CWE-295: TLS verification disabled — backup/pbm.go hardcodes insecure TLS with K8s Secret credentials

[LeoWSY-hashblue]

Summary

pkg/psmdb/backup/pbm.go hardcodes TLS certificate verification disabled for PBM (Percona Backup for MongoDB) connections. K8s Secrets credentials (MongoDB password) are transmitted over connections that accept any self-signed certificate.

Impact

MongoDB backup credentials from K8s Secrets exposed to MITM. Backup data and database credentials can be intercepted.

Remediation

Enable TLS verification by default, require explicit opt-out or CA configuration.

[egegunes]

I created https://perconadev.atlassian.net/browse/K8SPSMDB-1702 to fix this.