feat(urllib3): add proxy_ssl_context patch for the sync Python client

Closed
EM
3mo ago
+59-0

Fixes #307. Related: kubernetes-client/python#2387.

kubernetes-client/python#2387 wants a way to give the HTTPS proxy its own SSL context, separate from the destination TLS settings - urllib3's ProxyManager already supports this via proxy_ssl_context, but the generated client doesn't expose it.

Adds an elif args.library == "urllib3": branch to postprocess_python.py (parallel to the existing asyncio one), following the same pattern already used for tls_server_name/disable_strict_ssl_verification:

  • configuration.py: adds proxy_ssl_context: Optional[ssl.SSLContext] = None, stored and documented like proxy_headers.
  • rest.py: passes it to urllib3.ProxyManager via pool_args["proxy_ssl_context"] when set (non-SOCKS branch).

Verification: Ran postprocess_python.py against real copies of the generated configuration.py/rest.py (library=urllib3) - patch applies cleanly, output parses as valid Python, diff matches intent exactly. Also built an end-to-end reproduction (mock HTTPS proxy + destination server, independent self-signed CAs): fails with CERTIFICATE_VERIFY_FAILED without the fix, succeeds with it. See companion PR kubernetes-client/python#2658 for the applied result and full test.

test report: both scenarios passing, with captured CERTIFICATE_VERIFY_FAILED log for the without-fix case