Skip to content

Commit fbbde8d

Browse files
hiddecogithub-actions[bot]
hiddeco
authored and
github-actions[bot]
committed
fix: improve construction of HTTP transports (#3573)
Signed-off-by: Hidde Beydals <[email protected]> (cherry picked from commit 196ce61)
1 parent 1893308 commit fbbde8d

File tree

7 files changed

+74
-57
lines changed

7 files changed

+74
-57
lines changed

Diff for: ‎internal/api/dex/proxy.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ import (
55
"crypto/x509"
66
"errors"
77
"fmt"
8-
"net/http"
98
"net/http/httputil"
109
"net/url"
1110
"os"
1211

12+
"github.com/hashicorp/go-cleanhttp"
1313
"github.com/kelseyhightower/envconfig"
1414
)
1515

@@ -49,14 +49,15 @@ func NewProxy(cfg ProxyConfig) (*httputil.ReverseProxy, error) {
4949
}
5050
}
5151

52-
proxy := httputil.NewSingleHostReverseProxy(target)
53-
proxy.Transport = &http.Transport{
54-
TLSClientConfig: &tls.Config{
55-
MinVersion: tls.VersionTLS12,
56-
RootCAs: caCertPool,
57-
},
52+
transport := cleanhttp.DefaultPooledTransport()
53+
transport.TLSClientConfig = &tls.Config{
54+
MinVersion: tls.VersionTLS12,
55+
RootCAs: caCertPool,
5856
}
5957

58+
proxy := httputil.NewSingleHostReverseProxy(target)
59+
proxy.Transport = transport
60+
6061
return proxy, nil
6162
}
6263

Diff for: ‎internal/api/option/auth.go

+7-6
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"connectrpc.com/connect"
1717
"github.com/coreos/go-oidc/v3/oidc"
1818
"github.com/golang-jwt/jwt/v5"
19+
"github.com/hashicorp/go-cleanhttp"
1920
corev1 "k8s.io/api/core/v1"
2021
"k8s.io/apimachinery/pkg/types"
2122
libClient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -142,7 +143,7 @@ func newMultiClientVerifier(ctx context.Context, cfg config.ServerConfig) goOIDC
142143
// provider.Verifier() because they're not flexible enough to handle the Dex
143144
// proxy case.
144145
func getKeySet(ctx context.Context, cfg config.ServerConfig) (oidc.KeySet, error) {
145-
httpClient := &http.Client{}
146+
httpClient := cleanhttp.DefaultClient()
146147

147148
var discoURL string
148149
if cfg.DexProxyConfig == nil {
@@ -165,12 +166,12 @@ func getKeySet(ctx context.Context, cfg config.ServerConfig) (oidc.KeySet, error
165166
if ok := caCertPool.AppendCertsFromPEM(caCertBytes); !ok {
166167
return nil, errors.New("invalid CA cert data")
167168
}
168-
httpClient.Transport = &http.Transport{
169-
TLSClientConfig: &tls.Config{
170-
MinVersion: tls.VersionTLS12,
171-
RootCAs: caCertPool,
172-
},
169+
transport := cleanhttp.DefaultTransport()
170+
transport.TLSClientConfig = &tls.Config{
171+
MinVersion: tls.VersionTLS12,
172+
RootCAs: caCertPool,
173173
}
174+
httpClient.Transport = transport
174175
}
175176
}
176177

Diff for: ‎internal/cli/client/client.go

+10-7
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ import (
55
"crypto/tls"
66
"errors"
77
"fmt"
8-
"net/http"
98

109
"connectrpc.com/connect"
10+
"github.com/hashicorp/go-cleanhttp"
1111
"github.com/spf13/pflag"
1212

1313
"github.com/akuity/kargo/internal/cli/config"
@@ -57,13 +57,16 @@ func GetClient(
5757
credential string,
5858
insecureTLS bool,
5959
) svcv1alpha1connect.KargoServiceClient {
60-
httpClient := &http.Client{
61-
Transport: &http.Transport{
62-
TLSClientConfig: &tls.Config{
63-
InsecureSkipVerify: insecureTLS, // nolint: gosec
64-
},
65-
},
60+
httpClient := cleanhttp.DefaultClient()
61+
62+
if insecureTLS {
63+
transport := cleanhttp.DefaultTransport()
64+
transport.TLSClientConfig = &tls.Config{
65+
InsecureSkipVerify: true, // nolint: gosec
66+
}
67+
httpClient.Transport = transport
6668
}
69+
6770
if credential == "" {
6871
return svcv1alpha1connect.NewKargoServiceClient(httpClient, serverAddress)
6972
}

Diff for: ‎internal/cli/cmd/login/login.go

+11-10
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
"github.com/AlecAivazis/survey/v2"
2020
"github.com/bacongobbler/browser"
2121
"github.com/coreos/go-oidc/v3/oidc"
22+
"github.com/hashicorp/go-cleanhttp"
2223
"github.com/spf13/cobra"
2324
"golang.org/x/oauth2"
2425
"k8s.io/utils/strings/slices"
@@ -266,16 +267,16 @@ func ssoLogin(
266267

267268
scopes := res.Msg.OidcConfig.Scopes
268269

269-
ctx = oidc.ClientContext(
270-
ctx,
271-
&http.Client{
272-
Transport: &http.Transport{
273-
TLSClientConfig: &tls.Config{
274-
InsecureSkipVerify: insecureTLS, // nolint: gosec
275-
},
276-
},
277-
},
278-
)
270+
httpClient := cleanhttp.DefaultClient()
271+
if insecureTLS {
272+
transport := cleanhttp.DefaultTransport()
273+
transport.TLSClientConfig = &tls.Config{
274+
InsecureSkipVerify: true, // nolint: gosec
275+
}
276+
httpClient.Transport = transport
277+
}
278+
ctx = oidc.ClientContext(ctx, httpClient)
279+
279280
provider, err := oidc.NewProvider(ctx, res.Msg.OidcConfig.IssuerUrl)
280281
if err != nil {
281282
return "", "", fmt.Errorf("error initializing OIDC provider: %w", err)

Diff for: ‎internal/gitprovider/gitea/gitea.go

+9-8
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ import (
44
"context"
55
"crypto/tls"
66
"fmt"
7-
"net/http"
87
"net/url"
98
"strings"
109

1110
"code.gitea.io/sdk/gitea"
11+
"github.com/hashicorp/go-cleanhttp"
1212

1313
"github.com/akuity/kargo/internal/git"
1414
"github.com/akuity/kargo/internal/gitprovider"
@@ -94,15 +94,16 @@ func NewProvider(
9494
if opts.Token != "" {
9595
clientOpts = append(clientOpts, gitea.SetToken(opts.Token))
9696
}
97+
98+
httpClient := cleanhttp.DefaultClient()
9799
if opts.InsecureSkipTLSVerify {
98-
clientOpts = append(clientOpts, gitea.SetHTTPClient(&http.Client{
99-
Transport: &http.Transport{
100-
TLSClientConfig: &tls.Config{
101-
InsecureSkipVerify: true, // nolint: gosec
102-
},
103-
},
104-
}))
100+
transport := cleanhttp.DefaultTransport()
101+
transport.TLSClientConfig = &tls.Config{
102+
InsecureSkipVerify: true, // nolint: gosec
103+
}
104+
httpClient.Transport = transport
105105
}
106+
clientOpts = append(clientOpts, gitea.SetHTTPClient(httpClient))
106107

107108
baseURL := fmt.Sprintf("%s://%s", scheme, host)
108109
client, err := gitea.NewClient(baseURL, clientOpts...)

Diff for: ‎internal/gitprovider/github/github.go

+15-8
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ import (
44
"context"
55
"crypto/tls"
66
"fmt"
7-
"net/http"
87
"net/url"
98
"strings"
109

1110
"github.com/google/go-github/v56/github"
11+
"github.com/hashicorp/go-cleanhttp"
1212
"k8s.io/utils/ptr"
1313

1414
"github.com/akuity/kargo/internal/git"
@@ -87,17 +87,23 @@ func NewProvider(
8787
if opts == nil {
8888
opts = &gitprovider.Options{}
8989
}
90+
9091
scheme, host, owner, repo, err := parseRepoURL(repoURL)
9192
if err != nil {
9293
return nil, err
9394
}
94-
client := github.NewClient(&http.Client{
95-
Transport: &http.Transport{
96-
TLSClientConfig: &tls.Config{
97-
InsecureSkipVerify: opts.InsecureSkipTLSVerify, // nolint: gosec
98-
},
99-
},
100-
})
95+
96+
httpClient := cleanhttp.DefaultClient()
97+
if opts.InsecureSkipTLSVerify {
98+
transport := cleanhttp.DefaultTransport()
99+
transport.TLSClientConfig = &tls.Config{
100+
InsecureSkipVerify: true, // nolint: gosec
101+
}
102+
httpClient.Transport = transport
103+
}
104+
105+
client := github.NewClient(httpClient)
106+
101107
if host != "github.com" {
102108
baseURL := fmt.Sprintf("%s://%s", scheme, host)
103109
// This function call will automatically add correct paths to the base URL
@@ -109,6 +115,7 @@ func NewProvider(
109115
if opts.Token != "" {
110116
client = client.WithAuthToken(opts.Token)
111117
}
118+
112119
return &provider{
113120
owner: owner,
114121
repo: repo,

Diff for: ‎internal/gitprovider/gitlab/gitlab.go

+14-11
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ import (
44
"context"
55
"crypto/tls"
66
"fmt"
7-
"net/http"
87
"net/url"
98
"strings"
109

10+
"github.com/hashicorp/go-cleanhttp"
1111
gitlab "gitlab.com/gitlab-org/api/client-go"
1212

1313
"github.com/akuity/kargo/internal/git"
@@ -75,33 +75,36 @@ func NewProvider(
7575
if opts == nil {
7676
opts = &gitprovider.Options{}
7777
}
78+
7879
scheme, host, projectName, err := parseRepoURL(repoURL)
7980
if err != nil {
8081
return nil, err
8182
}
83+
8284
clientOpts := make([]gitlab.ClientOptionFunc, 0, 2)
85+
8386
if host != "gitlab.com" {
8487
clientOpts = append(
8588
clientOpts,
8689
gitlab.WithBaseURL(fmt.Sprintf("%s://%s/api/v4", scheme, host)),
8790
)
8891
}
92+
93+
httpClient := cleanhttp.DefaultClient()
8994
if opts.InsecureSkipTLSVerify {
90-
clientOpts = append(
91-
clientOpts,
92-
gitlab.WithHTTPClient(&http.Client{
93-
Transport: &http.Transport{
94-
TLSClientConfig: &tls.Config{
95-
InsecureSkipVerify: true, // nolint: gosec
96-
},
97-
},
98-
}),
99-
)
95+
transport := cleanhttp.DefaultTransport()
96+
transport.TLSClientConfig = &tls.Config{
97+
InsecureSkipVerify: true, // nolint: gosec
98+
}
99+
httpClient.Transport = transport
100100
}
101+
clientOpts = append(clientOpts, gitlab.WithHTTPClient(httpClient))
102+
101103
client, err := gitlab.NewClient(opts.Token, clientOpts...)
102104
if err != nil {
103105
return nil, err
104106
}
107+
105108
return &provider{
106109
projectName: projectName,
107110
client: client.MergeRequests,

0 commit comments

Comments
 (0)