TLSTerminationEdge,
-				InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyAllow,
+				InsecureEdgeTerminationPolicy: routev1.InsecureEdgeTerminationPolicyNone,
 			},
 		},
 	}