ECOPROJECT-5195 | fix: add TLS verification for vCenter connections

[nirarg]

Addresses security vulnerability (CVSS 7.4) where all vCenter TLS connections were using InsecureSkipVerify, making them vulnerable to MITM attacks.

Changes:

• Add TLSCACert, TLSThumbprint, and TLSInsecure fields to Credentials struct
• Create internal/tlsconfig package for TLS validation and configuration
• Update all vSphere client calls to use TLS config instead of hardcoded insecure mode
• Remove vulnerable getVCenterThumbprint() that used unverified TOFU connection
• Add comprehensive unit tests for TLS configuration

Backward compatibility:

• Existing code without TLS config defaults to insecure mode with LOUD deprecation warnings
• TLS verification will be required in v1.0.0
• Users can opt-in to secure mode via TLSCACert or TLSThumbprint
• Explicit TLSInsecure flag available for testing environments

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: f89074c7-7c3c-4257-b72f-bf8c5ea9bac2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}