From 9f30a42e8049ecfc43c89dd47f0120052dcf9394 Mon Sep 17 00:00:00 2001
From: "cortex-ai-agents[bot]"
 <279748396+cortex-ai-agents[bot]@users.noreply.github.com>
Date: Mon, 8 Jun 2026 07:51:47 +0000
Subject: [PATCH] docs: document insecureSkipTLSVerify option in multicluster
 guide

---
 docs/guides/multicluster/readme.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docs/guides/multicluster/readme.md b/docs/guides/multicluster/readme.md
index ab9c9e60a..4a4a1977a 100644
--- a/docs/guides/multicluster/readme.md
+++ b/docs/guides/multicluster/readme.md
@@ -121,6 +121,27 @@ $(cat /tmp/root-ca-remote-az-b.pem | sed 's/^/          /')
 EOF
 ```
 
+### Skipping TLS verification
+
+If a remote apiserver uses a CA certificate that rotates frequently and does not chain to a stable root, you can set `insecureSkipTLSVerify: true` instead of providing a `caCert`. When enabled, the `caCert` field is ignored and TLS certificate verification is skipped entirely for that remote.
+
+> [!WARNING]
+> Setting `insecureSkipTLSVerify` disables all TLS certificate verification for the connection to that remote apiserver. This makes the connection susceptible to man-in-the-middle attacks. Only use this option when you cannot maintain a stable CA certificate and the network path to the remote apiserver is otherwise secured.
+
+```yaml
+global:
+  conf:
+    apiservers:
+      remotes:
+      - host: https://my-remote-apiserver:6443
+        insecureSkipTLSVerify: true
+        gvks:
+        - kvm.cloud.sap/v1/Hypervisor
+        - kvm.cloud.sap/v1/HypervisorList
+        labels:
+          az: remote-az
+```
+
 Additionally, we will add some hypervisors cortex can reconcile on:
 ```bash
 kubectl --context kind-cortex-remote-az-a apply -f docs/guides/multicluster/hypervisors-az-a.yaml