Read proxy-url from kubeconfig cluster - #2680
Conversation
|
|
|
Welcome @yurnov! |
load_kube_config() ignored the cluster's proxy-url field, so Configuration.proxy stayed unset and requests bypassed the proxy. The async loader already handles it.
7fb3581 to
e192676
Compare
|
/pony |
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Ready for review. The GitHub Actions runs are sitting at |
|
thanks for the PR |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: yliaog, yurnov The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
9c3456a
into
kubernetes-client:master
|
@yliaog @roycaihw a question on release mechanics rather than the change itself: does this ride into a 36.0.x patch automatically, or should I open something against My reading is that nothing is needed — Happy to open a cherry-pick against |
What type of PR is this?
/kind bug
/kind feature
What this PR does / why we need it:
load_kube_config()ignored theproxy-urlfield of a kubeconfigclusterentry, so
Configuration.proxystayedNoneand requests went direct,bypassing the configured proxy. There was no warning — the field was parsed
and dropped.
Two changes in
kubernetes/base/config/kube_config.py:_load_cluster_info()readsproxy-urlintoself.proxy_set_config()copiesproxyto the client configurationThis mirrors
kubernetes/aio/config/kube_config.py, which already does both,and brings the sync client in line with
kubectl/client-go.The
keyslist in_set_config()is wrapped across two lines; it was 94characters and missing a space after
'verify_ssl',.Which issue(s) this PR fixes:
Fixes #2679
Special notes for your reviewer:
Scope was agreed with @yliaog in #2679: loader only, no generated files
touched. The
HTTPS_PROXY/HTTP_PROXYproblem described in that issue isdeliberately left out, since it would land in the generated
kubernetes/client/configuration.py— happy to file it separately.Tests are ported from the existing async suite:
test_proxy_url_from_cluster— loader level, mirrors the async test of thesame name
test_new_client_from_config_proxy— through the public entry pointBoth fail without the change (verified by reverting
kube_config.pyalone andre-running); the full sync config suite is 77 passed.
Also verified end to end against a kind cluster whose API server was reachable
only through a proxy: the control-plane container's DNS name is not resolvable
from the host, and kubeadm already puts that name in the apiserver cert SANs,
so TLS validates normally without
insecure-skip-tls-verify. Before thechange the call failed with a name-resolution error and
Configuration.proxywas
None; after it,proxyis set, the request succeeds, and the proxy logsCONNECT proxytest-control-plane:6443.Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: