Skip to content

feat(urllib3): add proxy_ssl_context patch for the sync Python client - #308

Open
emmanuel-adu wants to merge 1 commit into
kubernetes-client:masterfrom
emmanuel-adu:feat/proxy-ssl-context-urllib3
Open

feat(urllib3): add proxy_ssl_context patch for the sync Python client#308
emmanuel-adu wants to merge 1 commit into
kubernetes-client:masterfrom
emmanuel-adu:feat/proxy-ssl-context-urllib3

Conversation

@emmanuel-adu

@emmanuel-adu emmanuel-adu commented Jul 30, 2026

Copy link
Copy Markdown

Fixes #307. Related: kubernetes-client/python#2387.

kubernetes-client/python#2387 wants a way to give the HTTPS proxy its own SSL context, separate from the destination TLS settings - urllib3's ProxyManager already supports this via proxy_ssl_context, but the generated client doesn't expose it.

Adds an elif args.library == "urllib3": branch to postprocess_python.py (parallel to the existing asyncio one), following the same pattern already used for tls_server_name/disable_strict_ssl_verification:

  • configuration.py: adds proxy_ssl_context: Optional[ssl.SSLContext] = None, stored and documented like proxy_headers.
  • rest.py: passes it to urllib3.ProxyManager via pool_args["proxy_ssl_context"] when set (non-SOCKS branch).

Verification: Ran postprocess_python.py against real copies of the generated configuration.py/rest.py (library=urllib3) - patch applies cleanly, output parses as valid Python, diff matches intent exactly. Also built an end-to-end reproduction (mock HTTPS proxy + destination server, independent self-signed CAs): fails with CERTIFICATE_VERIFY_FAILED without the fix, succeeds with it. See companion PR kubernetes-client/python#2658 for the applied result and full test.

test report: both scenarios passing, with captured CERTIFICATE_VERIFY_FAILED log for the without-fix case

Mirrors the existing asyncio-branch patches (tls_server_name,
disable_strict_ssl_verification) with a urllib3-branch equivalent:
Configuration gains a proxy_ssl_context parameter, and RESTClientObject
passes it through to urllib3.ProxyManager when set, so proxy TLS
verification no longer has to share the destination's TLS settings.

Verified by running postprocess_python.py against real copies of the
generated configuration.py/rest.py with library=urllib3: the patch
applies cleanly and the resulting files remain valid Python.

Fixes kubernetes-client#307
Related: kubernetes-client/python#2387
@kubernetes-prow

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: emmanuel-adu
Once this PR has been reviewed and has the lgtm label, please assign yue9944882 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 30, 2026
@kubernetes-prow

Copy link
Copy Markdown

Welcome @emmanuel-adu!

It looks like this is your first PR to kubernetes-client/gen 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/gen has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@kubernetes-prow kubernetes-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 30, 2026
@emmanuel-adu

Copy link
Copy Markdown
Author

/kind feature

@kubernetes-prow kubernetes-prow Bot added the kind/feature Categorizes issue or PR as related to a new feature. label Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add proxy_ssl_context support for the sync (urllib3) Python client

1 participant