Readd optional proxy support

[kazk]

Readd proxy support (#245) for now. At least until we have a way for users to implement this easily with custom service.

Added proxy_url to Config and Cluster (mentioned in #425). So, it can be set manually or set in config file. Using unreleased version of hyper-proxy. Haven't tested, but compiles.

[clux]

Though haven't had the possibility to check it. Looks like it's handling it great in a smart way.
Service abstraction is handling everything :D

[kazk]

How was #246 tested? This compiles and doesn't break when proxy_url is not present, but I haven't tested the actual proxying part.

[clux]

comment on proxy matching

[clux]

How was #246 tested? This compiles and doesn't break when proxy_url is not present, but I haven't tested the actual proxying part.

I wish I remember. It's possible I took @edio's silence as success. At the time it was only an example feature with a one liner to reqwest.

As a sanity is it enough to run kubectl proxy --port=8080 and put proxy_url to http://127.0.0.1:8080/?
Not sure how if kubectl does more than a normal proxy server for this purpose.

[clux]

I can see kubectl have some tests in https://github.com/kubernetes/kubernetes/blob/7791bbe978d4dbcbb5694565c4a1c856bca48223/staging/src/k8s.io/apimachinery/pkg/util/net/http_test.go#L148 , and more proxy support was added in kubernetes/kubernetes#81443 but haven't had time to dig deeply into it.

Also a ref: master kubernetes kubeconfig comments

[kazk]

As a sanity is it enough to run kubectl proxy --port=8080 and put proxy_url to http://127.0.0.1:8080/?

Not working :( It connects to 127.0.0.1:8080, but fails.

[2021-02-28T10:41:41Z INFO  proxy] PROXY_URL is http://localhost:8080
[2021-02-28T10:41:41Z TRACE kube::service::log] GET https://0.0.0.0:33171/api/v1/namespaces? Body(Empty)
[2021-02-28T10:41:41Z DEBUG hyper::client::connect::dns] resolving host="localhost" 
[2021-02-28T10:41:41Z DEBUG hyper::client::connect::http] connecting to [::1]:8080 
[2021-02-28T10:41:41Z DEBUG hyper::client::connect::http] connecting to 127.0.0.1:8080 
[2021-02-28T10:41:41Z DEBUG hyper::client::connect::http] connected to 127.0.0.1:8080 
Error: HyperError: error trying to connect: unsuccessful tunnel (HTTP/1.1 404 Not)

Caused by:
    0: error trying to connect: unsuccessful tunnel (HTTP/1.1 404 Not)
    1: unsuccessful tunnel (HTTP/1.1 404 Not)

curl http://127.0.0.1:8080/api/v1/namespaces? works.

unsuccessful tunnel is from https://github.com/tafia/hyper-proxy/blob/768fbf4c4596717548ae3cf6d4687f0a588b911f/src/tunnel.rs#L119

[kazk]

kube connects to cluster_url. Setting proxy_url means to connect to the proxy instead (Intercept::All), right? hyper-proxy swaps the scheme and authority (user info + host + port) to the proxy_url's.

So in our case, what's the difference from simply replacing the cluster_url with proxy_url?

[clux]

Think I have a more realistic example that may be more helpful in doing this feature:

• a k3s cluster on a machine somewhere (giving me a kube config with a cluster url of https://127.0.0.1:6443)
• sshd running on that machine
• ssh connection with DynamicForward 3126 for the entry in my ~/.ssh/config

Then a setup that works with kubectl when having an ssh connection open to that machine is:

clusters:
- cluster:
    server: https://127.0.0.1:6443
    proxy-url: http://localhost:3126

sshd sets up a socks proxy against your local port 3126, which you can use to connect to the "other localhost" as you exit the proxy.

[kazk]

Closing and will try again after #540. I was misunderstanding how this should work.

An easier way to test will be to set up mitmproxy. https://ahmet.im/blog/kubectl-man-in-the-middle/

[kazk]

I decided to use reqwest as a reference since it supports multiple TLS and also socks5. Got mitmproxy working after starting the proxy with client certs and keys.

Custom client should be able to use hyper-proxy already.

I'll open a PR sometime during the week.
We'll support http/https proxy by default since it shouldn't need extra dependency, and add socks-proxy feature for socks5.

[clux]

Hey @kazk i know this is a bit ancient but you said this is doable with hyper-proxy. Are you able to write up an issue of what needs to be done to implement this? If you are busy, then at least having the outstanding work documented would be useful!

[kazk]

I don't remember the details anymore, but I think I ran into some issues with hyper-proxy.

I have a WIP branch from when I commented above, so I'll rebase that to the latest, and open a draft PR.

[kazk]

Opened #837