From 3e2b3caa099632c82d61ecf8f59ff07a9a5abf6a Mon Sep 17 00:00:00 2001
From: Ayoub Mrini <ayoubmrini424@gmail.com>
Date: Thu, 9 Jul 2026 14:00:47 +0200
Subject: [PATCH] Ensure Platform Prometheus scrape configs do not skip TLS CA
 verification

---
 test/extended/prometheus/prometheus.go | 36 ++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/test/extended/prometheus/prometheus.go b/test/extended/prometheus/prometheus.go
index 19a6ba5b8837..6c05b8ce0922 100644
--- a/test/extended/prometheus/prometheus.go
+++ b/test/extended/prometheus/prometheus.go
@@ -214,6 +214,42 @@ var _ = g.Describe("[sig-instrumentation][Late] Platform Prometheus targets", fu
 		o.Expect(errs).To(o.BeEmpty())
 	})
 
+	g.It("should not skip TLS CA verification", func() {
+		g.By("fetching the Prometheus scrape configuration")
+		contents, err := helper.GetURLWithToken(helper.MustJoinUrlPath(prometheusURL, "api/v1/status/config"), bearerToken)
+		o.Expect(err).NotTo(o.HaveOccurred())
+
+		var configResp struct {
+			Data struct {
+				YAML string `json:"yaml"`
+			} `json:"data"`
+		}
+		err = json.Unmarshal([]byte(contents), &configResp)
+		o.Expect(err).NotTo(o.HaveOccurred())
+
+		var promConfig struct {
+			ScrapeConfigs []struct {
+				JobName   string `json:"job_name"`
+				TLSConfig *struct {
+					InsecureSkipVerify bool `json:"insecure_skip_verify"`
+				} `json:"tls_config"`
+			} `json:"scrape_configs"`
+		}
+		err = yaml.Unmarshal([]byte(configResp.Data.YAML), &promConfig)
+		o.Expect(err).NotTo(o.HaveOccurred())
+		// sanity check.
+		o.Expect(len(promConfig.ScrapeConfigs)).To(o.BeNumerically(">=", 5), fmt.Sprintf("only got %d scrape configs, something is wrong", len(promConfig.ScrapeConfigs)))
+
+		g.By("checking that no scrape config has insecure_skip_verify set to true")
+		var errs []error
+		for _, sc := range promConfig.ScrapeConfigs {
+			if sc.TLSConfig != nil && sc.TLSConfig.InsecureSkipVerify {
+				errs = append(errs, fmt.Errorf("scrape config %q has insecure_skip_verify set to true", sc.JobName))
+			}
+		}
+		o.Expect(errs).To(o.BeEmpty())
+	})
+
 })
 
 var _ = g.Describe("[sig-instrumentation][Late] OpenShift alerting rules [apigroup:image.openshift.io]", func() {