Description
What happened (please include outputs or screenshots):
Tried to connect to my cluster with a utility that uses your library. As far as I can tell, the utility's code is correct and the k8s-client python code does not honor the tls-server-name and propagate it down the stack to urllib3.
Received this exception:
Traceback (most recent call last):
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.
py", line 703, in urlopen
httplib_response = self._make_request(
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.
py", line 386, in _make_request
self._validate_conn(conn)
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.
py", line 1042, in _validate_conn
conn.connect()
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connection.py",
line 467, in connect
_match_hostname(cert, self.assert_hostname or server_hostname)
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connection.py",
line 540, in _match_hostname
match_hostname(cert, asserted_hostname)
File "/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/util/ssl_match_
hostname.py", line 150, in match_hostname
raise CertificateError(
urllib3.util.ssl_match_hostname.CertificateError: hostname 'CNAME-THAT-I-USE' doesn
't match either of 'LIST', 'OF', 'OTHER', 'NAMES'
This is explicitly why I set tls-server-name in my kubeconfig.
What you expected to happen:
TLS connection to my cluster, with the proper SNI sent.
How to reproduce it (as minimally and precisely as possible):
Set your cluster.server property to some IP/CNAME not in the cert. Set tls-server-name in kubeconfig correctly.
Anything else we need to know?:
Looks like it is pretty easy to support. Just need to change https://github.com/kubernetes-client/python/blob/master/kubernetes/base/config/kube_config.py#L544 to read the tls-server-name, and make sure that gets propagated to https://github.com/kubernetes-client/python/blob/master/kubernetes/client/rest.py#L73 as assert_hostname