pub fn validate_backend_tls(tls: &TlsConfig, context: &str) -> ValidationResultExpand description
A backend’s tls block is internally consistent — every rule the structural
schema can’t express. A caBundleRef must actually name a ConfigMap
(configMapName was Option for API growth, so an empty caBundleRef: {}
parses fine but would be a silently dead reference), the name must be a
valid object name (or every mover run fails at ConfigMap resolution with a
far less actionable message), an explicitly-set key must not be blank
(blank would shadow the ca.crt default and never match a real key), and
pairing caBundleRef with disableTls: true is a contradiction: with
kopia’s --disable-tls there is no TLS handshake at all, so the CA could
never be consulted. context names the backend (e.g. "s3 backend") for
the message.
Deliberately NOT here: caBundleRef + insecureSkipVerify: true is an
admission warning (super::S3_TLS_SKIP_VERIFY_WARNING), never an error
— see that constant’s doc for why upgrades forbid hardening it.