Inject insecure mode instead of relying on global variable (#63825)

Part 1 or removing InsecureDevMode - enterprise still relies on it
so a few TODOs were left around for clean up later. This global is
mostly leveraged in tests to permit trust when self-signed certificates
are used. These tests are often spinning up multiple teleport instances
and most of the time exercise trusted clusters which makes them slow.
Due to the global nature of InsecureDevMode these tests cannot be
run in parallel.

e2e/aws/fixtures_test.go

@@ -202,6 +202,7 @@ func newTeleportConfig() *servicecfg.Config {
 	tconf.PollingPeriod = 500 * time.Millisecond
 	tconf.Testing.ClientTimeout = time.Second
 	tconf.Testing.ShutdownTimeout = 2 * tconf.Testing.ClientTimeout
+	tconf.InsecureMode = true
 	return tconf
 }
 

e2e/aws/main_test.go

@@ -22,7 +22,6 @@ import (
 	"testing"
 
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
 
@@ -142,7 +141,5 @@ const (
 // it as an argument. Otherwise, it will run tests as normal.
 func TestMain(m *testing.M) {
 	logtest.InitLogger(testing.Verbose)
-	// agents connect over a reverse tunnel to proxy, so we use insecure mode.
-	lib.SetInsecureDevMode(true)
 	helpers.TestMainImplementation(m)
 }

integration/appaccess/fixtures.go

@@ -37,7 +37,6 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/breaker"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
@@ -68,10 +67,6 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
 
 	log := logtest.NewLogger()
 
-	// Insecure development mode needs to be set because the web proxy uses a
-	// self-signed certificate during tests.
-	lib.SetInsecureDevMode(true)
-
 	p := &Pack{
 		rootAppName:        "app-01",
 		rootAppPublicAddr:  "app-01.example.com",
@@ -347,6 +342,9 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
 	p.leafCluster = helpers.NewInstance(t, leafCfg)
 
 	rcConf := servicecfg.MakeDefaultConfig()
+	// Insecure development mode needs to be set because the web proxy uses a
+	// self-signed certificate during tests.
+	rcConf.InsecureMode = true
 	rcConf.Logger = log
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
@@ -364,6 +362,9 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
 	rcConf.Clock = opts.Clock
 
 	lcConf := servicecfg.MakeDefaultConfig()
+	// Insecure development mode needs to be set because the web proxy uses a
+	// self-signed certificate during tests.
+	lcConf.InsecureMode = true
 	lcConf.Logger = log
 	lcConf.DataDir = t.TempDir()
 	lcConf.Auth.Enabled = true

integration/appaccess/pack.go

@@ -772,6 +772,7 @@ func (p *Pack) startRootAppServers(t *testing.T, count int, opts AppTestOptions)
 		raConf.Apps.MCPDemoServer = true
 		raConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 		raConf.Apps.MonitorCloseChannel = opts.MonitorCloseChannel
+		raConf.InsecureMode = true
 		raConf.Apps.Apps = append([]servicecfg.App{
 			{
 				Name:       p.rootAppName,
@@ -941,6 +942,7 @@ func (p *Pack) startLeafAppServers(t *testing.T, count int, opts AppTestOptions)
 		laConf.Apps.Enabled = true
 		laConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 		laConf.Apps.MonitorCloseChannel = opts.MonitorCloseChannel
+		laConf.InsecureMode = true
 		laConf.Apps.Apps = append([]servicecfg.App{
 			{
 				Name:       p.leafAppName,

integration/db/fixture.go

@@ -36,7 +36,6 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
@@ -130,6 +129,7 @@ func (pack *databaseClusterPack) StartDatabaseServices(t *testing.T, clock clock
 	conf := servicecfg.MakeDefaultConfig()
 	conf.DataDir = filepath.Join(t.TempDir(), pack.name)
 	conf.SetToken("static-token-value")
+	conf.InsecureMode = true
 
 	conf.SetAuthServerAddress(utils.NetAddr{
 		AddrNetwork: "tcp",
@@ -256,7 +256,6 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 	// Some global setup.
 	tracer := utils.NewTracer(utils.ThisFunction()).Start()
 	t.Cleanup(func() { tracer.Stop() })
-	lib.SetInsecureDevMode(true)
 	log := logtest.NewLogger()
 
 	// Generate keypair.
@@ -297,6 +296,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 
 	// Make root cluster config.
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Auth.Clock = p.clock
@@ -304,6 +304,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 	rcConf.Proxy.Enabled = true
 	rcConf.Proxy.DisableWebInterface = true
 	rcConf.Clock = p.clock
+	rcConf.InsecureMode = true
 	rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	if opts.rootConfig != nil {
 		opts.rootConfig(rcConf)
@@ -312,12 +313,14 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 	// Make leaf cluster config.
 	lcConf := servicecfg.MakeDefaultConfig()
 	lcConf.DataDir = t.TempDir()
+	lcConf.InsecureMode = true
 	lcConf.Auth.Enabled = true
 	lcConf.Auth.Clock = p.clock
 	lcConf.Auth.Preference.SetSecondFactor("off")
 	lcConf.Proxy.Enabled = true
 	lcConf.Proxy.DisableWebInterface = true
 	lcConf.Clock = p.clock
+	lcConf.InsecureMode = true
 	lcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	if opts.leafConfig != nil {
 		opts.leafConfig(lcConf)
@@ -456,6 +459,7 @@ func (p *DatabasePack) startRootDatabaseAgent(t *testing.T, params databaseAgent
 	conf.Databases.Databases = params.databases
 	conf.Databases.ResourceMatchers = params.resourceMatchers
 	conf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	conf.InsecureMode = true
 
 	server, authClient, hostUUID, err := p.Root.Cluster.StartDatabase(conf)
 	require.NoError(t, err)

integration/ec2_test.go

@@ -41,7 +41,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/clientutils"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	cloudimds "github.com/gravitational/teleport/lib/cloud/imds"
@@ -280,10 +279,6 @@ func TestIAMNodeJoin(t *testing.T) {
 		require.NoError(t, err)
 		require.NotEmpty(t, proxies)
 	}, 10*time.Second, 50*time.Millisecond, "waiting for proxy to join cluster")
-	// InsecureDevMode needed for node to trust proxy
-	wasInsecureDevMode := lib.IsInsecureDevMode()
-	t.Cleanup(func() { lib.SetInsecureDevMode(wasInsecureDevMode) })
-	lib.SetInsecureDevMode(true)
 
 	// sanity check there are no nodes to start with
 	nodes, err := authServer.GetNodes(ctx, apidefaults.Namespace)
@@ -294,6 +289,7 @@ func TestIAMNodeJoin(t *testing.T) {
 	// connecting to the proxy
 	nodeConfig := newNodeConfig(t, tokenName, types.JoinMethodIAM)
 	nodeConfig.ProxyServer = proxyConfig.Proxy.WebAddr
+	nodeConfig.InsecureMode = true
 	nodeSvc, err := service.NewTeleport(nodeConfig)
 	require.NoError(t, err)
 	require.NoError(t, nodeSvc.Start())

integration/helpers/helpers.go

@@ -48,7 +48,6 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/backend"
@@ -457,11 +456,10 @@ func MakeTestServers(t *testing.T) (auth *service.TeleportProcess, proxy *servic
 // MakeTestDatabaseServer creates a Database Service
 // It receives the Proxy Address, a Token (to join the cluster) and a list of Datbases
 func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string, resMatchers []services.ResourceMatcher, dbs ...servicecfg.Database) (db *service.TeleportProcess) {
-	// Proxy uses self-signed certificates in tests.
-	lib.SetInsecureDevMode(true)
-
 	cfg := servicecfg.MakeDefaultConfig()
 	cfg.DebugService.Enabled = false
+	// Proxy uses self-signed certificates in tests.
+	cfg.InsecureMode = true
 	cfg.Hostname = "localhost"
 	cfg.DataDir = t.TempDir()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
@@ -495,8 +493,7 @@ func MakeTestDatabaseServer(t *testing.T, proxyAddr utils.NetAddr, token string,
 // It receives the Proxy Address, a Token (to join the cluster).
 func MakeAgentServer(t *testing.T, cfg *servicecfg.Config, proxyAddr utils.NetAddr, token string) *service.TeleportProcess {
 	// Proxy uses self-signed certificates in tests.
-	lib.SetInsecureDevMode(true)
-
+	cfg.InsecureMode = true
 	cfg.Hostname = "localhost"
 	cfg.DataDir = t.TempDir()
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()

integration/helpers/instance.go

@@ -902,6 +902,7 @@ func (i *TeleInstance) StartApps(configs []*servicecfg.Config) ([]*service.Telep
 			cfg.Auth.Enabled = false
 			cfg.Proxy.Enabled = false
 			cfg.DebugService.Enabled = false
+			cfg.InsecureMode = true
 
 			// Create a new Teleport process and add it to the list of nodes that
 			// compose this "cluster".
@@ -1095,6 +1096,7 @@ func (i *TeleInstance) StartNodeAndProxy(t *testing.T, name string) (sshPort, we
 	}
 
 	tconf.Auth.Enabled = false
+	tconf.InsecureMode = true
 
 	tconf.Proxy.Enabled = true
 	tconf.Proxy.SSHAddr.Addr = NewListenerOn(t, i.Hostname, service.ListenerProxySSH, &tconf.FileDescriptors)

integration/integration_test.go

@@ -77,7 +77,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/prompt"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -717,6 +716,7 @@ func (s *integrationTestSuite) newTeleportIoT(t *testing.T, logins []string) *he
 	mainConfig := func() *servicecfg.Config {
 		tconf := s.defaultServiceConfig()
 		tconf.Auth.Enabled = true
+		tconf.InsecureMode = true
 
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
@@ -742,6 +742,7 @@ func (s *integrationTestSuite) newTeleportIoT(t *testing.T, logins []string) *he
 		tconf.Proxy.Enabled = false
 
 		tconf.SSH.Enabled = true
+		tconf.InsecureMode = true
 
 		return tconf
 	}
@@ -857,10 +858,6 @@ func testInteractiveReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
-	// InsecureDevMode needed for IoT node handshake
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	teleport := suite.newTeleportIoT(t, nil)
 	defer teleport.StopAll()
 
@@ -1190,10 +1187,6 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
-	// InsecureDevMode needed for IoT node handshake
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	failingListener, err := net.Listen("tcp", "localhost:0")
 	require.NoError(t, err)
 
@@ -1202,6 +1195,7 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 
 	// Create a Teleport instance with Auth/Proxy.
 	conf := suite.defaultServiceConfig()
+	conf.InsecureMode = true
 	conf.Auth.Enabled = true
 	conf.Proxy.Enabled = true
 	conf.Proxy.DisableWebService = false
@@ -1230,6 +1224,7 @@ func testCustomReverseTunnel(t *testing.T, suite *integrationTestSuite) {
 	nodeConf.Auth.Enabled = false
 	nodeConf.Proxy.Enabled = false
 	nodeConf.SSH.Enabled = true
+	nodeConf.InsecureMode = true
 	t.Setenv(defaults.TunnelPublicAddrEnvar, main.Web)
 
 	// verify the node is able to join the cluster
@@ -1403,6 +1398,7 @@ func testIPPropagation(t *testing.T, suite *integrationTestSuite) {
 			conf.Proxy.Enabled = false
 			conf.Apps.Enabled = false
 			conf.Databases.Enabled = false
+			conf.InsecureMode = true
 
 			process, err := service.NewTeleport(conf)
 			require.NoError(t, err)
@@ -2648,10 +2644,9 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 		tconf.SSH.Enabled = enableSSH
 		tconf.Proxy.DisableWebService = false
+		tconf.InsecureMode = true
 		return t, nil, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateEx(makeConfig(false)))
 	require.NoError(t, aux.CreateEx(makeConfig(true)))
@@ -2973,12 +2968,10 @@ func createAndUpdateTrustedClusters(t *testing.T, suite *integrationTestSuite, t
 		tconf.SSH.Enabled = enableSSH
 		tconf, err := instance.GenerateConfig(t, nil, tconf)
 		require.NoError(t, err)
-
+		tconf.InsecureMode = true
 		tconf.CachePolicy.Enabled = false
 		return t, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateWithConf(makeConfig(main, false)))
 	require.NoError(t, aux.CreateWithConf(makeConfig(aux, true)))
@@ -3097,10 +3090,9 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
 		tconf.SSH.Enabled = enableSSH
+		tconf.InsecureMode = true
 		return t, nil, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateEx(makeConfig(false)))
 	require.NoError(t, aux.CreateEx(makeConfig(true)))
@@ -3341,11 +3333,9 @@ func trustedDisabledCluster(t *testing.T, suite *integrationTestSuite, test trus
 		require.NoError(t, err)
 
 		tconf.CachePolicy.Enabled = false
-
+		tconf.InsecureMode = true
 		return t, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateWithConf(makeConfig(main, false)))
 	require.NoError(t, aux.CreateWithConf(makeConfig(aux, true)))
@@ -3477,12 +3467,10 @@ func trustedClustersRoleMapChanges(t *testing.T, suite *integrationTestSuite, te
 		tconf.SSH.Enabled = enableSSH
 		tconf, err := instance.GenerateConfig(t, nil, tconf)
 		require.NoError(t, err)
-
+		tconf.InsecureMode = true
 		tconf.CachePolicy.Enabled = false
 		return t, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateWithConf(makeConfig(main, false)))
 	require.NoError(t, aux.CreateWithConf(makeConfig(aux, true)))
@@ -3584,10 +3572,9 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 		tconf.Proxy.DisableWebService = false
 		tconf.SSH.Enabled = enableSSH
 		tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500
+		tconf.InsecureMode = true
 		return t, nil, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateEx(makeConfig(false)))
 	require.NoError(t, aux.CreateEx(makeConfig(true)))
@@ -3637,6 +3624,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 		tconf.Auth.Enabled = false
 		tconf.Proxy.Enabled = false
 		tconf.SSH.Enabled = true
+		tconf.InsecureMode = true
 		return tconf
 	}
 	_, err = aux.StartNode(nodeConfig())
@@ -3725,10 +3713,9 @@ func testTrustedClusterAgentless(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Proxy.DisableWebService = false
 		tconf.SSH.Enabled = enableSSH
+		tconf.InsecureMode = true
 		return t, nil, tconf
 	}
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	require.NoError(t, main.CreateEx(makeConfig(false)))
 	require.NoError(t, leaf.CreateEx(makeConfig(false)))
@@ -4121,9 +4108,6 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	t.Cleanup(func() { tr.Stop() })
 
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
-
 	// Create and start load balancer for proxies.
 	frontend := *utils.MustParseAddr(net.JoinHostPort(Loopback, "0"))
 	lb, err := utils.NewLoadBalancer(ctx, frontend)
@@ -4135,7 +4119,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 	// Create a Teleport instance with Auth/Proxy.
 	mainConfig := func() (*testing.T, []string, []*helpers.InstanceSecrets, *servicecfg.Config) {
 		tconf := suite.defaultServiceConfig()
-
+		tconf.InsecureMode = true
 		tconf.Auth.Enabled = true
 
 		tconf.Proxy.Enabled = true
@@ -4198,6 +4182,7 @@ func testReverseTunnelCollapse(t *testing.T, suite *integrationTestSuite) {
 		tconf.Auth.Enabled = false
 		tconf.Proxy.Enabled = false
 		tconf.SSH.Enabled = true
+		tconf.InsecureMode = true
 
 		return tconf
 	}
@@ -4273,9 +4258,6 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	// Create and start load balancer for proxies.
 	frontend := *utils.MustParseAddr(net.JoinHostPort(Loopback, "0"))
 	lb, err := utils.NewLoadBalancer(ctx, frontend)
@@ -4290,7 +4272,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 
 		tconf.Auth.Enabled = true
-
+		tconf.InsecureMode = true
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.TunnelPublicAddrs = []utils.NetAddr{
 			{
@@ -4329,6 +4311,7 @@ func testDiscoveryNode(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Hostname = "cluster-main-node"
 		tconf.SetToken("token")
+		tconf.InsecureMode = true
 		tconf.SetAuthServerAddress(utils.NetAddr{
 			AddrNetwork: "tcp",
 			Addr:        main.Web,
@@ -5536,6 +5519,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	clusterAux := "rotate-aux"
 
 	tconf := suite.rotationConfig(false)
+	tconf.InsecureMode = true
 	main := suite.newNamedTeleportInstance(t, clusterMain)
 	aux := suite.newNamedTeleportInstance(t, clusterAux)
 
@@ -5583,7 +5567,9 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// create auxiliary cluster and setup trust
-	require.NoError(t, aux.CreateEx(t, nil, suite.rotationConfig(false)))
+	auxConfig := suite.rotationConfig(false)
+	auxConfig.InsecureMode = true
+	require.NoError(t, aux.CreateEx(t, nil, auxConfig))
 
 	// auxiliary cluster has a role aux-devs
 	// connect aux cluster to main cluster
@@ -5608,10 +5594,6 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	})
 	require.NoError(t, aux.Start())
 
-	// try and upsert a trusted cluster
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	const skipNameValidation = false
 	helpers.TryUpsertTrustedCluster(t, aux.Process.GetAuthServer(), trustedCluster, skipNameValidation)
 	helpers.WaitForTunnelConnections(t, svc.GetAuthServer(), aux.Secrets.SiteName, 1)
@@ -6031,10 +6013,6 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) {
 	tr := utils.NewTracer(utils.ThisFunction()).Start()
 	defer tr.Stop()
 
-	// InsecureDevMode needed for IoT node handshake
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	// Create and start a Teleport cluster with auth, proxy, and node.
 	makeConfig := func() *servicecfg.Config {
 		recConfig, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
@@ -6043,6 +6021,7 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		tconf := suite.defaultServiceConfig()
+		tconf.InsecureMode = true
 		tconf.Hostname = "server-01"
 		tconf.Auth.Enabled = true
 		tconf.Auth.SessionRecordingConfig = recConfig
@@ -6068,6 +6047,7 @@ func testCmdLabels(t *testing.T, suite *integrationTestSuite) {
 			"role": "database",
 			"spam": "eggs",
 		}
+		tconf.InsecureMode = true
 
 		return tconf
 	}
@@ -7478,6 +7458,7 @@ func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraSe
 		tconf.Proxy.DisableWebService = false
 		tconf.SSH.Enabled = false
 		tconf.CachePolicy.MaxRetryPeriod = time.Millisecond * 500
+		tconf.InsecureMode = true
 
 		for _, opt := range cfgOpts {
 			opt(tconf, isRoot)
@@ -7486,10 +7467,6 @@ func createTrustedClusterPair(t *testing.T, suite *integrationTestSuite, extraSe
 		return t, nil, tconf
 	}
 
-	oldInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(oldInsecure)
-
 	require.NoError(t, root.CreateEx(makeConfig(true)))
 	require.NoError(t, leaf.CreateEx(makeConfig(false)))
 	_, err = leaf.Process.GetAuthServer().UpsertRole(ctx, role)
@@ -7564,12 +7541,10 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) {
 		multiplexer.PROXYProtocolOn, multiplexer.PROXYProtocolOff, multiplexer.PROXYProtocolUnspecified,
 	} {
 		t.Run(fmt.Sprintf("proxy protocol mode: %v", proxyProtocolMode), func(t *testing.T) {
-			lib.SetInsecureDevMode(true)
-			t.Cleanup(func() { lib.SetInsecureDevMode(false) })
-
 			// Create a Teleport instance with Auth/Proxy.
 			mainConfig := suite.defaultServiceConfig()
 			mainConfig.Auth.Enabled = true
+			mainConfig.InsecureMode = true
 
 			mainConfig.Proxy.Enabled = true
 			mainConfig.Proxy.DisableWebService = false
@@ -7596,6 +7571,7 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) {
 			nodeConfig := suite.defaultServiceConfig()
 			nodeConfig.Hostname = Host
 			nodeConfig.SetToken("token")
+			nodeConfig.InsecureMode = true
 
 			nodeConfig.Auth.Enabled = false
 			nodeConfig.Proxy.Enabled = false
@@ -7614,12 +7590,10 @@ func testJoinOverReverseTunnelOnly(t *testing.T, suite *integrationTestSuite) {
 
 	// Assert that gRPC-based join methods work over reverse tunnel.
 	t.Run("gRPC join service", func(t *testing.T) {
-		lib.SetInsecureDevMode(true)
-		defer lib.SetInsecureDevMode(false)
-
 		// Create a Teleport instance with Auth/Proxy.
 		mainConfig := suite.defaultServiceConfig()
 		mainConfig.Auth.Enabled = true
+		mainConfig.InsecureMode = true
 
 		mainConfig.Proxy.Enabled = true
 		mainConfig.Proxy.DisableWebService = false
@@ -9191,14 +9165,11 @@ func testNegotiatedALPNProtocols(t *testing.T, suite *integrationTestSuite) {
 }
 
 func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) {
-	// InsecureDevMode needed for IoT node handshake
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	// Create a Teleport instance with Auth/Proxy.
 	mainConfig := func() *servicecfg.Config {
 		tconf := suite.defaultServiceConfig()
 		tconf.Auth.Enabled = true
+		tconf.InsecureMode = true
 
 		tconf.Proxy.Enabled = true
 		tconf.Proxy.DisableWebService = false
@@ -9214,6 +9185,7 @@ func testForceListenerInTunnelMode(t *testing.T, suite *integrationTestSuite) {
 		tconf := suite.defaultServiceConfig()
 		tconf.Hostname = Host
 		tconf.SetToken("token")
+		tconf.InsecureMode = true
 
 		if tunnel {
 			tconf.SetAuthServerAddress(utils.NetAddr{

integration/kube_integration_test.go

@@ -74,7 +74,6 @@ import (
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/integration/kube"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/client"
@@ -811,13 +810,12 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 		Logger:      suite.log,
 	})
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
+	mainConf.InsecureMode = true
 	mainConf.Proxy.Kube.Enabled = true
 	err = main.CreateEx(t, nil, mainConf)
 	require.NoError(t, err)
 
+	auxConf.InsecureMode = true
 	err = aux.CreateEx(t, nil, auxConf)
 	require.NoError(t, err)
 
@@ -1084,9 +1082,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 		Logger:      suite.log,
 	})
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
+	mainConf.InsecureMode = true
 	// route all the traffic to the aux cluster
 	mainConf.Proxy.Kube.Enabled = true
 	// ClusterOverride forces connection to be routed
@@ -1095,6 +1091,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	err = main.CreateEx(t, nil, mainConf)
 	require.NoError(t, err)
 
+	auxConf.InsecureMode = true
 	err = aux.CreateEx(t, nil, auxConf)
 	require.NoError(t, err)
 

integration/proxy/proxy_helpers.go

@@ -51,7 +51,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/state"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -206,6 +205,7 @@ func (p *Suite) addNodeToLeafCluster(t *testing.T, tunnelNodeHostname string) {
 		tconf.Auth.Enabled = false
 		tconf.Proxy.Enabled = false
 		tconf.SSH.Enabled = true
+		tconf.InsecureMode = true
 		tconf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 		return tconf
 	}
@@ -329,6 +329,7 @@ func rootClusterStandardConfig(t *testing.T) func(suite *Suite) *servicecfg.Conf
 	return func(suite *Suite) *servicecfg.Config {
 		rc := suite.root
 		config := servicecfg.MakeDefaultConfig()
+		config.InsecureMode = true
 		config.DataDir = t.TempDir()
 		config.Auth.Enabled = true
 		config.Auth.Preference.SetSecondFactor("off")
@@ -349,6 +350,7 @@ func leafClusterStandardConfig(t *testing.T) func(suite *Suite) *servicecfg.Conf
 	return func(suite *Suite) *servicecfg.Config {
 		lc := suite.leaf
 		config := servicecfg.MakeDefaultConfig()
+		config.InsecureMode = true
 		config.DataDir = t.TempDir()
 		config.Auth.Enabled = true
 		config.Auth.Preference.SetSecondFactor("off")
@@ -661,7 +663,7 @@ func mustRegisterUsingIAMMethod(t *testing.T, proxyAddr utils.NetAddr, token str
 		},
 		ProxyServer: proxyAddr,
 		JoinMethod:  types.JoinMethodIAM,
-		Insecure:    lib.IsInsecureDevMode(),
+		Insecure:    true,
 	})
 	require.NoError(t, err, trace.DebugReport(err))
 }

integration/proxy/proxy_test.go

@@ -51,12 +51,10 @@ import (
 	dbhelpers "github.com/gravitational/teleport/integration/db"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/integration/kube"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/mfa"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -111,17 +109,16 @@ func TestALPNSNIProxyMultiCluster(t *testing.T) {
 
 	for _, tc := range testCase {
 		t.Run(tc.name, func(t *testing.T) {
-			lib.SetInsecureDevMode(true)
-			defer lib.SetInsecureDevMode(false)
-
 			username := helpers.MustGetCurrentUser(t).Username
 
 			suite := newSuite(t,
 				withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) {
 					config.Proxy.DisableALPNSNIListener = tc.disableALPNListenerOnRoot
+					config.InsecureMode = true
 				}),
 				withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) {
 					config.Proxy.DisableALPNSNIListener = tc.disableALPNListenerOnLeaf
+					config.InsecureMode = true
 				}),
 				withRootClusterListeners(tc.mainClusterPortSetup),
 				withLeafClusterListeners(tc.secondClusterPortSetup),
@@ -215,9 +212,6 @@ func TestALPNSNIProxyTrustedClusterNode(t *testing.T) {
 	}
 	for _, tc := range testCase {
 		t.Run(tc.name, func(t *testing.T) {
-			lib.SetInsecureDevMode(true)
-			defer lib.SetInsecureDevMode(false)
-
 			username := helpers.MustGetCurrentUser(t).Username
 
 			opts := []proxySuiteOptionsFunc{
@@ -407,9 +401,6 @@ func TestALPNSNIProxyKube(t *testing.T) {
 // TestALPNSNIProxyKubeV2Leaf tests remove cluster kubernetes configuration where root and leaf proxies
 // are using V2 configuration with Multiplex proxy listener.
 func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	const (
 		localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local"
 		k8User     = "[email protected]"
@@ -441,10 +432,12 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
 
 	suite := newSuite(t,
 		withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) {
+			config.InsecureMode = true
 			config.Proxy.Kube.Enabled = true
 			config.Version = defaults.TeleportConfigVersionV2
 		}),
 		withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) {
+			config.InsecureMode = true
 			config.Version = defaults.TeleportConfigVersionV2
 			config.Proxy.Kube.Enabled = true
 
@@ -477,9 +470,6 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
 
 // TestKubePROXYProtocol tests correct behavior of Proxy Kube listener regarding PROXY protocol usage.
 func TestKubePROXYProtocol(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	const (
 		kubeCluster = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local"
 		k8User      = "[email protected]"
@@ -566,6 +556,7 @@ func TestKubePROXYProtocol(t *testing.T) {
 				Logger:      logtest.NewLogger(),
 			}
 			tconf := servicecfg.MakeDefaultConfig()
+			tconf.InsecureMode = true
 			tconf.Proxy.Kube.ListenAddr = *utils.MustParseAddr(helpers.NewListener(t, service.ListenerProxyKube, &cfg.Fds))
 			if tt.proxyListenerMode == types.ProxyListenerMode_Multiplex {
 				cfg.Listeners = helpers.SingleProxyPortSetup(t, &cfg.Fds)
@@ -702,10 +693,6 @@ func createALPNLocalKubeClient(t *testing.T, targetAddr utils.NetAddr, teleportC
 }
 
 func TestKubeIPPinning(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-	modules.SetInsecureTestMode(true)
-
 	const (
 		kubeCluster = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local"
 		k8User      = "[email protected]"
@@ -739,6 +726,7 @@ func TestKubeIPPinning(t *testing.T) {
 
 	suite := newSuite(t,
 		withRootClusterConfig(rootClusterStandardConfig(t), func(config *servicecfg.Config) {
+			config.InsecureMode = true
 			config.Proxy.Kube.Enabled = true
 			config.Version = defaults.TeleportConfigVersionV3
 
@@ -749,6 +737,7 @@ func TestKubeIPPinning(t *testing.T) {
 		}),
 		withLeafClusterConfig(leafClusterStandardConfig(t), func(config *servicecfg.Config) {
 			config.Version = defaults.TeleportConfigVersionV3
+			config.InsecureMode = true
 			config.Proxy.Kube.Enabled = true
 
 			config.Kube.Enabled = true
@@ -1346,9 +1335,6 @@ func TestALPNSNIProxyAppAccess(t *testing.T) {
 // TestALPNProxyRootLeafAuthDial tests dialing local/remote auth service based on ALPN
 // teleport-auth protocol and ServerName as encoded cluster name.
 func TestALPNProxyRootLeafAuthDial(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	username := helpers.MustGetCurrentUser(t).Username
 
 	suite := newSuite(t,
@@ -1400,9 +1386,6 @@ func TestALPNProxyRootLeafAuthDial(t *testing.T) {
 // TestALPNProxyAuthClientConnectWithUserIdentity creates and connects to the Auth service
 // using user identity file when teleport is configured with Multiple proxy listener mode.
 func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	cfg := helpers.InstanceConfig{
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
@@ -1413,6 +1396,7 @@ func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) {
 	rc := helpers.NewInstance(t, cfg)
 
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -1499,9 +1483,6 @@ func TestALPNProxyAuthClientConnectWithUserIdentity(t *testing.T) {
 // TestALPNProxyDialProxySSHWithoutInsecureMode tests dialing to the localhost with teleport-proxy-ssh
 // protocol without using insecure mode in order to check if establishing connection to localhost works properly.
 func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	privateKey, publicKey, err := testauthority.GenerateKeyPair()
 	require.NoError(t, err)
 
@@ -1520,6 +1501,7 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) {
 
 	// Make root cluster config.
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Auth.Preference.SetSecondFactor("off")
@@ -1536,8 +1518,6 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) {
 		rc.StopAll()
 	})
 
-	// Disable insecure mode to make sure that dialing to localhost works.
-	lib.SetInsecureDevMode(false)
 	cfg := helpers.ClientConfig{
 		Login:   username,
 		Cluster: rc.Secrets.SiteName,
@@ -1568,9 +1548,6 @@ func TestALPNProxyDialProxySSHWithoutInsecureMode(t *testing.T) {
 // TestALPNProxyHTTPProxyNoProxyDial tests if a node joining to root cluster
 // takes into account http_proxy and no_proxy env variables.
 func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	// We need to use the non-loopback address for our Teleport cluster, as the
 	// Go HTTP library will recognize requests to the loopback address and
 	// refuse to use the HTTP proxy, which will invalidate the test.
@@ -1589,6 +1566,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	rc.AddUser(username, []string{username})
 
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -1597,6 +1575,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	rcConf.Proxy.DisableWebInterface = true
 	rcConf.SSH.Enabled = false
 	rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
+	rcConf.InsecureMode = true
 
 	err = rc.CreateEx(t, nil, rcConf)
 	require.NoError(t, err)
@@ -1620,7 +1599,9 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 
 	// Start the node, due to no_proxy=127.0.0.1 env variable the connection established
 	// to the proxy should not go through the http_proxy server.
-	_, err = rc.StartNode(makeNodeConfig("first-root-node", rcProxyAddr))
+	nodeConfig := makeNodeConfig("first-root-node", rcProxyAddr)
+	nodeConfig.InsecureMode = true
+	_, err = rc.StartNode(nodeConfig)
 	require.NoError(t, err)
 
 	ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(time.Second*30))
@@ -1634,7 +1615,9 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	// Unset the no_proxy=127.0.0.1 env variable. After that a new node
 	// should take into account the http_proxy address and connection should go through the http_proxy.
 	require.NoError(t, os.Unsetenv("no_proxy"))
-	_, err = rc.StartNode(makeNodeConfig("second-root-node", rcProxyAddr))
+	nodeConfig2 := makeNodeConfig("second-root-node", rcProxyAddr)
+	nodeConfig2.InsecureMode = true
+	_, err = rc.StartNode(nodeConfig2)
 	require.NoError(t, err)
 	err = rc.WaitForNodeCount(ctx, "root.example.com", 2)
 	require.NoError(t, err)
@@ -1645,9 +1628,6 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 // TestALPNProxyHTTPProxyBasicAuthDial tests if a node joining to root cluster
 // takes into account http_proxy with basic auth credentials in the address
 func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	log := logtest.NewLogger()
 
 	// We need to use the non-loopback address for our Teleport cluster, as the
@@ -1670,6 +1650,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
 	rc.AddUser(username, []string{username})
 
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -1679,6 +1660,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
 	rcConf.SSH.Enabled = false
 	rcConf.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	rcConf.Logger = log
+	rcConf.InsecureMode = true
 
 	err = rc.CreateEx(t, nil, rcConf)
 	require.NoError(t, err)
@@ -1704,6 +1686,7 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
 	rcProxyAddr := net.JoinHostPort(rcAddr, helpers.PortStr(t, rc.Web))
 	nodeCfg := makeNodeConfig("node1", rcProxyAddr)
 	nodeCfg.Logger = log
+	nodeCfg.InsecureMode = true
 
 	timeout := time.Second * 60
 	startErrC := make(chan error)
@@ -1734,9 +1717,6 @@ func TestALPNProxyHTTPProxyBasicAuthDial(t *testing.T) {
 // TestALPNSNIProxyGRPCInsecure tests ALPN protocol ProtocolProxyGRPCInsecure
 // by registering a node with IAM join method.
 func TestALPNSNIProxyGRPCInsecure(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	nodeAccount := "123456789012"
 	nodeRoleARN := "arn:aws:iam::123456789012:role/test"
 	nodeCredentials := credentials.NewStaticCredentialsProvider("FAKE_ID", "FAKE_KEY", "FAKE_TOKEN")
@@ -1770,9 +1750,6 @@ func TestALPNSNIProxyGRPCInsecure(t *testing.T) {
 // TestALPNSNIProxyGRPCSecure tests ALPN protocol ProtocolProxyGRPCSecure
 // by creating a KubeServiceClient for pod search.
 func TestALPNSNIProxyGRPCSecure(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	const (
 		localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local"
 		k8User     = "[email protected]"

integration/proxy/proxy_tunnel_strategy_test.go

@@ -34,7 +34,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
@@ -75,9 +74,7 @@ func newProxyTunnelStrategy(t *testing.T, cluster string, strategy *types.Tunnel
 		strategy: strategy,
 	}
 
-	lib.SetInsecureDevMode(true)
 	t.Cleanup(func() {
-		lib.SetInsecureDevMode(false)
 		p.cleanup(t)
 	})
 
@@ -329,6 +326,7 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) {
 	conf.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync)
 	conf.Proxy.Enabled = false
 	conf.SSH.Enabled = false
+	conf.InsecureMode = true
 
 	require.NoError(t, auth.CreateEx(t, nil, conf))
 	require.NoError(t, auth.Start())
@@ -355,6 +353,7 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) {
 	conf.DataDir = t.TempDir()
 	conf.Logger = proxy.Log
 	conf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+	conf.InsecureMode = true
 
 	conf.Auth.Enabled = false
 	conf.SSH.Enabled = false
@@ -401,6 +400,7 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) {
 	conf.Logger = node.Log
 	conf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
 	conf.DebugService.Enabled = false
+	conf.InsecureMode = true
 
 	conf.Auth.Enabled = false
 	conf.Proxy.Enabled = false
@@ -448,6 +448,7 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) {
 	conf.DataDir = t.TempDir()
 	conf.Logger = db.Log
 	conf.InstanceMetadataClient = imds.NewDisabledIMDSClient()
+	conf.InsecureMode = true
 
 	conf.Auth.Enabled = false
 	conf.Proxy.Enabled = false

integration/proxy/teleterm_test.go

@@ -45,7 +45,6 @@ import (
 	dbhelpers "github.com/gravitational/teleport/integration/db"
 	"github.com/gravitational/teleport/integration/helpers"
 	"github.com/gravitational/teleport/integration/kube"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -393,10 +392,7 @@ func (c *mockTSHDEventsService) PromptMFA(context.Context, *api.PromptMFARequest
 // is enabled in those tests. User certs with pinned IPs are injected during
 // those tests, which is not feasible for Teleterm daemon flow.
 func TestTeletermKubeGateway(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 	ctx := context.Background()
-
 	const (
 		localK8SNI = constants.KubeTeleportProxyALPNPrefix + "teleport.cluster.local"
 		k8User     = "[email protected]"

integration/teleterm_test.go

@@ -71,9 +71,11 @@ func TestTeleterm(t *testing.T) {
 		dbhelpers.WithListenerSetupDatabaseTest(helpers.SingleProxyPortSetup),
 		dbhelpers.WithLeafConfig(func(config *servicecfg.Config) {
 			config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			config.InsecureMode = true
 		}),
 		dbhelpers.WithRootConfig(func(config *servicecfg.Config) {
 			config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			config.InsecureMode = true
 		}),
 	)
 	pack.WaitForLeaf(t)

integration/time_sync_test.go

@@ -28,15 +28,12 @@ import (
 
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 )
 
 // TestTimeReconciliation launches two instances with clock differences in system clock,
 // to verify that global notification is created about time drifting.
 func TestTimeReconciliation(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 	helpers.SetTestTimeouts(2 * time.Second)
 
 	ctx := t.Context()

integration/web/web_test.go

@@ -36,7 +36,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/integration/helpers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
@@ -89,6 +88,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 		testserver.WithTestApp("root-app-mfa", rootAppMFAServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = false
+			cfg.InsecureMode = true
 			cfg.Auth.Preference = &types.AuthPreferenceV2{
 				Metadata: types.Metadata{
 					Labels: map[string]string{types.OriginLabel: types.OriginConfigFile},
@@ -125,6 +125,7 @@ func TestMFAAuthenticateChallenge_IsMFARequiredApp(t *testing.T) {
 		testserver.WithTestApp("leaf-app-mfa", leafAppMFAServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.SSH.Enabled = false
+			cfg.InsecureMode = true
 		}),
 	)
 	require.NoError(t, err)
@@ -291,11 +292,6 @@ func RegisterPasswordlessDeviceForUser(t *testing.T, server *service.TeleportPro
 }
 
 func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) {
-	// Use insecure mode so that the trusted cluster can establish trust over reverse tunnel.
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) })
-
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
 	rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr()

integrations/operator/controllers/resources/testlib/env.go

@@ -79,7 +79,7 @@ func ValidRandomResourceName(prefix string) string {
 	return prefix + string(b)
 }
 
-func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string) {
+func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.TeleInstance, string) {
 	modulestest.SetTestModules(t, modulestest.Modules{
 		TestBuildType: modules.BuildEnterprise,
 		TestFeatures: modules.Features{
@@ -104,6 +104,7 @@ func defaultTeleportServiceConfig(t *testing.T) (*helpers.TeleInstance, string)
 	rcConf.Proxy.DisableWebInterface = true
 	rcConf.SSH.Enabled = true
 	rcConf.Version = "v2"
+	rcConf.InsecureMode = insecureMode
 
 	roleName := ValidRandomResourceName("role-")
 	unrestricted := []string{"list", "create", "read", "update", "delete"}
@@ -184,6 +185,7 @@ type TestSetup struct {
 	TeleportServer           *helpers.TeleInstance
 	ResourceName             string
 	Context                  context.Context
+	InsecureMode             bool
 }
 
 // StartKubernetesOperator creates and start a new operator
@@ -253,7 +255,7 @@ func setupTeleportClient(t *testing.T, setup *TestSetup) {
 
 	// Start a Teleport server for the test and set up a client connected to
 	// that server.
-	teleportServer, operatorName := defaultTeleportServiceConfig(t)
+	teleportServer, operatorName := defaultTeleportServiceConfig(t, setup.InsecureMode)
 	setup.TeleportServer = teleportServer
 	require.NoError(t, teleportServer.Start())
 	setup.TeleportClient = clientForTeleport(t, teleportServer, operatorName)
@@ -277,6 +279,12 @@ func WithTeleportClient(clt *client.Client) TestOption {
 	}
 }
 
+func WithInsecureMode() TestOption {
+	return func(setup *TestSetup) {
+		setup.InsecureMode = true
+	}
+}
+
 func StepByStep(setup *TestSetup) {
 	setup.stepByStepReconciliation = true
 }

integrations/operator/controllers/resources/trusted_clusterv2_controller_test.go

@@ -40,7 +40,6 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/secretlookup"
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils/log/logtest"
 )
@@ -168,14 +167,13 @@ func (r *trustedClusterV2TestingPrimitives) setupTest(t *testing.T, clusterName
 	r.remoteCluster = remoteCluster
 
 	rcConf := servicecfg.MakeDefaultConfig()
+	rcConf.InsecureMode = true
 	rcConf.DataDir = t.TempDir()
 	rcConf.Auth.Enabled = true
 	rcConf.Proxy.Enabled = true
 	rcConf.Proxy.DisableWebInterface = true
 	rcConf.Version = "v2"
-
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
+	rcConf.InsecureMode = true
 
 	require.NoError(t, remoteCluster.CreateEx(t, nil, rcConf))
 	require.NoError(t, remoteCluster.Start())
@@ -191,6 +189,7 @@ func TestTrustedClusterV2Creation(t *testing.T) {
 		resources.NewTrustedClusterV2Reconciler,
 		test,
 		testlib.WithResourceName(remoteClusterName),
+		testlib.WithInsecureMode(),
 	)
 }
 
@@ -203,6 +202,7 @@ func TestTrustedClusterV2Deletion(t *testing.T) {
 		resources.NewTrustedClusterV2Reconciler,
 		test,
 		testlib.WithResourceName(remoteClusterName),
+		testlib.WithInsecureMode(),
 	)
 }
 
@@ -215,6 +215,7 @@ func TestTrustedClusterV2DeletionDrift(t *testing.T) {
 		resources.NewTrustedClusterV2Reconciler,
 		test,
 		testlib.WithResourceName(remoteClusterName),
+		testlib.WithInsecureMode(),
 	)
 }
 
@@ -227,6 +228,7 @@ func TestTrustedClusterUpdate(t *testing.T) {
 		resources.NewTrustedClusterV2Reconciler,
 		test,
 		testlib.WithResourceName(remoteClusterName),
+		testlib.WithInsecureMode(),
 	)
 }
 
@@ -234,7 +236,7 @@ func TestTrustedClusterV2SecretLookup(t *testing.T) {
 	test := &trustedClusterV2TestingPrimitives{}
 	const remoteClusterName = "remote.example.com"
 	test.setupTest(t, remoteClusterName)
-	setup := testlib.SetupFakeKubeTestEnv(t)
+	setup := testlib.SetupFakeKubeTestEnv(t, testlib.WithInsecureMode())
 	test.Init(setup)
 	ctx := t.Context()
 	require.NoError(t, test.SetupTeleportFixtures(ctx))

lib/auth/auth.go

@@ -754,6 +754,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (as *Server, err error) {
 		sessionSummarizerProvider:    cfg.SessionSummarizerProvider,
 		recordingMetadataProvider:    cfg.RecordingMetadataProvider,
 		awsOrganizationsClientGetter: cfg.AWSOrganizationsClientGetter,
+		insecureMode:                 cfg.InsecureMode,
 	}
 	as.inventory = inventory.NewController(as, services,
 		inventory.WithAuthServerID(cfg.HostUUID),
@@ -1231,8 +1232,9 @@ type Server struct {
 	clock clockwork.Clock
 	bk    backend.Backend
 
-	closeCtx   context.Context
-	cancelFunc context.CancelFunc
+	insecureMode bool
+	closeCtx     context.Context
+	cancelFunc   context.CancelFunc
 
 	fakePasswordHash     []byte
 	fakeRecoveryCodeHash []byte

lib/auth/authtest/authtest.go

@@ -117,6 +117,7 @@ type AuthServerConfig struct {
 	FIPS bool
 	// KeystoreConfig is configuration for the CA keystore.
 	KeystoreConfig servicecfg.KeystoreConfig
+	InsecureMode   bool
 }
 
 // CheckAndSetDefaults checks and sets defaults
@@ -380,6 +381,7 @@ func NewAuthServer(cfg AuthServerConfig) (*AuthServer, error) {
 		AWSOrganizationsClientGetter: cfg.AWSOrganizationsClientGetter,
 		FakePasswordHash:             []byte(FakePasswordHash),
 		FakeRecoveryCodeHash:         []byte(FakeRecoveryCodeHash),
+		InsecureMode:                 cfg.InsecureMode,
 	},
 		// Reduce auth.Server bcrypt costs when testing.
 		WithBcryptCost(bcrypt.MinCost),

lib/auth/init.go

@@ -103,6 +103,9 @@ type RecordingEncryptionManager interface {
 
 // InitConfig is auth server init config
 type InitConfig struct {
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
+
 	// Backend is auth backend to use
 	Backend backend.Backend
 
@@ -700,7 +703,7 @@ func initCluster(ctx context.Context, cfg InitConfig, asrv *Server) error {
 		return trace.Wrap(err)
 	}
 
-	if lib.IsInsecureDevMode() {
+	if lib.IsInsecureDevMode() || cfg.InsecureMode {
 		const warningMessage = "Starting teleport in insecure mode. This is " +
 			"dangerous! Sensitive information will be logged to console and " +
 			"certificates will not be verified. Proceed with caution!"

lib/auth/init_test.go

@@ -59,7 +59,6 @@ import (
 	"github.com/gravitational/teleport/api/types/vnet"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authcatest"
 	"github.com/gravitational/teleport/lib/auth/authtest"
@@ -2352,9 +2351,6 @@ func TestInitCreatesCertsIfMissing(t *testing.T) {
 }
 
 func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	tests := []struct {
 		name               string
 		initialVersion     string
@@ -2435,6 +2431,7 @@ func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) {
 			ctx := t.Context()
 
 			authCfg := setupConfig(t)
+			authCfg.InsecureMode = true
 			service, err := local.NewBackendInfoService(authCfg.Backend)
 			require.NoError(t, err)
 

lib/auth/trustedcluster.go

@@ -685,7 +685,8 @@ func (a *Server) sendValidateRequestToProxy(ctx context.Context, host string, va
 		roundtrip.SanitizerEnabled(true),
 	}
 
-	if lib.IsInsecureDevMode() {
+	// TODO(tross): remove lib.IsInsecureDevMode after everything is converted.
+	if lib.IsInsecureDevMode() || a.insecureMode {
 		a.logger.WarnContext(ctx, "The setting insecureSkipVerify is used to communicate with proxy. Make sure you intend to run Teleport in insecure mode!")
 
 		// Get the default transport, this allows picking up proxy from the
@@ -743,7 +744,7 @@ func (a *Server) validateTrustedClusterName(ctx context.Context, trustedCluster
 	resp, err := webclient.Find(&webclient.Config{
 		Context:   ctx,
 		ProxyAddr: trustedCluster.GetProxyAddress(),
-		Insecure:  lib.IsInsecureDevMode(),
+		Insecure:  a.insecureMode,
 	})
 	if err != nil {
 		return trace.Wrap(err)

lib/config/configuration.go

@@ -2504,9 +2504,6 @@ func applyConfigVersion(fc *FileConfig, cfg *servicecfg.Config) {
 // Configure merges command line arguments with what's in a configuration file
 // with CLI commands taking precedence
 func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags bool) error {
-	// pass the value of --insecure flag to the runtime
-	lib.SetInsecureDevMode(clf.InsecureMode)
-
 	// load /etc/teleport.yaml and apply its values:
 	fileConf, err := ReadConfigFile(clf.ConfigFile)
 	if err != nil {
@@ -2919,14 +2916,18 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
 		cfg.Auth.AgentRolloutControllerSyncPeriod = period
 	}
 
+	// TODO(tross): Remove when enterprise is consuming from the config
+	lib.SetInsecureDevMode(clf.InsecureMode)
+	// pass the value of --insecure flag to the runtime
+	if clf.InsecureMode {
+		cfg.InsecureMode = true
+	}
+
 	return nil
 }
 
 // ConfigureOpenSSH initializes a config from the commandline flags passed
 func ConfigureOpenSSH(clf *CommandLineFlags, cfg *servicecfg.Config) error {
-	// pass the value of --insecure flag to the runtime
-	lib.SetInsecureDevMode(clf.InsecureMode)
-
 	// Apply command line --debug flag to override logger severity.
 	level := slog.LevelError
 	if clf.Debug {
@@ -2990,6 +2991,12 @@ func ConfigureOpenSSH(clf *CommandLineFlags, cfg *servicecfg.Config) error {
 	cfg.SetAuthServerAddresses(nil)
 	cfg.ProxyServer = *proxyServer
 
+	// TODO(tross): Remove when enterprise is consuming from the config
+	lib.SetInsecureDevMode(clf.InsecureMode)
+	// pass the value of --insecure flag to the runtime
+	if clf.InsecureMode {
+		cfg.InsecureMode = true
+	}
 	return nil
 }
 

lib/config/configuration_test.go

@@ -44,7 +44,6 @@ import (
 	"github.com/gravitational/teleport/api/types/installers"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/cryptosuites"
@@ -219,8 +218,6 @@ func TestSampleConfig(t *testing.T) {
 			require.Equal(t, testCase.expectProxyWebAddr, fc.Proxy.WebAddr)
 			require.ElementsMatch(t, testCase.expectProxyPublicAddrs, fc.Proxy.PublicAddr)
 			require.ElementsMatch(t, testCase.expectProxyKeyPairs, fc.Proxy.KeyPairs)
-
-			require.False(t, lib.IsInsecureDevMode())
 		})
 	}
 }

lib/integrations/awsoidc/idp_iam_config.go

@@ -46,6 +46,7 @@ const (
 
 // IdPIAMConfigureRequest represents a request to configure AWS OIDC integration.
 type IdPIAMConfigureRequest struct {
+	Insecure bool
 	// Cluster is the Teleport Cluster.
 	// Used for tagging the created Roles/IdP.
 	Cluster string
@@ -264,7 +265,7 @@ func createOIDCIdPAction(ctx context.Context, clt IdPIAMConfigureClient, req IdP
 		thumbprint = req.fakeThumbprint
 	} else {
 		var err error
-		thumbprint, err = ThumbprintIdP(ctx, req.ProxyPublicAddress)
+		thumbprint, err = ThumbprintIdP(ctx, req.ProxyPublicAddress, req.Insecure)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}

lib/integrations/awsoidc/idp_iam_config_test.go

@@ -34,7 +34,6 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
-	"github.com/gravitational/teleport/lib"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	"github.com/gravitational/teleport/lib/cloud/aws/tags"
 	"github.com/gravitational/teleport/lib/utils/testutils/golden"
@@ -43,6 +42,7 @@ import (
 func TestIdPIAMConfigReqDefaults(t *testing.T) {
 	baseIdPIAMConfigReq := func() IdPIAMConfigureRequest {
 		return IdPIAMConfigureRequest{
+			Insecure:                true,
 			Cluster:                 "mycluster",
 			IntegrationName:         "myintegration",
 			IntegrationRole:         "integrationrole",
@@ -74,6 +74,7 @@ func TestIdPIAMConfigReqDefaults(t *testing.T) {
 					"teleport.dev/integration": "myintegration",
 					"teleport.dev/origin":      "integration_awsoidc",
 				},
+				Insecure:                true,
 				IntegrationPolicyPreset: PolicyPresetUnspecified,
 				AutoConfirm:             true,
 			},
@@ -171,10 +172,6 @@ func TestConfigureIdPIAM(t *testing.T) {
 	require.NoError(t, err)
 
 	tlsServerIssuer := tlsServerURL.Host
-	// TLS Server starts with self-signed certificates.
-
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 
 	baseIdPIAMConfigReqWithTLServer := func() IdPIAMConfigureRequest {
 		return IdPIAMConfigureRequest{
@@ -298,7 +295,9 @@ func TestConfigureIdPIAM(t *testing.T) {
 				existingIDPUrl:       tt.mockExistingIdPUrl,
 			}
 
-			err := ConfigureIdPIAM(ctx, &clt, tt.req())
+			req := tt.req()
+			req.Insecure = true
+			err := ConfigureIdPIAM(ctx, &clt, req)
 			tt.errCheck(t, err)
 
 			if tt.externalStateCheck != nil {
@@ -311,8 +310,6 @@ func TestConfigureIdPIAM(t *testing.T) {
 func TestConfigureIdPIAMWithPresetPolicy(t *testing.T) {
 	ctx := context.Background()
 	tlsServer := httptest.NewTLSServer(nil)
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
 	const mockAccountID string = "123456789012"
 	baseIdPIAMConfigReqWithTLServer := func() IdPIAMConfigureRequest {
 		return IdPIAMConfigureRequest{
@@ -321,6 +318,7 @@ func TestConfigureIdPIAMWithPresetPolicy(t *testing.T) {
 			IntegrationRole:    "integrationrole",
 			ProxyPublicAddress: tlsServer.URL,
 			AutoConfirm:        true,
+			Insecure:           true,
 		}
 	}
 

lib/integrations/awsoidc/idp_thumbprint.go

@@ -27,7 +27,6 @@ import (
 
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/utils/oidc"
 )
 
@@ -36,7 +35,7 @@ import (
 // https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
 // Returns the thumbprint of the top intermediate CA that signed the TLS cert used to serve HTTPS requests.
 // In case of a self signed certificate, then it returns the thumbprint of the TLS cert itself.
-func ThumbprintIdP(ctx context.Context, publicAddress string) (string, error) {
+func ThumbprintIdP(ctx context.Context, publicAddress string, insecureMode bool) (string, error) {
 	issuer, err := oidc.IssuerFromPublicAddress(publicAddress, "")
 	if err != nil {
 		return "", trace.Wrap(err)
@@ -54,7 +53,7 @@ func ThumbprintIdP(ctx context.Context, publicAddress string) (string, error) {
 
 	d := tls.Dialer{
 		Config: &tls.Config{
-			InsecureSkipVerify: lib.IsInsecureDevMode(),
+			InsecureSkipVerify: insecureMode,
 		},
 	}
 	conn, err := d.DialContext(ctx, "tcp", addrURL.Host)

lib/integrations/awsoidc/idp_thumbprint_test.go

@@ -26,8 +26,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib"
 )
 
 func TestThumbprint(t *testing.T) {
@@ -35,11 +33,7 @@ func TestThumbprint(t *testing.T) {
 
 	tlsServer := httptest.NewTLSServer(nil)
 
-	// Proxy starts with self-signed certificates.
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
-	thumbprint, err := ThumbprintIdP(ctx, tlsServer.URL)
+	thumbprint, err := ThumbprintIdP(ctx, tlsServer.URL, true)
 	require.NoError(t, err)
 
 	serverCertificateSHA1 := sha1.Sum(tlsServer.Certificate().Raw)

lib/reversetunnel/agentpool.go

@@ -43,7 +43,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/reversetunnel/track"
@@ -144,6 +143,8 @@ type AgentPoolConfig struct {
 	PROXYSigner multiplexer.PROXYHeaderSigner
 	// StaleConnTimeoutDisabled is true if connection timeouts are disabled.
 	StaleConnTimeoutDisabled bool
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
 }
 
 // CheckAndSetDefaults checks and sets defaults.
@@ -209,7 +210,7 @@ func NewAgentPool(ctx context.Context, config AgentPoolConfig) (*AgentPool, erro
 			"target_cluster", config.Cluster,
 			"local_cluster", config.LocalCluster,
 		),
-		runtimeConfig: newAgentPoolRuntimeConfig(),
+		runtimeConfig: newAgentPoolRuntimeConfig(config.InsecureMode),
 	}
 
 	pool.runtimeConfig.isRemoteCluster = pool.IsRemoteCluster
@@ -474,7 +475,7 @@ func (p *AgentPool) newAgent(ctx context.Context, tracker *track.Tracker, lease
 		p.logger.DebugContext(ctx, "Failed to update remote config", "error", err)
 	}
 
-	options := []proxy.DialerOptionFunc{proxy.WithInsecureSkipTLSVerify(lib.IsInsecureDevMode())}
+	options := []proxy.DialerOptionFunc{proxy.WithInsecureSkipTLSVerify(p.InsecureMode)}
 	if p.runtimeConfig.useALPNRouting() {
 		options = append(options, proxy.WithALPNDialer(p.runtimeConfig.alpnDialerConfig(p.getClusterCAs)))
 	}
@@ -656,6 +657,7 @@ type agentPoolRuntimeConfig struct {
 	// tlsRoutingConnUpgradeRequired indicates that ALPN connection upgrades
 	// are required for making TLS routing requests.
 	tlsRoutingConnUpgradeRequired bool
+	insecureMode                  bool
 
 	// remoteTLSRoutingEnabled caches a remote clusters tls routing setting. This helps prevent
 	// proxy endpoint stagnation where an even numbers of proxies are hidden behind a round robin
@@ -671,7 +673,7 @@ type agentPoolRuntimeConfig struct {
 	clock          clockwork.Clock
 }
 
-func newAgentPoolRuntimeConfig() *agentPoolRuntimeConfig {
+func newAgentPoolRuntimeConfig(insecureMode bool) *agentPoolRuntimeConfig {
 	return &agentPoolRuntimeConfig{
 		tunnelStrategyType: types.AgentMesh,
 		connectionCount:    defaultAgentConnectionCount,
@@ -679,6 +681,7 @@ func newAgentPoolRuntimeConfig() *agentPoolRuntimeConfig {
 		keepAliveInterval:  defaults.KeepAliveInterval(),
 		keepAliveCount:     defaults.KeepAliveCountMax,
 		clock:              clockwork.NewRealClock(),
+		insecureMode:       insecureMode,
 	}
 }
 
@@ -729,7 +732,7 @@ func (c *agentPoolRuntimeConfig) alpnDialerConfig(getClusterCAs client.GetCluste
 	return client.ALPNDialerConfig{
 		TLSConfig: &tls.Config{
 			NextProtos:         alpncommon.ProtocolsToString(protocols),
-			InsecureSkipVerify: lib.IsInsecureDevMode(),
+			InsecureSkipVerify: c.insecureMode,
 		},
 		KeepAlivePeriod:         c.keepAliveInterval,
 		ALPNConnUpgradeRequired: c.tlsRoutingConnUpgradeRequired,
@@ -773,7 +776,7 @@ func (c *agentPoolRuntimeConfig) updateRemote(ctx context.Context, addr *utils.N
 	ping, err := webclient.Find(&webclient.Config{
 		Context:   ctx,
 		ProxyAddr: addr.Addr,
-		Insecure:  lib.IsInsecureDevMode(),
+		Insecure:  c.insecureMode,
 	})
 	if err != nil {
 		// If TLS Routing is disabled the address is the proxy reverse tunnel
@@ -801,7 +804,7 @@ func (c *agentPoolRuntimeConfig) updateRemote(ctx context.Context, addr *utils.N
 
 	c.remoteTLSRoutingEnabled = tlsRoutingEnabled
 	if c.remoteTLSRoutingEnabled {
-		c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode())
+		c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, c.insecureMode)
 		slog.DebugContext(ctx, "ALPN upgrade required for remote cluster",
 			"remote_addr", addr.Addr,
 			"conn_upgrade_required", c.tlsRoutingConnUpgradeRequired,
@@ -837,7 +840,7 @@ func (c *agentPoolRuntimeConfig) update(ctx context.Context, netConfig types.Clu
 	if c.proxyListenerMode == types.ProxyListenerMode_Multiplex && oldProxyListenerMode != c.proxyListenerMode {
 		addr, _, err := resolver(ctx)
 		if err == nil {
-			c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, lib.IsInsecureDevMode())
+			c.tlsRoutingConnUpgradeRequired = client.IsALPNConnUpgradeRequired(ctx, addr.Addr, c.insecureMode)
 		} else {
 			slog.WarnContext(ctx, "Failed to resolve addr", "error", err)
 		}

lib/reversetunnel/rc_manager.go

@@ -81,6 +81,8 @@ type RemoteClusterTunnelManagerConfig struct {
 	KubeDialAddr utils.NetAddr
 	// FIPS indicates if Teleport was started in FIPS mode.
 	FIPS bool
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
 	// Logger is the logger
 	Logger *slog.Logger
 	// LocalAuthAddresses is a list of auth servers to use when dialing back to
@@ -360,6 +362,7 @@ func (w *RemoteClusterTunnelManager) Sync(ctx context.Context) error {
 
 func realNewAgentPool(ctx context.Context, cfg RemoteClusterTunnelManagerConfig, cluster, addr string) (*AgentPool, error) {
 	pool, err := NewAgentPool(ctx, AgentPoolConfig{
+		InsecureMode: cfg.InsecureMode,
 		// Configs for our cluster.
 		Client:              cfg.AuthClient,
 		AccessPoint:         cfg.AccessPoint,

lib/service/connect.go

@@ -48,7 +48,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/state"
@@ -759,7 +758,7 @@ func (process *TeleportProcess) makeJoinParams(
 		// requests before closing
 		CircuitBreakerConfig: breaker.NoopBreakerConfig(),
 		FIPS:                 process.Config.FIPS,
-		Insecure:             lib.IsInsecureDevMode(),
+		Insecure:             process.Config.InsecureMode,
 	}
 	if joinParams.JoinMethod == types.JoinMethodAzure {
 		joinParams.AzureParams = joinclient.AzureParams{
@@ -1488,7 +1487,7 @@ func (process *TeleportProcess) newClientThroughTunnel(tlsConfig *tls.Config, ss
 		Resolver:              process.resolver,
 		ClientConfig:          sshConfig,
 		Log:                   process.logger,
-		InsecureSkipTLSVerify: lib.IsInsecureDevMode(),
+		InsecureSkipTLSVerify: process.Config.InsecureMode,
 		GetClusterCAs: func(context.Context) (*x509.CertPool, error) {
 			return getClusterCAs()
 		},

lib/service/db.go

@@ -184,6 +184,7 @@ func (process *TeleportProcess) initDatabaseService() (retErr error) {
 	agentPool, err := reversetunnel.NewAgentPool(
 		process.ExitContext(),
 		reversetunnel.AgentPoolConfig{
+			InsecureMode:             process.Config.InsecureMode,
 			Component:                teleport.ComponentDatabase,
 			HostUUID:                 conn.HostID(),
 			Resolver:                 tunnelAddrResolver,

lib/service/desktop.go

@@ -118,6 +118,7 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(logger *slog
 		agentPool, err = reversetunnel.NewAgentPool(
 			process.ExitContext(),
 			reversetunnel.AgentPoolConfig{
+				InsecureMode:             process.Config.InsecureMode,
 				Component:                teleport.ComponentWindowsDesktop,
 				HostUUID:                 conn.HostID(),
 				Resolver:                 conn.TunnelProxyResolver(),

lib/service/kubernetes.go

@@ -132,6 +132,7 @@ func (process *TeleportProcess) initKubernetesService(logger *slog.Logger, conn
 		agentPool, err = reversetunnel.NewAgentPool(
 			process.ExitContext(),
 			reversetunnel.AgentPoolConfig{
+				InsecureMode:             process.Config.InsecureMode,
 				Component:                teleport.ComponentKube,
 				HostUUID:                 conn.HostID(),
 				Resolver:                 conn.TunnelProxyResolver(),

lib/service/service.go

@@ -86,7 +86,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/retryutils"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auditd"
 	"github.com/gravitational/teleport/lib/auth"
@@ -1366,7 +1365,7 @@ func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) {
 		reversetunnelclient.WebClientResolver(&webclient.Config{
 			Context:   process.ExitContext(),
 			ProxyAddr: resolverAddr.String(),
-			Insecure:  lib.IsInsecureDevMode(),
+			Insecure:  cfg.InsecureMode,
 			Timeout:   process.Config.Testing.ClientTimeout,
 		}),
 		process.Clock,
@@ -2477,6 +2476,7 @@ func (process *TeleportProcess) initAuthService() error {
 			RunWhileLockedRetryInterval: cfg.Testing.RunWhileLockedRetryInterval,
 			SessionSummarizerProvider:   sessionSummarizerProvider,
 			RecordingMetadataProvider:   recordingMetadataProvider,
+			InsecureMode:                cfg.InsecureMode,
 		}, func(as *auth.Server) error {
 			if !process.Config.CachePolicy.Enabled {
 				return nil
@@ -3694,6 +3694,7 @@ func (process *TeleportProcess) initSSH() error {
 			agentPool, err = reversetunnel.NewAgentPool(
 				process.ExitContext(),
 				reversetunnel.AgentPoolConfig{
+					InsecureMode:             process.Config.InsecureMode,
 					Component:                teleport.ComponentNode,
 					HostUUID:                 conn.HostID(),
 					Resolver:                 conn.TunnelProxyResolver(),
@@ -5412,6 +5413,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 		}
 
 		connectionsHandler, err := app.NewConnectionsHandler(process.GracefulExitContext(), &app.ConnectionsHandlerConfig{
+			InsecureMode:      process.Config.InsecureMode,
 			Clock:             process.Clock,
 			DataDir:           cfg.DataDir,
 			Emitter:           asyncEmitter,
@@ -5474,6 +5476,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			ProxyGroupID:              cfg.Proxy.ProxyGroupID,
 			CipherSuites:              cfg.CipherSuites,
 			FIPS:                      cfg.FIPS,
+			InsecureMode:              cfg.InsecureMode,
 			AccessPoint:               accessPoint,
 			Emitter:                   asyncEmitter,
 			PluginRegistry:            process.PluginRegistry,
@@ -5730,7 +5733,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 	sshGRPCTLSConfig := serverTLSConfig.Clone()
 	sshGRPCTLSConfig.NextProtos = []string{string(alpncommon.ProtocolHTTP2), string(alpncommon.ProtocolProxySSHGRPC)}
 	sshGRPCTLSConfig.ClientAuth = tls.RequireAndVerifyClientCert
-	if lib.IsInsecureDevMode() {
+	if cfg.InsecureMode {
 		sshGRPCTLSConfig.InsecureSkipVerify = true
 		sshGRPCTLSConfig.ClientAuth = tls.RequireAnyClientCert
 	}
@@ -5849,6 +5852,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 	// Create and register reverse tunnel AgentPool.
 	rcWatcher, err = reversetunnel.NewRemoteClusterTunnelManager(reversetunnel.RemoteClusterTunnelManagerConfig{
+		InsecureMode:        process.Config.InsecureMode,
 		HostUUID:            conn.HostID(),
 		AuthClient:          conn.Client,
 		AccessPoint:         accessPoint,
@@ -6813,6 +6817,7 @@ func (process *TeleportProcess) initApps() {
 		}
 
 		connectionsHandler, err := app.NewConnectionsHandler(process.ExitContext(), &app.ConnectionsHandlerConfig{
+			InsecureMode:      process.Config.InsecureMode,
 			Clock:             process.Config.Clock,
 			DataDir:           process.Config.DataDir,
 			AuthClient:        conn.Client,
@@ -6867,6 +6872,7 @@ func (process *TeleportProcess) initApps() {
 		agentPool, err := reversetunnel.NewAgentPool(
 			process.ExitContext(),
 			reversetunnel.AgentPoolConfig{
+				InsecureMode:             process.Config.InsecureMode,
 				Component:                teleport.ComponentApp,
 				HostUUID:                 conn.HostID(),
 				Resolver:                 tunnelAddrResolver,

lib/service/service_test.go

@@ -58,7 +58,6 @@ import (
 	autoupdate "github.com/gravitational/teleport/api/types/autoupdate"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/authtest"
 	"github.com/gravitational/teleport/lib/backend"
@@ -1158,9 +1157,6 @@ func expectedSSHPrincipals(hostID, hostName, clusterName string) []string {
 func TestTeleportProcessAuthVersionCheck(t *testing.T) {
 	t.Parallel()
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	listenAddr := utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
 	token := "join-token"
 
@@ -1178,6 +1174,7 @@ func TestTeleportProcessAuthVersionCheck(t *testing.T) {
 	require.NoError(t, err)
 
 	authCfg := servicecfg.MakeDefaultConfig()
+	authCfg.InsecureMode = true
 	authCfg.SetAuthServerAddress(listenAddr)
 	authCfg.DataDir = makeTempDir(t)
 	authCfg.Auth.Enabled = true
@@ -1200,6 +1197,7 @@ func TestTeleportProcessAuthVersionCheck(t *testing.T) {
 	// Create Node process, pointing at the auth server's local port
 	authListenAddr := authProc.Config.AuthServerAddresses()[0]
 	nodeCfg := servicecfg.MakeDefaultConfig()
+	nodeCfg.InsecureMode = true
 	nodeCfg.SetAuthServerAddress(authListenAddr)
 	nodeCfg.DataDir = makeTempDir(t)
 	nodeCfg.SetToken(token)
@@ -2231,11 +2229,7 @@ func makeTempDir(t *testing.T) string {
 // the instance has malformed system roles using pre-constructed data directories
 // generated by an older teleport version that permitted token mix-and-match.
 func TestInstanceCertReissue(t *testing.T) {
-	t.Setenv("_insecuredevmode_no_parallel", "1") // panic if the test is or will become parallel
 	t.Setenv("TELEPORT_UNSTABLE_SKIP_VERSION_UPGRADE_CHECK", "1")
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	var eg errgroup.Group
 	defer func() { require.NoError(t, eg.Wait()) }()
 
@@ -2251,6 +2245,7 @@ func TestInstanceCertReissue(t *testing.T) {
 	require.NoError(t, basicDirCopy("testdata/agent", agentDir))
 
 	authCfg := servicecfg.MakeDefaultConfig()
+	authCfg.InsecureMode = true
 	authCfg.Version = defaults.TeleportConfigVersionV3
 	authCfg.DataDir = authDir
 	authCfg.Auth.Enabled = true
@@ -2299,6 +2294,7 @@ func TestInstanceCertReissue(t *testing.T) {
 	require.ElementsMatch(t, []string{string(types.RoleAuth), string(types.RoleProxy), string(types.RoleNode)}, authIdentity.SystemRoles)
 
 	agentCfg := servicecfg.MakeDefaultConfig()
+	agentCfg.InsecureMode = true
 	agentCfg.Version = defaults.TeleportConfigVersionV3
 	agentCfg.DataDir = agentDir
 	agentCfg.ProxyServer = utils.NetAddr{

lib/service/servicecfg/config.go

@@ -277,7 +277,8 @@ type Config struct {
 	// DatabaseREPLRegistry is used to retrieve datatabase REPL given the
 	// protocol.
 	DatabaseREPLRegistry dbrepl.REPLRegistry
-
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
 	// token is either the token needed to join the auth server, or a path pointing to a file
 	// that contains the token
 	//

lib/srv/app/connections_handler.go

@@ -121,6 +121,9 @@ type ConnectionsHandlerConfig struct {
 
 	// MCPDemoServer enables the "Teleport Demo" MCP server.
 	MCPDemoServer bool
+
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
 }
 
 // CheckAndSetDefaults validates the config values and sets defaults.
@@ -297,6 +300,7 @@ func NewConnectionsHandler(closeContext context.Context, cfg *ConnectionsHandler
 		EnableDemoServer: c.cfg.MCPDemoServer,
 		CipherSuites:     c.cfg.CipherSuites,
 		AuthClient:       c.cfg.AuthClient,
+		InsecureMode:     c.cfg.InsecureMode,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)

lib/srv/app/session.go

@@ -161,6 +161,7 @@ func (c *ConnectionsHandler) withJWTTokenForwarder(ctx context.Context, sess *se
 			traits:       traits,
 			log:          c.log,
 			hostID:       c.cfg.HostID,
+			insecureMode: c.cfg.InsecureMode,
 		})
 	if err != nil {
 		return trace.Wrap(err)

lib/srv/app/transport.go

@@ -36,7 +36,6 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/app/common"
@@ -52,7 +51,8 @@ type transportConfig struct {
 	traits       wrappers.Traits
 	log          *slog.Logger
 	// hostID is purely for troubleshooting purposes (put in the error messages)
-	hostID string
+	hostID       string
+	insecureMode bool
 }
 
 // Check validates configuration.
@@ -284,7 +284,7 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 	// Don't verify the server's certificate if Teleport was started with
 	// the --insecure flag, or 'insecure_skip_verify' was specifically requested in
 	// the application config.
-	tlsConfig.InsecureSkipVerify = (lib.IsInsecureDevMode() || c.app.GetInsecureSkipVerify())
+	tlsConfig.InsecureSkipVerify = (c.insecureMode || c.app.GetInsecureSkipVerify())
 
 	return tlsConfig, nil
 }

lib/srv/mcp/server.go

@@ -70,6 +70,8 @@ type ServerConfig struct {
 	// CipherSuites is the list of TLS cipher suites that have been configured
 	// for this process.
 	CipherSuites []uint16
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
 
 	clock clockwork.Clock
 }

lib/srv/mcp/sse.go

@@ -28,7 +28,6 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
 	logutils "github.com/gravitational/teleport/lib/utils/log"
@@ -136,7 +135,7 @@ func (s *Server) makeBasicHTTPTransport(app types.Application) (http.RoundTrippe
 	// from the target server.
 	tr.ResponseHeaderTimeout = time.Minute
 	tr.TLSClientConfig = utils.TLSConfig(s.cfg.CipherSuites)
-	tr.TLSClientConfig.InsecureSkipVerify = lib.IsInsecureDevMode() || app.GetInsecureSkipVerify()
+	tr.TLSClientConfig.InsecureSkipVerify = s.cfg.InsecureMode || app.GetInsecureSkipVerify()
 	return tr, nil
 }
 

lib/web/apiserver.go

@@ -240,6 +240,10 @@ type Config struct {
 	// FIPS mode means Teleport started in a FedRAMP/FIPS compliant
 	// configuration.
 	FIPS bool
+
+	// InsecureMode defines whether insecure connections are allowed.
+	InsecureMode bool
+
 	// Modules define the build type, entitlements and licensed features.
 	Modules modules.Modules
 

lib/web/apiserver_test.go

@@ -98,7 +98,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/agentless"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
@@ -8319,6 +8318,7 @@ type WebPackOptions struct {
 	proxyOptions    []proxyOption
 	enableAuthCache bool
 	modules         *modulestest.Modules
+	insecureMode    bool
 }
 
 type webPackOptions func(*WebPackOptions)
@@ -8341,6 +8341,12 @@ func withModules(m *modulestest.Modules) webPackOptions {
 	}
 }
 
+func withInsecureMode() webPackOptions {
+	return func(cfg *WebPackOptions) {
+		cfg.insecureMode = true
+	}
+}
+
 func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack {
 	options := &WebPackOptions{}
 
@@ -8365,6 +8371,7 @@ func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack {
 			Clock:        clock,
 			AuditLog:     events.NewDiscardAuditLog(),
 			CacheEnabled: options.enableAuthCache,
+			InsecureMode: options.insecureMode,
 		},
 	})
 	require.NoError(t, err)
@@ -8479,7 +8486,7 @@ func newWebPack(t *testing.T, numProxies int, opts ...webPackOptions) *webPack {
 	var proxies []*testProxy
 	for p := range numProxies {
 		proxyID := fmt.Sprintf("proxy%v", p)
-		proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, options.modules, options.proxyOptions...))
+		proxies = append(proxies, createProxy(ctx, t, proxyID, node, server.TLS, hostSigners, clock, options.modules, options.insecureMode, options.proxyOptions...))
 	}
 
 	// Wait for proxies to fully register before starting the test.
@@ -8535,7 +8542,7 @@ func withKubeProxy() proxyOption {
 }
 
 func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regular.Server, authServer *authtest.TLSServer,
-	hostSigners []ssh.Signer, clock *clockwork.FakeClock, m *modulestest.Modules, opts ...proxyOption,
+	hostSigners []ssh.Signer, clock *clockwork.FakeClock, m *modulestest.Modules, insecureMode bool, opts ...proxyOption,
 ) *testProxy {
 	t.Helper()
 	cfg := proxyConfig{}
@@ -8713,7 +8720,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 	tlscfg, err := authServer.Identity.TLSConfig(utils.DefaultCipherSuites())
 	require.NoError(t, err)
 	tlscfg.ClientAuth = tls.RequireAndVerifyClientCert
-	if lib.IsInsecureDevMode() {
+	if insecureMode {
 		tlscfg.InsecureSkipVerify = true
 		tlscfg.ClientAuth = tls.RequireAnyClientCert
 	}
@@ -8848,6 +8855,7 @@ func createProxy(ctx context.Context, t *testing.T, proxyID string, node *regula
 		DatabaseREPLRegistry:  &mockDatabaseREPLRegistry{repl: map[string]dbrepl.REPLNewFunc{}},
 		Modules:               m,
 		ClusterFeatures:       *m.TestFeatures.ToProto(),
+		InsecureMode:          insecureMode,
 	}, SetClock(clock))
 	require.NoError(t, err)
 

lib/web/oidcidp.go

@@ -57,5 +57,5 @@ func (h *Handler) jwksOIDC(_ http.ResponseWriter, r *http.Request, _ httprouter.
 // Returns the thumbprint of the top intermediate CA that signed the TLS cert used to serve HTTPS requests.
 // In case of a self signed certificate, then it returns the thumbprint of the TLS cert itself.
 func (h *Handler) thumbprint(_ http.ResponseWriter, r *http.Request, _ httprouter.Params) (any, error) {
-	return awsoidc.ThumbprintIdP(r.Context(), h.PublicProxyAddr())
+	return awsoidc.ThumbprintIdP(r.Context(), h.PublicProxyAddr(), h.cfg.InsecureMode)
 }

lib/web/oidcidp_test.go

@@ -27,8 +27,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/lib"
 )
 
 // TestOIDCIdPPublicEndpoints ensures the public endpoints for the AWS OIDC integration are available.
@@ -87,11 +85,7 @@ func TestOIDCIdPPublicEndpoints(t *testing.T) {
 func TestThumbprint(t *testing.T) {
 	ctx := context.Background()
 
-	// Proxy starts with self-signed certificates.
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
-	env := newWebPack(t, 1)
+	env := newWebPack(t, 1, withInsecureMode())
 	proxy := env.proxies[0]
 
 	// Request OpenID Configuration public endpoint.

tool/teleport/common/integration_configure.go

@@ -33,7 +33,6 @@ import (
 	"github.com/gravitational/trace"
 
 	ecatypes "github.com/gravitational/teleport/api/types/externalauditstorage"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
 	"github.com/gravitational/teleport/lib/integrations/awsra"
@@ -126,9 +125,6 @@ func onIntegrationConfEKSIAM(ctx context.Context, params config.IntegrationConfE
 }
 
 func onIntegrationConfAWSOIDCIdP(ctx context.Context, clf config.CommandLineFlags) error {
-	// pass the value of --insecure flag to the runtime
-	lib.SetInsecureDevMode(clf.InsecureMode)
-
 	// Ensure we print output to the user. LogLevel at this point was set to Error.
 	utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo)
 
@@ -144,6 +140,7 @@ func onIntegrationConfAWSOIDCIdP(ctx context.Context, clf config.CommandLineFlag
 		ProxyPublicAddress:      clf.IntegrationConfAWSOIDCIdPArguments.ProxyPublicURL,
 		IntegrationPolicyPreset: awsoidc.PolicyPreset(clf.IntegrationConfAWSOIDCIdPArguments.PolicyPreset),
 		AutoConfirm:             clf.IntegrationConfAWSOIDCIdPArguments.AutoConfirm,
+		Insecure:                clf.InsecureMode,
 	}
 	return trace.Wrap(awsoidc.ConfigureIdPIAM(ctx, iamClient, confReq))
 }
@@ -294,9 +291,6 @@ func onIntegrationConfSAMLIdPGCPWorkforce(ctx context.Context, params samlidpcon
 }
 
 func onIntegrationConfAWSRATrustAnchor(ctx context.Context, clf config.CommandLineFlags) error {
-	// pass the value of --insecure flag to the runtime
-	lib.SetInsecureDevMode(clf.InsecureMode)
-
 	// Ensure we print output to the user. LogLevel at this point was set to Error.
 	utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo)
 

tool/tsh/common/access_request_test.go

@@ -30,7 +30,6 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/modules"
 	"github.com/gravitational/teleport/lib/modules/modulestest"
@@ -48,8 +47,6 @@ func TestAccessRequestSearch(t *testing.T) {
 		},
 	},
 	)
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
 	ctx := context.Background()
 	const (
 		rootClusterName = "root-cluster"
@@ -59,6 +56,7 @@ func TestAccessRequestSearch(t *testing.T) {
 	)
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.ClusterName.SetClusterName(rootClusterName)
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Kube.Enabled = true
@@ -69,6 +67,7 @@ func TestAccessRequestSearch(t *testing.T) {
 		withLeafCluster(),
 		withLeafConfigFunc(
 			func(cfg *servicecfg.Config) {
+				cfg.InsecureMode = true
 				cfg.Auth.ClusterName.SetClusterName(leafClusterName)
 				cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 				cfg.Kube.Enabled = true

tool/tsh/common/app_aws_test.go

@@ -35,7 +35,6 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/integrations/awsra/createsession"
 	"github.com/gravitational/teleport/lib/service"
@@ -448,6 +447,7 @@ func TestAWSConsoleLogins(t *testing.T) {
 		testserver.WithClusterName("root"),
 		testserver.WithBootstrap(connector, user, rootAWSRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps.Enabled = true
 			cfg.Apps.Apps = []servicecfg.App{
@@ -477,6 +477,7 @@ func TestAWSConsoleLogins(t *testing.T) {
 		testserver.WithClusterName("leaf"),
 		testserver.WithBootstrap(leafAWSRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps.Enabled = true
 			cfg.Apps.Apps = []servicecfg.App{
@@ -552,11 +553,6 @@ func makeUserWithAWSRole(t *testing.T) (types.User, types.Role) {
 }
 
 func SetupTrustedCluster(ctx context.Context, t *testing.T, rootServer, leafServer *service.TeleportProcess, additionalRoleMappings ...types.RoleMapping) {
-	// Use insecure mode so that the trusted cluster can establish trust over reverse tunnel.
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(isInsecure) })
-
 	rootProxyAddr, err := rootServer.ProxyWebAddr()
 	require.NoError(t, err)
 	rootProxyTunnelAddr, err := rootServer.ProxyTunnelAddr()

tool/tsh/common/app_azure_test.go

@@ -34,7 +34,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/services"
@@ -43,7 +42,6 @@ import (
 )
 
 func TestAzure(t *testing.T) {
-	lib.SetInsecureDevMode(true)
 	tmpHomePath := t.TempDir()
 
 	connector := mockConnector(t)
@@ -54,6 +52,7 @@ func TestAzure(t *testing.T) {
 		testserver.WithClusterName("localhost"),
 		testserver.WithBootstrap(connector, user, azureRole),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps.Enabled = true
 			cfg.Apps.Apps = []servicecfg.App{

tool/tsh/common/app_test.go

@@ -114,6 +114,7 @@ func TestAppCommands(t *testing.T) {
 		testserver.WithTestApp("rootapp", rootApp.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.InsecureMode = true
 		}),
 	}
 	rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
@@ -141,6 +142,7 @@ func TestAppCommands(t *testing.T) {
 		testserver.WithTestApp("leafapp", leafApp.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.InsecureMode = true
 		}),
 	}
 	leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...)

tool/tsh/common/db_test.go

@@ -43,7 +43,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/cryptosuites"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -102,16 +101,6 @@ func TestTshDB(t *testing.T) {
 		defaults.ResyncInterval = oldResyncInterval
 	})
 
-	// Proxy uses self-signed certificates in tests.
-	originalValue := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	// To detect tests that run in parallel incorrectly, call t.Setenv with a
-	// dummy env var - that function detects tests with parallel ancestors
-	// and panics, preventing improper use of this helper.
-	t.Setenv("WithInsecureDevMode", "1")
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(originalValue)
-	})
 	t.Run("Login", testDatabaseLogin)
 	t.Run("List", testListDatabase)
 	t.Run("DatabaseSelection", testDatabaseSelection)
@@ -161,6 +150,7 @@ func testDatabaseLogin(t *testing.T) {
 	alice.SetRoles([]string{"dev-access", "autouser", "access-requestor"})
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.BootstrapResources = append(
 				cfg.Auth.BootstrapResources,
 				autoUserRole,
@@ -708,6 +698,7 @@ func testListDatabase(t *testing.T) {
 	fullName := "root-postgres-rds-us-west-1-123456789012"
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Databases.Enabled = true
@@ -731,6 +722,7 @@ func testListDatabase(t *testing.T) {
 		withLeafCluster(),
 		withLeafConfigFunc(func(cfg *servicecfg.Config) {
 			cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond
+			cfg.InsecureMode = true
 			cfg.SSH.Enabled = false
 			cfg.Databases.Enabled = true
 			cfg.Databases.Databases = []servicecfg.Database{{
@@ -1601,6 +1593,7 @@ func testDatabaseSelection(t *testing.T) {
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
 			cfg.Auth.BootstrapResources = append(cfg.Auth.BootstrapResources, alice)
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Databases.Enabled = true
 			cfg.SSH.Enabled = false

tool/tsh/common/hardware_key_test.go

@@ -45,7 +45,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/keys"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -560,12 +559,6 @@ func TestHardwareKeyApp(t *testing.T) {
 		defaults.ResyncInterval = oldResyncInterval
 	})
 
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(isInsecure)
-	})
-
 	accessUser, err := types.NewUser("access")
 	require.NoError(t, err)
 	accessUser.SetRoles([]string{"access"})
@@ -580,6 +573,7 @@ func TestHardwareKeyApp(t *testing.T) {
 		testserver.WithClusterName("root"),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.InsecureMode = true
 			cfg.Apps = servicecfg.AppsConfig{
 				Enabled: true,
 				Apps: []servicecfg.App{{

tool/tsh/common/kube_test.go

@@ -47,7 +47,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keypaths"
 	"github.com/gravitational/teleport/entitlements"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/kube/kubeconfig"
@@ -61,9 +60,6 @@ import (
 )
 
 func TestKube(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
-
 	pack := setupKubeTestPack(t, true)
 	t.Run("list kube", pack.testListKube)
 	t.Run("proxy kube", pack.testProxyKube)
@@ -71,9 +67,6 @@ func TestKube(t *testing.T) {
 }
 
 func TestKubeLogin(t *testing.T) {
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
-
 	testKubeLogin := func(t *testing.T, kubeCluster string, expectedAddr string) {
 		// Set default kubeconfig to a non-exist file to avoid loading other things.
 		t.Setenv("KUBECONFIG", filepath.Join(os.Getenv(types.HomeEnvVar), uuid.NewString()))
@@ -147,6 +140,7 @@ func setupKubeTestPack(t *testing.T, withMultiplexMode bool) *kubeTestPack {
 			if withMultiplexMode {
 				cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			}
+			cfg.InsecureMode = true
 			cfg.Kube.Enabled = true
 			cfg.Kube.ListenAddr = utils.MustParseAddr(localListenerAddr())
 			cfg.Kube.KubeconfigPath = newKubeConfigFile(t, rootKubeCluster1, rootKubeCluster2)
@@ -161,6 +155,7 @@ func setupKubeTestPack(t *testing.T, withMultiplexMode bool) *kubeTestPack {
 				if withMultiplexMode {
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 				}
+				cfg.InsecureMode = true
 				cfg.Kube.Enabled = true
 				cfg.Kube.ListenAddr = utils.MustParseAddr(localListenerAddr())
 				cfg.Kube.KubeconfigPath = newKubeConfigFile(t, leafKubeCluster)
@@ -335,15 +330,6 @@ func TestKubeSelection(t *testing.T) {
 			},
 		},
 	)
-	originalValue := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	// To detect tests that run in parallel incorrectly, call t.Setenv with a
-	// dummy env var - that function detects tests with parallel ancestors
-	// and panics, preventing improper use of this helper.
-	t.Setenv("WithInsecureDevMode", "1")
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(originalValue)
-	})
 
 	oldResyncInterval := defaults.ResyncInterval
 	defaults.ResyncInterval = 100 * time.Millisecond
@@ -380,6 +366,7 @@ func TestKubeSelection(t *testing.T) {
 	t.Cleanup(cancel)
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			// reconfig the user to use the new role instead of the default ones
 			// User is the second bootstrap resource.
 			user, ok := cfg.Auth.BootstrapResources[1].(types.User)

tool/tsh/common/proxy_test.go

@@ -55,7 +55,6 @@ import (
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/utils/keys"
 	"github.com/gravitational/teleport/api/utils/retryutils"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -81,10 +80,6 @@ func TestSSH(t *testing.T) {
 		t.Skip("the current platform doesn't support adding CAs to the system pool")
 	}
 
-	t.Setenv("_TELEPORT_TEST_NO_PARALLEL", "1")
-	defer lib.SetInsecureDevMode(lib.IsInsecureDevMode())
-	lib.SetInsecureDevMode(false)
-
 	d := t.TempDir()
 	webCertPath := filepath.Join(d, "cert.pem")
 	webKeyPath := filepath.Join(d, "key.pem")
@@ -107,9 +102,6 @@ func TestSSH(t *testing.T) {
 		}),
 	)
 
-	// just in case someone changes newTestSuite
-	require.False(t, lib.IsInsecureDevMode())
-
 	tests := []struct {
 		name string
 		fn   func(t *testing.T, s *suite)
@@ -625,13 +617,12 @@ func TestProxySSHJumpHost(t *testing.T) {
 					testserver.WithBootstrap(connector, accessUser),
 					testserver.WithHostname("node01"),
 					testserver.WithClusterName("root"),
-					testserver.WithAuthConfig(
-						func(cfg *servicecfg.AuthConfig) {
-							cfg.NetworkingConfig.SetProxyListenerMode(rootListenerMode)
-							// Load all CAs on login so that leaf CA is trusted by clients.
-							cfg.LoadAllCAs = true
-						},
-					),
+					testserver.WithConfig(func(cfg *servicecfg.Config) {
+						cfg.Auth.NetworkingConfig.SetProxyListenerMode(rootListenerMode)
+						// Load all CAs on login so that leaf CA is trusted by clients.
+						cfg.Auth.LoadAllCAs = true
+						cfg.InsecureMode = true
+					}),
 				}
 				rootServer, err := testserver.NewTeleportProcess(t.TempDir(), rootServerOpts...)
 				require.NoError(t, err)
@@ -644,11 +635,10 @@ func TestProxySSHJumpHost(t *testing.T) {
 					testserver.WithBootstrap(accessUser),
 					testserver.WithHostname("node02"),
 					testserver.WithClusterName("leaf"),
-					testserver.WithAuthConfig(
-						func(cfg *servicecfg.AuthConfig) {
-							cfg.NetworkingConfig.SetProxyListenerMode(leafListenerMode)
-						},
-					),
+					testserver.WithConfig(func(cfg *servicecfg.Config) {
+						cfg.Auth.NetworkingConfig.SetProxyListenerMode(leafListenerMode)
+						cfg.InsecureMode = true
+					}),
 				}
 				leafServer, err := testserver.NewTeleportProcess(t.TempDir(), leafServerOpts...)
 				require.NoError(t, err)
@@ -711,9 +701,6 @@ func TestTSHProxyTemplate(t *testing.T) {
 		t.Skip("Skipping test, no ssh binary found.")
 	}
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	tshPath, err := os.Executable()
 	require.NoError(t, err)
 
@@ -754,9 +741,6 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 		t.Skip("Skipping no external SSH binary found.")
 	}
 
-	lib.SetInsecureDevMode(true)
-	defer lib.SetInsecureDevMode(false)
-
 	tests := []struct {
 		name string
 		opts []testSuiteOptionFunc
@@ -765,6 +749,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 			name: "node recording mode with TLS routing enabled",
 			opts: []testSuiteOptionFunc{
 				withRootConfigFunc(func(cfg *servicecfg.Config) {
+					cfg.InsecureMode = true
 					cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync)
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 				}),
@@ -774,6 +759,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 			name: "proxy recording mode with TLS routing enabled",
 			opts: []testSuiteOptionFunc{
 				withRootConfigFunc(func(cfg *servicecfg.Config) {
+					cfg.InsecureMode = true
 					cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync)
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 				}),
@@ -785,6 +771,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 			name: "proxy recording mode with TLS routing enabled legacy",
 			opts: []testSuiteOptionFunc{
 				withRootConfigFunc(func(cfg *servicecfg.Config) {
+					cfg.InsecureMode = true
 					cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync)
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 					cfg.Auth.Preference.SetSignatureAlgorithmSuite(types.SignatureAlgorithmSuite_SIGNATURE_ALGORITHM_SUITE_LEGACY)
@@ -795,6 +782,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 			name: "node recording mode with TLS routing disabled",
 			opts: []testSuiteOptionFunc{
 				withRootConfigFunc(func(cfg *servicecfg.Config) {
+					cfg.InsecureMode = true
 					cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtNodeSync)
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Separate)
 				}),
@@ -804,6 +792,7 @@ func TestTSHConfigConnectWithOpenSSHClient(t *testing.T) {
 			name: "proxy recording mode with TLS routing disabled",
 			opts: []testSuiteOptionFunc{
 				withRootConfigFunc(func(cfg *servicecfg.Config) {
+					cfg.InsecureMode = true
 					cfg.Auth.SessionRecordingConfig.SetMode(types.RecordAtProxySync)
 					cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Separate)
 				}),
@@ -895,20 +884,16 @@ func TestEnvVarCommand(t *testing.T) {
 
 // TestList verifies "tsh ls" functionality
 func TestList(t *testing.T) {
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(isInsecure)
-	})
-
 	s := newTestSuite(t,
 		withRootConfigFunc(func(cfg *servicecfg.Config) {
 			cfg.Version = defaults.TeleportConfigVersionV2
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		}),
 		withLeafCluster(),
 		withLeafConfigFunc(func(cfg *servicecfg.Config) {
 			cfg.Version = defaults.TeleportConfigVersionV2
+			cfg.InsecureMode = true
 		}),
 	)
 	rootNodeAddress, err := s.root.NodeSSHAddr()
@@ -1468,8 +1453,6 @@ func TestCheckProxyAWSFormatCompatibility(t *testing.T) {
 // correctly given a Machine ID-style identity with a valid RouteToApp.
 func TestProxyAppWithIdentity(t *testing.T) {
 	disableAgent(t)
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
 	ctx := context.Background()
 
 	const (
@@ -1485,6 +1468,7 @@ func TestProxyAppWithIdentity(t *testing.T) {
 		testserver.WithClusterName(clusterName),
 		testserver.WithTestApp(appName, appServer.URL),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 		}),
 	}
@@ -1607,9 +1591,6 @@ func TestProxyAppWithIdentity(t *testing.T) {
 
 func TestProxyAppMultiPort(t *testing.T) {
 	disableAgent(t)
-	// Necessary for self-signed certs to be considered valid.
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() { lib.SetInsecureDevMode(false) })
 	ctx := context.Background()
 
 	const (
@@ -1633,6 +1614,7 @@ func TestProxyAppMultiPort(t *testing.T) {
 		testserver.WithBootstrap(connector, user),
 		testserver.WithClusterName(clusterName),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
 			cfg.Apps = servicecfg.AppsConfig{
 				Enabled: true,

tool/tsh/common/tsh_helper_test.go

@@ -97,6 +97,7 @@ func (s *suite) setupRootCluster(t *testing.T, options testSuiteOptions) {
 	}
 
 	cfg := servicecfg.MakeDefaultConfig()
+	cfg.InsecureMode = true
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.Logger = logtest.NewLogger()
 	err := config.ApplyFileConfig(fileConfig, cfg)
@@ -196,6 +197,7 @@ func (s *suite) setupLeafCluster(t *testing.T, options testSuiteOptions) {
 	}
 
 	cfg := servicecfg.MakeDefaultConfig()
+	cfg.InsecureMode = true
 	cfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
 	cfg.Logger = logtest.NewLogger()
 	err := config.ApplyFileConfig(fileConfig, cfg)

tool/tsh/common/tsh_test.go

@@ -75,7 +75,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/entitlements"
 	"github.com/gravitational/teleport/integration/kube"
-	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/auth/mocku2f"
@@ -1259,12 +1258,6 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 
 	ctx := t.Context()
 
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(isInsecure)
-	})
-
 	origin := func(cluster string) string {
 		return fmt.Sprintf("https://%s", cluster)
 	}
@@ -1313,7 +1306,12 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 	require.NoError(t, err)
 	device.SetPasswordless()
 
-	rootAuth, rootProxy := makeTestServers(t, withBootstrap(connector, alice, bob, noAccessRole, sshLoginRole, perSessionMFARole))
+	rootAuth, rootProxy := makeTestServers(t,
+		withBootstrap(connector, alice, bob, noAccessRole, sshLoginRole, perSessionMFARole),
+		withConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
+		}),
+	)
 
 	rootAuthAddr, err := rootAuth.AuthAddr()
 	require.NoError(t, err)
@@ -1346,7 +1344,13 @@ func TestSSHOnMultipleNodes(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	leafAuth, leafProxy := makeTestServers(t, withClusterName(t, "leafcluster"), withBootstrap(connector, alice, sshLoginRole, perSessionMFARole))
+	leafAuth, leafProxy := makeTestServers(t,
+		withClusterName(t, "leafcluster"),
+		withBootstrap(connector, alice, sshLoginRole, perSessionMFARole),
+		withConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
+		}),
+	)
 	tryCreateTrustedCluster(t, leafAuth.GetAuthServer(), trustedCluster)
 
 	leafAuthAddr, err := leafAuth.AuthAddr()
@@ -2434,12 +2438,6 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(isInsecure)
-	})
-
 	requester, err := types.NewRole("requester", types.RoleSpecV6{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
@@ -2457,6 +2455,9 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 
 	rootAuth, rootProxy := makeTestServers(t,
 		withBootstrap(requester, connector, alice),
+		withConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
+		}),
 	)
 
 	rootAuthServer := rootAuth.GetAuthServer()
@@ -2481,7 +2482,12 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	leafAuth, _ := makeTestServers(t, withClusterName(t, "leafcluster"))
+	leafAuth, _ := makeTestServers(t,
+		withClusterName(t, "leafcluster"),
+		withConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
+		}),
+	)
 	tryCreateTrustedCluster(t, leafAuth.GetAuthServer(), trustedCluster)
 
 	err = Run(ctx, []string{
@@ -5940,13 +5946,6 @@ func TestMakeProfileInfo_NoInternalLogins(t *testing.T) {
 }
 
 func TestBenchmarkPostgres(t *testing.T) {
-	// Set insecure mode to allow db agent to establish reverse tunnel.
-	isInsecure := lib.IsInsecureDevMode()
-	lib.SetInsecureDevMode(true)
-	t.Cleanup(func() {
-		lib.SetInsecureDevMode(isInsecure)
-	})
-
 	// Canceling the context right after the test ensures the local proxy
 	// started by the benchmark command is closed and the remaining connections
 	// (if any) are dropped.
@@ -5965,6 +5964,7 @@ func TestBenchmarkPostgres(t *testing.T) {
 		testserver.WithBootstrap(connector, alice),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+			cfg.InsecureMode = true
 			cfg.Databases.Enabled = true
 			cfg.Databases.Databases = []servicecfg.Database{
 				{
@@ -6451,6 +6451,7 @@ func TestListingResourcesAcrossClusters(t *testing.T) {
 		testserver.WithDebugApp(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
 			// Enable DB
+			cfg.InsecureMode = true
 			cfg.Databases.Enabled = true
 			cfg.Databases.Databases = []servicecfg.Database{
 				{
@@ -6474,6 +6475,7 @@ func TestListingResourcesAcrossClusters(t *testing.T) {
 		testserver.WithClusterName("leaf"),
 		testserver.WithDebugApp(),
 		testserver.WithConfig(func(cfg *servicecfg.Config) {
+			cfg.InsecureMode = true
 			// Enable DB
 			cfg.Databases.Enabled = true
 			cfg.Databases.Databases = []servicecfg.Database{