Make Client configurable

[kazk]

Customize client with Layers:

use kube::{client::ConfigExt, Client, Config};
use tower::ServiceBuilder;
use tower_http::{decompression::DecompressionLayer, trace::TraceLayer};

let config = Config::infer().await?;
let https = config.native_tls_https_connector()?;
let client = Client::new(
    ServiceBuilder::new()
        .layer(config.base_uri_layer())
        .option_layer(config.auth_layer()?)
        .layer(DecompressionLayer::new())
        .layer(TraceLayer::new_for_http())
        .service(hyper::Client::builder().build(https)),
);

Customize HttpsConnector:

let https = ServiceBuilder::new()
    .layer(layer_fn(|c| {
        let mut conn = TimeoutConnector::new(c);
        conn.set_connect_timeout(Some(Duration::from_secs(5)));
        conn
    }))
    .service(config.native_tls_https_connector()?);

It's also possible to create HttpsConnector from TlsConnector:

let https = {
    let tls = tokio_native_tls::TlsConnector::from(
        config.native_tls_connector()?
    );
    let mut http = HttpConnector::new();
    http.enforce_http(false);
    HttpsConnector::from((http, tls))
};

TLS Enhancements

• Add kube::client::ConfigExt extending Config for custom Client. This includes methods to configure TLS connection when building a custom client (Make Client configurable with Layers #539)
  • native-tls: Config::native_tls_https_connector and Config::native_tls_connector
  • rustls-tls: Config::rustls_https_connector and Config::rustls_client_config
• Remove the requirement of having native-tls or rustls-tls enabled when client is enabled. Allow one, both or none.
  • When both, the default Service will use native-tls because of rustls cannot reach a cluster through ip #153. rustls can be still used with a custom client. Users will have an option to configure TLS at runtime.
  • When none, HTTP connector is used.
• Remove TLS features from kube-runtime
  • BREAKING: Features must be removed if specified
• Remove client feature from native-tls and rust-tls features
  • config + native-tls/rustls-tls can be used independently, e.g., to create a simple HTTP client
  • BREAKING: client feature must be added if default-features = false

Layers

• ConfigExt::base_uri_layer (BaseUriLayer) to set cluster URL (Make Client configurable with Layers #539)
• ConfigExt::auth_layer that returns optional layer to manage Authorization header (Make Client configurable with Layers #539)
• gzip: Replaced custom decompression module with DecompressionLayer from tower-http (Make Client configurable with Layers #539)
• Replaced custom LogRequest with TraceLayer from tower-http (Make Client configurable with Layers #539)
  • Request body is no longer shown
• Basic and Bearer authentication using AddAuthorizationLayer (borrowing from Add AddAuthorization middleware tower-rs/tower-http#95 until released)

Changes

• BREAKING: Remove headers from Config. It was originally added to allow injecting arbitrary headers, but now a custom client can be used to do that.
• Add support for loading proxy URL from kube config. Proxy itself is not supported yet.

Dependency Changes

• Remove static_assertions since it's no longer used
• Replace tokio_rustls with rustls and webpki since we're not using tokio_rustls directly
• Replace uses of rustls::internal::pemfile with rustls-pemfile
• Remove url and always use http::Uri
  • BREAKING: Config::cluster_url is now http::Uri
  • BREAKING: Error::InternalUrlError(url::ParseError) and Error::MalformedUrl(url::ParseError) replaced by Error::InvalidUri(http::uri::InvalidUri)

---

Closes #539

[kazk]

Took me a few days to come up with this, but should be worth it. This change allows us to take advantage of the Tower ecosystem much more without introducing type parameters to Client.

Shouldn't be a breaking change, but need to test more to make sure.

[clux]

looks great. just small philosophical comments. have not dug through the tls stuff much yet.

[clux]

Looks amazing. Huge work 💯

Had another go over. TLS looks all great, good error handling everywhere, docs everywhere, things with TODOs are all pub(crate).

Left (another) philosiphical naming nit, but beyond this I am all good with this.

[clux]

I didn't know about this pattern, but am a fan. Feels like a very smart way to avoid having all the public methods in a big namespace 👍

[kazk]

Yeah, the downside is the extra import, but I think the explicit kube::client::ConfigExt actually makes sense for this. I also wanted to keep client stuff out of the config module.

[clux]

I'll leave it to you to make the final call on naming, and will make a release after you merge this :-)

[clux]

Release in 0.56.0! Thank you so much!