Skip to content

Commit ac781ab

Browse files
kazkkazk
committed
Remove native-tls feature
Signed-off-by: kazk <[email protected]>
1 parent 3033e0f commit ac781ab

File tree

13 files changed

+11
-215
lines changed

13 files changed

+11
-215
lines changed

‎.github/workflows/ci.yml

-3
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,6 @@ jobs:
5555
run: cargo build -j4 -p kube-examples
5656

5757
# Feature tests
58-
- name: Test kube with features native-tls,ws,oauth
59-
run: cargo test -p kube --lib --no-default-features --features=native-tls,ws,oauth
60-
if: matrix.os == 'ubuntu-latest'
6158
- name: Test kube with features rustls-tls,ws,oauth
6259
run: cargo test -p kube --lib --no-default-features --features=rustls-tls,ws,oauth
6360
if: matrix.os == 'ubuntu-latest'

‎examples/custom_client_tls.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Custom client supporting both native-tls and rustls-tls
1+
// Custom client supporting both openssl-tls and rustls-tls
22
// Must enable `rustls-tls` feature to run this.
33
// Run with `USE_RUSTLS=1` to pick rustls.
44
use k8s_openapi::api::core::v1::Pod;

‎justfile

-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ test:
2121
cargo test --doc --all
2222
cargo test -p kube-examples --examples
2323
cargo test -p kube --lib --no-default-features --features=rustls-tls,ws,oauth
24-
cargo test -p kube --lib --no-default-features --features=native-tls,ws,oauth
2524
cargo test -p kube --lib --no-default-features --features=openssl-tls,ws,oauth
2625
cargo test -p kube --lib --no-default-features
2726

‎kube-client/Cargo.toml

+1-4
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ edition = "2021"
1717

1818
[features]
1919
default = ["client", "openssl-tls"]
20-
native-tls = ["openssl", "hyper-tls", "tokio-native-tls"]
2120
rustls-tls = ["rustls", "rustls-pemfile", "hyper-rustls"]
2221
openssl-tls = ["openssl", "hyper-openssl"]
2322
ws = ["client", "tokio-tungstenite", "rand", "kube-core/ws"]
@@ -32,7 +31,7 @@ config = ["__non_core", "pem", "dirs"]
3231
__non_core = ["tracing", "serde_yaml", "base64"]
3332

3433
[package.metadata.docs.rs]
35-
features = ["client", "native-tls", "rustls-tls", "openssl-tls", "ws", "oauth", "jsonpatch", "admission", "k8s-openapi/v1_25"]
34+
features = ["client", "rustls-tls", "openssl-tls", "ws", "oauth", "jsonpatch", "admission", "k8s-openapi/v1_25"]
3635
# Define the configuration attribute `docsrs`. Used to enable `doc_cfg` feature.
3736
rustdoc-args = ["--cfg", "docsrs"]
3837

@@ -50,7 +49,6 @@ thiserror = "1.0.29"
5049
futures = { version = "0.3.17", optional = true }
5150
pem = { version = "1.0.1", optional = true }
5251
openssl = { version = "0.10.36", optional = true }
53-
tokio-native-tls = { version = "0.3.0", optional = true }
5452
rustls = { version = "0.20.3", features = ["dangerous_configuration"], optional = true }
5553
rustls-pemfile = { version = "1.0.0", optional = true }
5654
bytes = { version = "1.1.0", optional = true }
@@ -59,7 +57,6 @@ kube-core = { path = "../kube-core", version = "=0.75.0" }
5957
jsonpath_lib = { version = "0.3.0", optional = true }
6058
tokio-util = { version = "0.7.0", optional = true, features = ["io", "codec"] }
6159
hyper = { version = "0.14.13", optional = true, features = ["client", "http1", "stream", "tcp"] }
62-
hyper-tls = { version = "0.5.0", optional = true }
6360
hyper-rustls = { version = "0.23.0", optional = true }
6461
tokio-tungstenite = { version = "0.17.1", optional = true }
6562
tower = { version = "0.4.6", optional = true, features = ["buffer", "filter", "util"] }

‎kube-client/src/client/auth/oauth.rs

+4-10
Original file line numberDiff line numberDiff line change
@@ -103,23 +103,17 @@ impl Gcp {
103103
Ok(TokenOrRequest::Request {
104104
request, scope_hash, ..
105105
}) => {
106-
#[cfg(not(any(feature = "native-tls", feature = "rustls-tls", feature = "openssl-tls")))]
106+
#[cfg(not(any(feature = "rustls-tls", feature = "openssl-tls")))]
107107
compile_error!(
108-
"At least one of native-tls or rustls-tls or openssl-tls feature must be enabled to use oauth feature"
108+
"At least one of rustls-tls or openssl-tls feature must be enabled to use oauth feature"
109109
);
110110
// Current TLS feature precedence when more than one are set:
111111
// 1. openssl-tls
112-
// 2. native-tls
113-
// 3. rustls-tls
112+
// 2. rustls-tls
114113
#[cfg(feature = "openssl-tls")]
115114
let https =
116115
hyper_openssl::HttpsConnector::new().map_err(Error::CreateOpensslHttpsConnector)?;
117-
#[cfg(all(not(feature = "openssl-tls"), feature = "native-tls"))]
118-
let https = hyper_tls::HttpsConnector::new();
119-
#[cfg(all(
120-
not(any(feature = "openssl-tls", feature = "native-tls")),
121-
feature = "rustls-tls"
122-
))]
116+
#[cfg(all(not(feature = "openssl-tls"), feature = "rustls-tls"))]
123117
let https = hyper_rustls::HttpsConnectorBuilder::new()
124118
.with_native_roots()
125119
.https_only()

‎kube-client/src/client/builder.rs

+2-11
Original file line numberDiff line numberDiff line change
@@ -79,21 +79,12 @@ impl TryFrom<Config> for ClientBuilder<BoxService<Request<hyper::Body>, Response
7979

8080
// Current TLS feature precedence when more than one are set:
8181
// 1. openssl-tls
82-
// 2. native-tls
83-
// 3. rustls-tls
82+
// 2. rustls-tls
8483
// Create a custom client to use something else.
8584
// If TLS features are not enabled, http connector will be used.
8685
#[cfg(feature = "openssl-tls")]
8786
let connector = config.openssl_https_connector_with_connector(connector)?;
88-
#[cfg(all(not(feature = "openssl-tls"), feature = "native-tls"))]
89-
let connector = hyper_tls::HttpsConnector::from((
90-
connector,
91-
tokio_native_tls::TlsConnector::from(config.native_tls_connector()?),
92-
));
93-
#[cfg(all(
94-
not(any(feature = "openssl-tls", feature = "native-tls")),
95-
feature = "rustls-tls"
96-
))]
87+
#[cfg(all(not(feature = "openssl-tls"), feature = "rustls-tls"))]
9788
let connector = hyper_rustls::HttpsConnector::from((
9889
connector,
9990
std::sync::Arc::new(config.rustls_client_config()?),

‎kube-client/src/client/config_ext.rs

+1-60
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ use http::{header::HeaderName, HeaderValue};
44
use secrecy::ExposeSecret;
55
use tower::{filter::AsyncFilterLayer, util::Either};
66

7-
#[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "openssl-tls"))]
8-
use super::tls;
7+
#[cfg(any(feature = "rustls-tls", feature = "openssl-tls"))] use super::tls;
98
use super::{
109
auth::Auth,
1110
middleware::{AddAuthorizationLayer, AuthLayer, BaseUriLayer, ExtraHeadersLayer},
@@ -27,23 +26,6 @@ pub trait ConfigExt: private::Sealed {
2726
/// Layer to add non-authn HTTP headers depending on the config.
2827
fn extra_headers_layer(&self) -> Result<ExtraHeadersLayer>;
2928

30-
/// Create [`hyper_tls::HttpsConnector`] based on config.
31-
///
32-
/// # Example
33-
///
34-
/// ```rust
35-
/// # async fn doc() -> Result<(), Box<dyn std::error::Error>> {
36-
/// # use kube::{client::ConfigExt, Config};
37-
/// let config = Config::infer().await?;
38-
/// let https = config.native_tls_https_connector()?;
39-
/// let hyper_client: hyper::Client<_, hyper::Body> = hyper::Client::builder().build(https);
40-
/// # Ok(())
41-
/// # }
42-
/// ```
43-
#[cfg_attr(docsrs, doc(cfg(feature = "native-tls")))]
44-
#[cfg(feature = "native-tls")]
45-
fn native_tls_https_connector(&self) -> Result<hyper_tls::HttpsConnector<hyper::client::HttpConnector>>;
46-
4729
/// Create [`hyper_rustls::HttpsConnector`] based on config.
4830
///
4931
/// # Example
@@ -61,29 +43,6 @@ pub trait ConfigExt: private::Sealed {
6143
#[cfg(feature = "rustls-tls")]
6244
fn rustls_https_connector(&self) -> Result<hyper_rustls::HttpsConnector<hyper::client::HttpConnector>>;
6345

64-
/// Create [`native_tls::TlsConnector`](tokio_native_tls::native_tls::TlsConnector) based on config.
65-
/// # Example
66-
///
67-
/// ```rust
68-
/// # async fn doc() -> Result<(), Box<dyn std::error::Error>> {
69-
/// # use hyper::client::HttpConnector;
70-
/// # use kube::{client::ConfigExt, Client, Config};
71-
/// let config = Config::infer().await?;
72-
/// let https = {
73-
/// let tls = tokio_native_tls::TlsConnector::from(
74-
/// config.native_tls_connector()?
75-
/// );
76-
/// let mut http = HttpConnector::new();
77-
/// http.enforce_http(false);
78-
/// hyper_tls::HttpsConnector::from((http, tls))
79-
/// };
80-
/// # Ok(())
81-
/// # }
82-
/// ```
83-
#[cfg_attr(docsrs, doc(cfg(feature = "native-tls")))]
84-
#[cfg(feature = "native-tls")]
85-
fn native_tls_connector(&self) -> Result<tokio_native_tls::native_tls::TlsConnector>;
86-
8746
/// Create [`rustls::ClientConfig`] based on config.
8847
/// # Example
8948
///
@@ -213,24 +172,6 @@ impl ConfigExt for Config {
213172
})
214173
}
215174

216-
#[cfg(feature = "native-tls")]
217-
fn native_tls_connector(&self) -> Result<tokio_native_tls::native_tls::TlsConnector> {
218-
tls::native_tls::native_tls_connector(
219-
self.identity_pem().as_ref(),
220-
self.root_cert.as_ref(),
221-
self.accept_invalid_certs,
222-
)
223-
.map_err(Error::NativeTls)
224-
}
225-
226-
#[cfg(feature = "native-tls")]
227-
fn native_tls_https_connector(&self) -> Result<hyper_tls::HttpsConnector<hyper::client::HttpConnector>> {
228-
let tls = tokio_native_tls::TlsConnector::from(self.native_tls_connector()?);
229-
let mut http = hyper::client::HttpConnector::new();
230-
http.enforce_http(false);
231-
Ok(hyper_tls::HttpsConnector::from((http, tls)))
232-
}
233-
234175
#[cfg(feature = "rustls-tls")]
235176
fn rustls_client_config(&self) -> Result<rustls::ClientConfig> {
236177
tls::rustls_tls::rustls_client_config(

‎kube-client/src/client/mod.rs

+1-3
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,8 @@ mod config_ext;
3636
pub use auth::Error as AuthError;
3737
pub use config_ext::ConfigExt;
3838
pub mod middleware;
39-
#[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "openssl-tls"))]
40-
mod tls;
39+
#[cfg(any(feature = "rustls-tls", feature = "openssl-tls"))] mod tls;
4140

42-
#[cfg(feature = "native-tls")] pub use tls::native_tls::Error as NativeTlsError;
4341
#[cfg(feature = "openssl-tls")]
4442
pub use tls::openssl_tls::Error as OpensslTlsError;
4543
#[cfg(feature = "rustls-tls")] pub use tls::rustls_tls::Error as RustlsTlsError;

‎kube-client/src/client/tls.rs

-80
Original file line numberDiff line numberDiff line change
@@ -1,83 +1,3 @@
1-
#[cfg(feature = "native-tls")]
2-
pub mod native_tls {
3-
use thiserror::Error;
4-
use tokio_native_tls::native_tls::{Certificate, Identity, TlsConnector};
5-
6-
const IDENTITY_PASSWORD: &str = " ";
7-
8-
/// Errors from native TLS
9-
#[derive(Debug, Error)]
10-
pub enum Error {
11-
/// Failed to deserialize PEM-encoded X509 certificate
12-
#[error("failed to deserialize PEM-encoded X509 certificate: {0}")]
13-
DeserializeCertificate(#[source] openssl::error::ErrorStack),
14-
15-
/// Failed to deserialize PEM-encoded private key
16-
#[error("failed to deserialize PEM-encoded private key: {0}")]
17-
DeserializePrivateKey(#[source] openssl::error::ErrorStack),
18-
19-
/// Failed to create PKCS #12 archive
20-
#[error("failed to create PKCS #12 archive: {0}")]
21-
CreatePkcs12(#[source] openssl::error::ErrorStack),
22-
23-
/// Failed to serialize PKCS #12 archive to DER
24-
#[error("failed to serialize PKCS #12 archive to DER encoding: {0}")]
25-
SerializePkcs12(#[source] openssl::error::ErrorStack),
26-
27-
/// Failed to deserialize DER-encoded PKCS #12 archive
28-
#[error("failed to deserialize DER-encoded PKCS #12 archive: {0}")]
29-
DeserializePkcs12(#[source] tokio_native_tls::native_tls::Error),
30-
31-
/// Failed to deserialize DER-encoded X509 certificate
32-
#[error("failed to deserialize DER-encoded X509 certificate: {0}")]
33-
DeserializeRootCertificate(#[source] tokio_native_tls::native_tls::Error),
34-
35-
/// Failed to create `TlsConnector`
36-
#[error("failed to create `TlsConnector`: {0}")]
37-
CreateTlsConnector(#[source] tokio_native_tls::native_tls::Error),
38-
}
39-
40-
/// Create `native_tls::TlsConnector`.
41-
pub fn native_tls_connector(
42-
identity_pem: Option<&Vec<u8>>,
43-
root_cert: Option<&Vec<Vec<u8>>>,
44-
accept_invalid: bool,
45-
) -> Result<TlsConnector, Error> {
46-
let mut builder = TlsConnector::builder();
47-
if let Some(pem) = identity_pem {
48-
let identity = pkcs12_from_pem(pem, IDENTITY_PASSWORD)?;
49-
builder.identity(
50-
Identity::from_pkcs12(&identity, IDENTITY_PASSWORD).map_err(Error::DeserializePkcs12)?,
51-
);
52-
}
53-
54-
if let Some(ders) = root_cert {
55-
for der in ders {
56-
builder.add_root_certificate(
57-
Certificate::from_der(der).map_err(Error::DeserializeRootCertificate)?,
58-
);
59-
}
60-
}
61-
62-
if accept_invalid {
63-
builder.danger_accept_invalid_certs(true);
64-
}
65-
66-
builder.build().map_err(Error::CreateTlsConnector)
67-
}
68-
69-
// TODO Switch to PKCS8 support when https://github.com/sfackler/rust-native-tls/pull/209 is merged
70-
fn pkcs12_from_pem(pem: &[u8], password: &str) -> Result<Vec<u8>, Error> {
71-
use openssl::{pkcs12::Pkcs12, pkey::PKey, x509::X509};
72-
let x509 = X509::from_pem(pem).map_err(Error::DeserializeCertificate)?;
73-
let pkey = PKey::private_key_from_pem(pem).map_err(Error::DeserializePrivateKey)?;
74-
let p12 = Pkcs12::builder()
75-
.build(password, "kubeconfig", &pkey, &x509)
76-
.map_err(Error::CreatePkcs12)?;
77-
p12.to_der().map_err(Error::SerializePkcs12)
78-
}
79-
}
80-
811
#[cfg(feature = "rustls-tls")]
822
pub mod rustls_tls {
833
use hyper_rustls::ConfigBuilderExt;

‎kube-client/src/config/mod.rs

-19
Original file line numberDiff line numberDiff line change
@@ -312,9 +312,6 @@ impl Config {
312312
let mut root_cert = None;
313313

314314
if let Some(ca_bundle) = loader.ca_bundle()? {
315-
for ca in &ca_bundle {
316-
accept_invalid_certs = hacky_cert_lifetime_for_macos(ca);
317-
}
318315
root_cert = Some(ca_bundle);
319316
}
320317

@@ -396,22 +393,6 @@ const DEFAULT_TIMEOUT: Duration = Duration::from_secs(295);
396393
const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
397394
const DEFAULT_READ_TIMEOUT: Duration = Duration::from_secs(295);
398395

399-
// temporary catalina hack for openssl only
400-
#[cfg(all(target_os = "macos", feature = "native-tls"))]
401-
fn hacky_cert_lifetime_for_macos(ca: &[u8]) -> bool {
402-
use openssl::x509::X509;
403-
let ca = X509::from_der(ca).expect("valid der is a der");
404-
ca.not_before()
405-
.diff(ca.not_after())
406-
.map(|d| d.days.abs() > 824)
407-
.unwrap_or(false)
408-
}
409-
410-
#[cfg(any(not(target_os = "macos"), not(feature = "native-tls")))]
411-
fn hacky_cert_lifetime_for_macos(_: &[u8]) -> bool {
412-
false
413-
}
414-
415396
// Expose raw config structs
416397
pub use file_config::{
417398
AuthInfo, AuthProviderConfig, Cluster, Context, ExecConfig, Kubeconfig, NamedAuthInfo, NamedCluster,

‎kube-client/src/error.rs

-6
Original file line numberDiff line numberDiff line change
@@ -59,12 +59,6 @@ pub enum Error {
5959
#[error("Error from discovery: {0}")]
6060
Discovery(#[source] DiscoveryError),
6161

62-
/// Errors from Native TLS
63-
#[cfg(feature = "native-tls")]
64-
#[cfg_attr(docsrs, doc(cfg(feature = "native-tls")))]
65-
#[error("native tls error: {0}")]
66-
NativeTls(#[source] crate::client::NativeTlsError),
67-
6862
/// Errors from OpenSSL TLS
6963
#[cfg(feature = "openssl-tls")]
7064
#[cfg_attr(docsrs, doc(cfg(feature = "openssl-tls")))]

‎kube-client/src/lib.rs

-15
Original file line numberDiff line numberDiff line change
@@ -161,21 +161,6 @@ mod test {
161161
Ok(())
162162
}
163163

164-
#[tokio::test]
165-
#[ignore] // needs cluster (lists pods)
166-
#[cfg(all(feature = "native-tls"))]
167-
async fn custom_client_native_tls_configuration() -> Result<(), Box<dyn std::error::Error>> {
168-
let config = Config::infer().await?;
169-
let https = config.native_tls_https_connector()?;
170-
let service = ServiceBuilder::new()
171-
.layer(config.base_uri_layer())
172-
.service(hyper::Client::builder().build(https));
173-
let client = Client::new(service, config.default_namespace);
174-
let pods: Api<Pod> = Api::default_namespaced(client);
175-
pods.list(&Default::default()).await?;
176-
Ok(())
177-
}
178-
179164
#[tokio::test]
180165
#[ignore] // needs cluster (lists pods)
181166
#[cfg(all(feature = "openssl-tls"))]

‎kube/Cargo.toml

+1-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ edition = "2021"
1717

1818
[features]
1919
default = ["client", "openssl-tls"]
20-
native-tls = ["kube-client/native-tls"]
2120
rustls-tls = ["kube-client/rustls-tls"]
2221
openssl-tls = ["kube-client/openssl-tls"]
2322
ws = ["kube-client/ws", "kube-core/ws"]
@@ -31,7 +30,7 @@ config = ["kube-client/config"]
3130
runtime = ["kube-runtime"]
3231

3332
[package.metadata.docs.rs]
34-
features = ["client", "native-tls", "rustls-tls", "openssl-tls", "derive", "ws", "oauth", "jsonpatch", "admission", "runtime", "k8s-openapi/v1_25"]
33+
features = ["client", "rustls-tls", "openssl-tls", "derive", "ws", "oauth", "jsonpatch", "admission", "runtime", "k8s-openapi/v1_25"]
3534
# Define the configuration attribute `docsrs`. Used to enable `doc_cfg` feature.
3635
rustdoc-args = ["--cfg", "docsrs"]
3736

0 commit comments

Comments
 (0)