Repository: kubernetes/kubernetes
File: staging/src/k8s.io/kube-aggregator/pkg/controllers/status/remote/remote_available_controller.go (Go)

Code before:
		} else if len(endpointSlices) == 0 {
			availableCondition.Status = apiregistrationv1.ConditionFalse
			availableCondition.Reason = "EndpointsNotFound"
			availableCondition.Message = fmt.Sprintf("cannot find endpointslices for service/%s in %q", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		}
		hasActiveEndpoints := hasAvailableEndpoint(portName, endpointSlices...)
		if !hasActiveEndpoints {
			availableCondition.Status = apiregistrationv1.ConditionFalse
			availableCondition.Reason = "MissingEndpoints"
			availableCondition.Message = fmt.Sprintf("endpointslices for service/%s in %q have no addresses with port name %q", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace, portName)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		}
	}
	// actually try to hit the discovery endpoint when it isn't local and when we're routing as a service.
	if apiService.Spec.Service != nil && c.serviceResolver != nil {
		// if a particular transport was specified, use that otherwise build one
		// construct an http client that will ignore TLS verification (if someone owns the network and messes with your status
		// that's not so bad) and sets a very short timeout.  This is a best effort GET that provides no additional information
		transportConfig := &transport.Config{
			TLS: transport.TLSConfig{
				Insecure:   apiService.Spec.InsecureSkipTLSVerify || len(apiService.Spec.CABundle) == 0,
				CAData:     apiService.Spec.CABundle,
				ServerName: apiService.Spec.Service.Name + "." + apiService.Spec.Service.Namespace + ".svc",
			},
			DialHolder: c.proxyTransportDial,
		}

		if c.proxyCurrentCertKeyContent != nil {
			proxyClientCert, proxyClientKey := c.proxyCurrentCertKeyContent()

			transportConfig.TLS.CertData = proxyClientCert
			transportConfig.TLS.KeyData = proxyClientKey
		}
		restTransport, err := transport.New(transportConfig)
		if err != nil {
			return err
		}
		discoveryClient := &http.Client{
			Transport: restTransport,
			// the request should happen quickly.
			Timeout: 5 * time.Second,
			CheckRedirect: func(req *http.Request, via []*http.Request) error {
				return http.ErrUseLastResponse
			},
		}


Review comment (suggestion):
Dislike having this as insecure but it already was.
As far as I can tell; it is not less secure after the change. 

Code after:
			}
		}
		if !foundPort {
			availableCondition.Status = apiregistrationv1.ConditionFalse
			availableCondition.Reason = "ServicePortError"
			availableCondition.Message = fmt.Sprintf("service/%s in %q is not listening on port %d", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace, *apiService.Spec.Service.Port)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		}

		endpointSlices, err := c.endpointSliceGetter.GetEndpointSlices(apiService.Spec.Service.Namespace, apiService.Spec.Service.Name)
		if err != nil {
			availableCondition.Status = apiregistrationv1.ConditionUnknown
			availableCondition.Reason = "EndpointsAccessError"
			availableCondition.Message = fmt.Sprintf("service/%s in %q cannot be checked due to: %v", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace, err)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		} else if len(endpointSlices) == 0 {
			availableCondition.Status = apiregistrationv1.ConditionFalse
			availableCondition.Reason = "EndpointsNotFound"
			availableCondition.Message = fmt.Sprintf("cannot find endpointslices for service/%s in %q", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		}
		hasActiveEndpoints := hasAvailableEndpoint(portName, endpointSlices...)
		if !hasActiveEndpoints {
			availableCondition.Status = apiregistrationv1.ConditionFalse
			availableCondition.Reason = "MissingEndpoints"
			availableCondition.Message = fmt.Sprintf("endpointslices for service/%s in %q have no addresses with port name %q", apiService.Spec.Service.Name, apiService.Spec.Service.Namespace, portName)
			apiregistrationv1apihelper.SetAPIServiceCondition(apiService, availableCondition)
			_, err := c.updateAPIServiceStatus(originalAPIService, apiService)
			return err
		}
	}
	// actually try to hit the discovery endpoint when it isn't local and when we're routing as a service.
	if apiService.Spec.Service != nil && c.serviceResolver != nil {
		// if a particular transport was specified, use that otherwise build one
		var proxyClientCert, proxyClientKey []byte
		if c.proxyCurrentCertKeyContent != nil {
			proxyClientCert, proxyClientKey = c.proxyCurrentCertKeyContent()
		}

		transportConfig := BuildTransportConfig(c.proxyTransportDial, proxyClientCert, proxyClientKey, apiService)
		restTransport, err := transport.New(transportConfig)
		if err != nil {
			return err
		}
		discoveryClient := &http.Client{