{
  "appeals": 1,
  "budgets": {
    "baseline_limit_s": 600,
    "verification_timeout_s": 600,
    "worker": {
      "max_completion_tokens": 96000,
      "max_turns": 60,
      "max_wall_seconds": 1500.0,
      "prompt_token_budget": 160000
    }
  },
  "issue": "Client doesn't honor tls-server-name setting in kubeconfig\n**What happened (please include outputs or screenshots)**:\r\n\r\nTried to connect to my cluster with a utility that uses your library. As far as I can tell, the utility's code is correct and the k8s-client python code does not honor the tls-server-name and propagate it down the stack to urllib3.\r\n\r\n\r\n\r\nReceived this exception:\r\n\r\n```\r\nTraceback (most recent call last):\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.\r\npy\", line 703, in urlopen\r\n    httplib_response = self._make_request(\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.\r\npy\", line 386, in _make_request\r\n    self._validate_conn(conn)\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connectionpool.\r\npy\", line 1042, in _validate_conn\r\n    conn.connect()\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connection.py\",\r\n line 467, in connect\r\n    _match_hostname(cert, self.assert_hostname or server_hostname)\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/connection.py\",\r\n line 540, in _match_hostname\r\n    match_hostname(cert, asserted_hostname)\r\n  File \"/home/nicholas/code/k8spurger-venv/lib/python3.9/site-packages/urllib3/util/ssl_match_\r\nhostname.py\", line 150, in match_hostname\r\n    raise CertificateError(\r\nurllib3.util.ssl_match_hostname.CertificateError: hostname 'CNAME-THAT-I-USE' doesn\r\n't match either of 'LIST', 'OF', 'OTHER', 'NAMES'\r\n```\r\n\r\nThis is explicitly why I set tls-server-name in my kubeconfig.\r\n\r\n**What you expected to happen**:\r\n\r\nTLS connection to my cluster, with the proper SNI sent.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\nSet your cluster.server property to some IP/CNAME not in the cert. Set tls-server-name in kubeconfig correctly.\r\n\r\n**Anything else we need to know?**:\r\n\r\nLooks like it is pretty easy to support. Just need to change https://github.com/kubernetes-client/python/blob/master/kubernetes/base/config/kube_config.py#L544 to read the tls-server-name, and make sure that gets propagated to https://github.com/kubernetes-client/python/blob/master/kubernetes/client/rest.py#L73 as `assert_hostname`\r\n",
  "source": {
    "image": "docker.io/swerebenchv2/kubernetes-client-python:1933-045b189",
    "platform": "linux/amd64",
    "python": "python",
    "setup": [
      "python -c 'import base64; from pathlib import Path; Path('\"'\"'/tmp/receipts-kubernetes-client__python-1933-test.patch'\"'\"').write_bytes(base64.b64decode('\"'\"'ZGlmZiAtLWdpdCBhL2t1YmVybmV0ZXMvYmFzZS9jb25maWcva3ViZV9jb25maWdfdGVzdC5weSBiL2t1YmVybmV0ZXMvYmFzZS9jb25maWcva3ViZV9jb25maWdfdGVzdC5weQppbmRleCBkYTBkMmYzNWMuLmI0MTU0OTIwMyAxMDA2NDQKLS0tIGEva3ViZXJuZXRlcy9iYXNlL2NvbmZpZy9rdWJlX2NvbmZpZ190ZXN0LnB5CisrKyBiL2t1YmVybmV0ZXMvYmFzZS9jb25maWcva3ViZV9jb25maWdfdGVzdC5weQpAQCAtMTAyLDcgKzEwMiw3IEBAIFRFU1RfQ0xJRU5UX0tFWSA9ICJjbGllbnQta2V5IgogVEVTVF9DTElFTlRfS0VZX0JBU0U2NCA9IF9iYXNlNjQoVEVTVF9DTElFTlRfS0VZKQogVEVTVF9DTElFTlRfQ0VSVCA9ICJjbGllbnQtY2VydCIKIFRFU1RfQ0xJRU5UX0NFUlRfQkFTRTY0ID0gX2Jhc2U2NChURVNUX0NMSUVOVF9DRVJUKQotCitURVNUX1RMU19TRVJWRVJfTkFNRSA9ICJrdWJlcm5ldGVzLmlvIgogCiBURVNUX09JRENfVE9LRU4gPSAidGVzdC1vaWRjLXRva2VuIgogVEVTVF9PSURDX0lORk8gPSAie1wibmFtZVwiOiBcInRlc3RcIn0iCkBAIC01OTIsNyArNTkyLDE0IEBAIGNsYXNzIFRlc3RLdWJlQ29uZmlnTG9hZGVyKEJhc2VUZXN0Q2FzZSk6CiAgICAgICAgICAgICAgICAgICAgICJjbHVzdGVyIjogImNsdXN0ZXJ0ZXN0Y21kcGF0aCIsCiAgICAgICAgICAgICAgICAgICAgICJ1c2VyIjogInVzZXJ0ZXN0Y21kcGF0aHNjb3BlIgogICAgICAgICAgICAgICAgIH0KLSAgICAgICAgICAgIH0KKyAgICAgICAgICAgIH0sCisgICAgICAgICAgICB7CisgICAgICAgICAgICAgICAgIm5hbWUiOiAidGxzLXNlcnZlci1uYW1lIiwKKyAgICAgICAgICAgICAgICAiY29udGV4dCI6IHsKKyAgICAgICAgICAgICAgICAgICAgImNsdXN0ZXIiOiAidGxzLXNlcnZlci1uYW1lIiwKKyAgICAgICAgICAgICAgICAgICAgInVzZXIiOiAic3NsIgorICAgICAgICAgICAgICAgIH0KKyAgICAgICAgICAgIH0sCiAgICAgICAgIF0sCiAgICAgICAgICJjbHVzdGVycyI6IFsKICAgICAgICAgICAgIHsKQEAgLTYzNCw3ICs2NDEsMTcgQEAgY2xhc3MgVGVzdEt1YmVDb25maWdMb2FkZXIoQmFzZVRlc3RDYXNlKToKICAgICAgICAgICAgIHsKICAgICAgICAgICAgICAgICAibmFtZSI6ICJjbHVzdGVydGVzdGNtZHBhdGgiLAogICAgICAgICAgICAgICAgICJjbHVzdGVyIjoge30KLSAgICAgICAgICAgIH0KKyAgICAgICAgICAgIH0sCisgICAgICAgICAgICB7CisgICAgICAgICAgICAgICAgIm5hbWUiOiAidGxzLXNlcnZlci1uYW1lIiwKKyAgICAgICAgICAgICAgICAiY2x1c3RlciI6IHsKKyAgICAgICAgICAgICAgICAgICAgInNlcnZlciI6IFRFU1RfU1NMX0hPU1QsCisgICAgICAgICAgICAgICAgICAgICJjZXJ0aWZpY2F0ZS1hdXRob3JpdHktZGF0YSI6CisgICAgICAgICAgICAgICAgICAgICAgICBURVNUX0NFUlRJRklDQVRFX0FVVEhfQkFTRTY0LAorICAgICAgICAgICAgICAgICAgICAiaW5zZWN1cmUtc2tpcC10bHMtdmVyaWZ5IjogRmFsc2UsCisgICAgICAgICAgICAgICAgICAgICJ0bHMtc2VydmVyLW5hbWUiOiBURVNUX1RMU19TRVJWRVJfTkFNRSwKKyAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICB9LAogICAgICAgICBdLAogICAgICAgICAidXNlcnMiOiBbCiAgICAgICAgICAgICB7CkBAIC0xMjUxLDYgKzEyNjgsMjIgQEAgY2xhc3MgVGVzdEt1YmVDb25maWdMb2FkZXIoQmFzZVRlc3RDYXNlKToKICAgICAgICAgICAgIGFjdGl2ZV9jb250ZXh0PSJub19zc2xfdmVyaWZpY2F0aW9uIikubG9hZF9hbmRfc2V0KGFjdHVhbCkKICAgICAgICAgc2VsZi5hc3NlcnRFcXVhbChleHBlY3RlZCwgYWN0dWFsKQogCisgICAgZGVmIHRlc3RfdGxzX3NlcnZlcl9uYW1lKHNlbGYpOgorICAgICAgICBleHBlY3RlZCA9IEZha2VDb25maWcoCisgICAgICAgICAgICBob3N0PVRFU1RfU1NMX0hPU1QsCisgICAgICAgICAgICB0b2tlbj1CRUFSRVJfVE9LRU5fRk9STUFUICUgVEVTVF9EQVRBX0JBU0U2NCwKKyAgICAgICAgICAgIGNlcnRfZmlsZT1zZWxmLl9jcmVhdGVfdGVtcF9maWxlKFRFU1RfQ0xJRU5UX0NFUlQpLAorICAgICAgICAgICAga2V5X2ZpbGU9c2VsZi5fY3JlYXRlX3RlbXBfZmlsZShURVNUX0NMSUVOVF9LRVkpLAorICAgICAgICAgICAgc3NsX2NhX2NlcnQ9c2VsZi5fY3JlYXRlX3RlbXBfZmlsZShURVNUX0NFUlRJRklDQVRFX0FVVEgpLAorICAgICAgICAgICAgdmVyaWZ5X3NzbD1UcnVlLAorICAgICAgICAgICAgdGxzX3NlcnZlcl9uYW1lPVRFU1RfVExTX1NFUlZFUl9OQU1FCisgICAgICAgICkKKyAgICAgICAgYWN0dWFsID0gRmFrZUNvbmZpZygpCisgICAgICAgIEt1YmVDb25maWdMb2FkZXIoCisgICAgICAgICAgICBjb25maWdfZGljdD1zZWxmLlRFU1RfS1VCRV9DT05GSUcsCisgICAgICAgICAgICBhY3RpdmVfY29udGV4dD0idGxzLXNlcnZlci1uYW1lIikubG9hZF9hbmRfc2V0KGFjdHVhbCkKKyAgICAgICAgc2VsZi5hc3NlcnRFcXVhbChleHBlY3RlZCwgYWN0dWFsKQorCiAgICAgZGVmIHRlc3RfbGlzdF9jb250ZXh0cyhzZWxmKToKICAgICAgICAgbG9hZGVyID0gS3ViZUNvbmZpZ0xvYWRlcigKICAgICAgICAgICAgIGNvbmZpZ19kaWN0PXNlbGYuVEVTVF9LVUJFX0NPTkZJRywK'\"'\"'))'",
      "git apply /tmp/receipts-kubernetes-client__python-1933-test.patch"
    ],
    "workdir": "/python"
  },
  "spec_paths": [
    "kubernetes/base/config/kube_config_test.py"
  ],
  "spec_tests": [
    "kubernetes/base/config/kube_config_test.py::TestKubeConfigLoader::test_tls_server_name"
  ],
  "suite_scope": "--no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning kubernetes/base/config/kube_config_test.py"
}