feat(urllib3): add proxy_ssl_context patch for the sync Python client - #308
feat(urllib3): add proxy_ssl_context patch for the sync Python client#308emmanuel-adu wants to merge 1 commit into
Conversation
Mirrors the existing asyncio-branch patches (tls_server_name, disable_strict_ssl_verification) with a urllib3-branch equivalent: Configuration gains a proxy_ssl_context parameter, and RESTClientObject passes it through to urllib3.ProxyManager when set, so proxy TLS verification no longer has to share the destination's TLS settings. Verified by running postprocess_python.py against real copies of the generated configuration.py/rest.py with library=urllib3: the patch applies cleanly and the resulting files remain valid Python. Fixes kubernetes-client#307 Related: kubernetes-client/python#2387
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: emmanuel-adu The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @emmanuel-adu! |
|
/kind feature |
Fixes #307. Related: kubernetes-client/python#2387.
kubernetes-client/python#2387wants a way to give the HTTPS proxy its own SSL context, separate from the destination TLS settings - urllib3'sProxyManageralready supports this viaproxy_ssl_context, but the generated client doesn't expose it.Adds an
elif args.library == "urllib3":branch topostprocess_python.py(parallel to the existingasyncioone), following the same pattern already used fortls_server_name/disable_strict_ssl_verification:configuration.py: addsproxy_ssl_context: Optional[ssl.SSLContext] = None, stored and documented likeproxy_headers.rest.py: passes it tourllib3.ProxyManagerviapool_args["proxy_ssl_context"]when set (non-SOCKS branch).Verification: Ran
postprocess_python.pyagainst real copies of the generatedconfiguration.py/rest.py(library=urllib3) - patch applies cleanly, output parses as valid Python, diff matches intent exactly. Also built an end-to-end reproduction (mock HTTPS proxy + destination server, independent self-signed CAs): fails withCERTIFICATE_VERIFY_FAILEDwithout the fix, succeeds with it. See companion PR kubernetes-client/python#2658 for the applied result and full test.