Skip to content

feat: add proxy_ssl_context to Configuration for a separate proxy TLS context - #2658

Open
emmanuel-adu wants to merge 1 commit into
kubernetes-client:masterfrom
emmanuel-adu:feat/proxy-ssl-context
Open

feat: add proxy_ssl_context to Configuration for a separate proxy TLS context#2658
emmanuel-adu wants to merge 1 commit into
kubernetes-client:masterfrom
emmanuel-adu:feat/proxy-ssl-context

Conversation

@emmanuel-adu

@emmanuel-adu emmanuel-adu commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Fixes #2387.

Configuration gains proxy_ssl_context: Optional[ssl.SSLContext] = None, passed through to urllib3.ProxyManager in RESTClientObject. This lets the HTTPS proxy's TLS cert be validated independently of the destination (K8s API server) settings - the "HTTPS Proxy + HTTPS Destination" scenario urllib3 already supports natively.

kubernetes/client is generated from kubernetes-client/gen; companion PR kubernetes-client/gen#308 adds the same patch there. This PR applies it to the already-generated files so it's usable now.

Verification: kubernetes/e2e_test/test_issue_2387_proxy_ssl_context.py spins up a mock HTTPS proxy and destination server with independent self-signed CAs (no live cluster needed). Without proxy_ssl_context: fails with CERTIFICATE_VERIFY_FAILED. With it set to trust the proxy's CA: succeeds, destination still validated separately.

test report: both scenarios passing, with captured CERTIFICATE_VERIFY_FAILED log for the without-fix case 
Added `proxy_ssl_context` to `Configuration`, letting users provide a separate SSL context for HTTPS proxy TLS verification, independent of the destination TLS settings.

@kubernetes-prow kubernetes-prow Bot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jul 30, 2026
@kubernetes-prow

kubernetes-prow Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: emmanuel-adu
Once this PR has been reviewed and has the lgtm label, please assign yliaog for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow
kubernetes-prow Bot requested review from roycaihw and yliaog July 30, 2026 00:32
@kubernetes-prow kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jul 30, 2026
@kubernetes-prow

kubernetes-prow Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Welcome @emmanuel-adu!

It looks like this is your first PR to kubernetes-client/python 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/python has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@kubernetes-prow kubernetes-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 30, 2026
@emmanuel-adu
feat: add proxy_ssl_context to Configuration for a separate proxy TLS…
f526d68 
… context

Adds a proxy_ssl_context parameter to Configuration and threads it through
RESTClientObject to urllib3.ProxyManager, so the HTTPS proxy's own TLS
certificate can be validated independently of the destination (Kubernetes
API server) TLS settings - the "HTTPS Proxy + HTTPS Destination" scenario
urllib3 documents at:
https://urllib3.readthedocs.io/en/stable/advanced-usage.html#https-proxy-https-destination

kubernetes/client is generated from kubernetes-client/gen; this applies
the equivalent of the companion gen-repo patch directly to the
already-generated files, so the feature is usable now rather than
waiting on the next full regeneration.

Added an end-to-end test (kubernetes/e2e_test) using a mock HTTPS proxy
and a mock HTTPS destination server, each with an independent self-signed
CA - it doesn't require a live cluster, only openssl on PATH. Verified:
without proxy_ssl_context, connecting through a proxy with a different CA
than the destination fails with CERTIFICATE_VERIFY_FAILED; with it set to
trust the proxy's CA, the connection succeeds and the destination is
still validated against its own separate CA.
@emmanuel-adu
emmanuel-adu force-pushed the feat/proxy-ssl-context branch from 6985e88 to f526d68 Compare July 30, 2026 00:37
@kubernetes-prow kubernetes-prow Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jul 30, 2026
@emmanuel-adu

emmanuel-adu commented Jul 30, 2026

Copy link
Copy Markdown
Author

/kind feature

@kubernetes-prow kubernetes-prow Bot added kind/feature Categorizes issue or PR as related to a new feature. and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jul 30, 2026
roycaihw
roycaihw reviewed Jul 30, 2026
View reviewed changes
Comment thread kubernetes/client/configuration.py


import copy
import ssl

@roycaihw roycaihw Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is generated by upstream openapi-generator. Please send a PR to update the upstream generator to properly support this feature.

@emmanuel-adu emmanuel-adu Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Opened kubernetes-client/gen#308 to add proxy_ssl_context for the sync client, following the existing pattern, and this PR applies that generated change now.

Or are you asking for this to be implemented in OpenAPITools/openapi-generator itself instead?

@emmanuel-adu emmanuel-adu mentioned this pull request Jul 30, 2026
Open
@emmanuel-adu
emmanuel-adu requested a review from roycaihw July 31, 2026 01:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yliaog yliaog Awaiting requested review from yliaog
@roycaihw roycaihw Awaiting requested review from roycaihw

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Proxy SSL Context

2 participants

@emmanuel-adu @roycaihw