diff --git a/pkg/webhooks/webhooks.go b/pkg/webhooks/webhooks.go index e5f766a0f4..00c50bf0cf 100644 --- a/pkg/webhooks/webhooks.go +++ b/pkg/webhooks/webhooks.go @@ -16,6 +16,7 @@ package webhooks import ( "context" + "crypto/tls" "errors" "fmt" "io" @@ -185,10 +186,16 @@ func Start(ctx context.Context, cfg *rest.Config, ctors ...knativeinjection.Cont } func HealthProbe(ctx context.Context) healthz.Checker { + // Create new transport that doesn't validate the TLS certificate + // This transport is just polling so validating the server certificate isn't necessary + transport := http.DefaultTransport.(*http.Transport).Clone() + transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // nolint:gosec + client := &http.Client{Transport: transport} + // TODO: Add knative health check port for webhooks when health port can be configured // Issue: https://github.com/knative/pkg/issues/2765 return func(req *http.Request) (err error) { - res, err := http.Get(fmt.Sprintf("http://localhost:%d", options.FromContext(ctx).WebhookPort)) + res, err := client.Get(fmt.Sprintf("https://localhost:%d", options.FromContext(ctx).WebhookPort)) // If the webhook connection errors out, liveness/readiness should fail if err != nil { return err