Repository: kubernetes-sigs/external-dns (language: go)

Issue:
provider/bluecat: allow toggling TLS verification
<!-- Please only use this template for submitting enhancement requests. This can be something like a new provider or a new gateway.  -->

**What would you like to be added**:
I'd like to be able enable/disable TLS verification to the BlueCat Gateway API. Currently it is hard coded to disable TLS verification.

**Why is this needed**:
Because security matters.



Discussion / hints:
/cc @vinny-sabatini 

FYI ... @seegeekrow @sanbornick

Fix patch:
diff --git a/provider/bluecat/bluecat.go b/provider/bluecat/bluecat.go
index 2205dcc0c5..ed6860aec4 100644
--- a/provider/bluecat/bluecat.go
+++ b/provider/bluecat/bluecat.go
@@ -44,6 +44,7 @@ type bluecatConfig struct {
 	DNSConfiguration string `json:"dnsConfiguration"`
 	View             string `json:"dnsView"`
 	RootZone         string `json:"rootZone"`
+	SkipTLSVerify    bool   `json:"skipTLSVerify"`
 }
 
 // BluecatProvider implements the DNS provider for Bluecat DNS
@@ -83,6 +84,7 @@ type GatewayClientConfig struct {
 	DNSConfiguration string
 	View             string
 	RootZone         string
+	SkipTLSVerify    bool
 }
 
 // BluecatZone defines a zone to hold records
@@ -159,7 +161,7 @@ func NewBluecatProvider(configFile string, domainFilter endpoint.DomainFilter, z
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to get API token from Bluecat Gateway")
 	}
-	gatewayClient := NewGatewayClient(cookie, token, cfg.GatewayHost, cfg.DNSConfiguration, cfg.View, cfg.RootZone)
+	gatewayClient := NewGatewayClient(cookie, token, cfg.GatewayHost, cfg.DNSConfiguration, cfg.View, cfg.RootZone, cfg.SkipTLSVerify)
 
 	provider := &BluecatProvider{
 		domainFilter:     domainFilter,
@@ -174,7 +176,7 @@ func NewBluecatProvider(configFile string, domainFilter endpoint.DomainFilter, z
 }
 
 // NewGatewayClient creates and returns a new Bluecat gateway client
-func NewGatewayClient(cookie http.Cookie, token, gatewayHost, dnsConfiguration, view, rootZone string) GatewayClientConfig {
+func NewGatewayClient(cookie http.Cookie, token, gatewayHost, dnsConfiguration, view, rootZone string, skipTLSVerify bool) GatewayClientConfig {
 	// Right now the Bluecat gateway doesn't seem to have a way to get the root zone from the API. If the user
 	// doesn't provide one via the config file we'll assume it's 'com'
 	if rootZone == "" {
@@ -187,6 +189,7 @@ func NewGatewayClient(cookie http.Cookie, token, gatewayHost, dnsConfiguration,
 		DNSConfiguration: dnsConfiguration,
 		View:             view,
 		RootZone:         rootZone,
+		SkipTLSVerify:    skipTLSVerify,
 	}
 }
 
@@ -525,7 +528,7 @@ func getBluecatGatewayToken(cfg bluecatConfig) (string, http.Cookie, error) {
 
 	c := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // ignore self-signed SSL cert check
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: cfg.SkipTLSVerify},
 		}}
 
 	resp, err := c.Post(cfg.GatewayHost+"/rest_login", "application/json", bytes.NewBuffer(body))
@@ -559,7 +562,7 @@ func getBluecatGatewayToken(cfg bluecatConfig) (string, http.Cookie, error) {
 
 func (c GatewayClientConfig) getBluecatZones(zoneName string) ([]BluecatZone, error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -597,7 +600,7 @@ func (c GatewayClientConfig) getBluecatZones(zoneName string) ([]BluecatZone, er
 
 func (c GatewayClientConfig) getHostRecords(zone string, records *[]BluecatHostRecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -629,7 +632,7 @@ func (c GatewayClientConfig) getHostRecords(zone string, records *[]BluecatHostR
 
 func (c GatewayClientConfig) getCNAMERecords(zone string, records *[]BluecatCNAMERecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -661,7 +664,7 @@ func (c GatewayClientConfig) getCNAMERecords(zone string, records *[]BluecatCNAM
 
 func (c GatewayClientConfig) getTXTRecords(zone string, records *[]BluecatTXTRecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -695,7 +698,7 @@ func (c GatewayClientConfig) getTXTRecords(zone string, records *[]BluecatTXTRec
 
 func (c GatewayClientConfig) getHostRecord(name string, record *BluecatHostRecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -723,7 +726,7 @@ func (c GatewayClientConfig) getHostRecord(name string, record *BluecatHostRecor
 
 func (c GatewayClientConfig) getCNAMERecord(name string, record *BluecatCNAMERecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -751,7 +754,7 @@ func (c GatewayClientConfig) getCNAMERecord(name string, record *BluecatCNAMERec
 
 func (c GatewayClientConfig) getTXTRecord(name string, record *BluecatTXTRecord) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -780,7 +783,7 @@ func (c GatewayClientConfig) getTXTRecord(name string, record *BluecatTXTRecord)
 
 func (c GatewayClientConfig) createHostRecord(zone string, req *bluecatCreateHostRecordRequest) (res interface{}, err error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -804,7 +807,7 @@ func (c GatewayClientConfig) createHostRecord(zone string, req *bluecatCreateHos
 
 func (c GatewayClientConfig) createCNAMERecord(zone string, req *bluecatCreateCNAMERecordRequest) (res interface{}, err error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -830,7 +833,7 @@ func (c GatewayClientConfig) createCNAMERecord(zone string, req *bluecatCreateCN
 
 func (c GatewayClientConfig) createTXTRecord(zone string, req *bluecatCreateTXTRecordRequest) (interface{}, error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -855,7 +858,7 @@ func (c GatewayClientConfig) createTXTRecord(zone string, req *bluecatCreateTXTR
 
 func (c GatewayClientConfig) deleteHostRecord(name string) (err error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -879,7 +882,7 @@ func (c GatewayClientConfig) deleteHostRecord(name string) (err error) {
 
 func (c GatewayClientConfig) deleteCNAMERecord(name string) (err error) {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,
@@ -903,7 +906,7 @@ func (c GatewayClientConfig) deleteCNAMERecord(name string) (err error) {
 
 func (c GatewayClientConfig) deleteTXTRecord(name string) error {
 	transportCfg := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //ignore self-signed SSL cert check
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: c.SkipTLSVerify},
 	}
 	client := &http.Client{
 		Transport: transportCfg,


Test patch: