Skip to content

feat: add --skip-ssl-verify and --override-base-url global flags (#675)#724

Open
saiflayouni wants to merge 1 commit into
apigee:mainfrom
saiflayouni:fix/ssl-tls-override
Open

feat: add --skip-ssl-verify and --override-base-url global flags (#675)#724
saiflayouni wants to merge 1 commit into
apigee:mainfrom
saiflayouni:fix/ssl-tls-override

Conversation

@saiflayouni

Copy link
Copy Markdown

Summary

  • Adds two new persistent (global) flags and matching environment variables:
    • --skip-ssl-verify / APIGEECLI_SKIP_SSL_VERIFY=true — disables TLS certificate verification (useful behind a corporate MITM proxy; not recommended for production)
    • --override-base-url <url> / APIGEECLI_OVERRIDE_BASE_URL=<url> — replaces the computed Apigee control-plane base URL entirely (useful for local emulators or testing)
  • Adds SkipSSLVerify and OverrideBaseURL fields to ApigeeClientOptions
  • GetApigeeBaseURL() checks the override before computing the region/API-specific URL
  • GetHttpClient() creates an http.Transport with tls.Config.InsecureSkipVerify so both proxy and non-proxy paths respect the flag

Test plan

  • apigeecli --skip-ssl-verify orgs get -o <org> connects without verifying the server cert
  • APIGEECLI_OVERRIDE_BASE_URL=http://localhost:8080/v1/organizations/ apigeecli orgs get -o test hits the local server
  • Normal (no flags) operation is unchanged — TLS verification is on by default

Closes #675

🤖 Generated with Claude Code

@google-cla

google-cla Bot commented Jun 30, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

…gee#675)

Some users run apigeecli behind a corporate MITM proxy or against a local
Apigee emulator. Two new persistent flags (and matching env vars) make this
possible without patching the binary:

- `--skip-ssl-verify` / `APIGEECLI_SKIP_SSL_VERIFY=true`
  Disables TLS certificate verification. Not recommended for production.
- `--override-base-url <url>` / `APIGEECLI_OVERRIDE_BASE_URL=<url>`
  Replaces the computed Apigee base URL entirely.

Implementation:
- `ApigeeClientOptions` gains `SkipSSLVerify bool` and `OverrideBaseURL string`
- `GetApigeeBaseURL()` checks the override first
- `GetHttpClient()` creates an `http.Transport` with `tls.Config.InsecureSkipVerify`
  so both the proxy and non-proxy code paths respect the flag
@saiflayouni
saiflayouni force-pushed the fix/ssl-tls-override branch from d8f55e4 to 1838f04 Compare July 1, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FR] Allow disabling SSL verification, and changing the server endpoint and port

1 participant