Summary

Add an insecure field to the Kubernetes provider's KubernetesServer configuration that allows skipping TLS certificate verification when connecting to Kubernetes API servers.

Closes #5904

Changes

• API Types (v1 & v1beta1): Added Insecure bool field to KubernetesServer struct
• Provider Auth: Updated auth.go to use c.store.Server.Insecure instead of hardcoded false
• Validation: Modified validate.go to allow insecure: true without requiring CA
• Tests: Added test case for insecure mode validation
• Documentation: Added usage examples with security warnings

Use Case

When accessing Kubernetes clusters through API proxies like Tailscale's Kubernetes API server proxy, the proxy terminates TLS and presents its own certificate (typically Let's Encrypt for *.ts.net domains). These certificates are trusted by system CA roots, but external-secrets currently requires an explicit caBundle or caProvider.

This creates friction because other K8s tools (kubectl, Headlamp, etc.) work seamlessly since Go's client-go uses system CA roots by default.

Usage

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
spec:
  provider:
    kubernetes:
      server:
        url: "https://my-cluster-proxy.example.com"
        insecure: true  # Skips TLS verification
      auth:
        serviceAccount:
          name: "my-sa"

Security Notice

The documentation clearly warns that:

• This disables TLS certificate verification
• This is NOT recommended for production use
• Users should prefer proper CA certificates when possible

This follows the pattern of --insecure-skip-tls-verify in kubectl and other tools.

Testing

=== RUN   TestValidateStore/insecure_mode_without_ca_is_valid
--- PASS: TestValidateStore/insecure_mode_without_ca_is_valid (0.00s)

All existing tests continue to pass.

Adds support for skipping TLS certificate verification when connecting to Kubernetes API servers via a new Insecure field on the KubernetesServer struct.

Changes

• API types: Add Insecure bool to KubernetesServer in both apis/externalsecrets/v1 and v1beta1.
• Auth logic (providers/v1/kubernetes/auth.go): Only fetch CA data when Server.Insecure is false; TLSClientConfig.Insecure now reflects the server's Insecure setting instead of being hard-coded false.
• Validation (providers/v1/kubernetes/validate.go): Allow Insecure: true without requiring caBundle or caProvider; updated error message to reference the new option.
• Tests (providers/v1/kubernetes/validate_test.go): Add test insecure mode without ca is valid; existing tests continue to pass.
• Docs (docs/provider/kubernetes.md): Add "Insecure TLS (Skip Certificate Verification)" section with usage example and explicit security warnings.

Use case: Reduces friction for connections via API proxies or setups where system CA roots already trust the proxy cert (aligns behavior with kubectl).

Security note: Disabling TLS verification is unsafe for production; prefer supplying proper CA certificates where possible.

Closes #5904.