ERR_TLS_CERT_ALTNAME_INVALID error for proxy-url feature

[warjiang]

Describe the bug
I metioned that in the client-node sdk main branch, it implemented proxy-url feature, it would be very useful for local development. But when I use the client-node sdk, and the kubeconfig file contains proxy-url field, it will output the following error:

Client Version
e.g. 0.12.0
not a stable release version, just in the main branch.

Server Version
e.g. 1.19.1
v1.28.3

To Reproduce
Steps to reproduce the behavior:
prepare a kubeconfig file with proxy-url, and use the loadFromFile method to init the client-node sdk.

Expected behavior
A clear and concise description of what you expected to happen.
I expected the sdk can work with the proxy-url, and visit the kubernetes apiserver.

Example Code
Code snippet for what you are doing

import * as k8s from '@kubernetes/client-node';


const kc = new k8s.KubeConfig();
kc.loadFromFile('path/to/local/kubeconfig')
const k8sApi = kc.makeApiClient(k8s.CoreV1Api);
k8sApi.listNamespacedPod({ namespace: "default" }).then((res) => {
  console.log(res);
});

Environment (please complete the following information):

• OS: [e.g. Windows, Linux] macos
• Node.js version [eg. 20] v20.12.1
• Cloud runtime [e.g. Azure Functions, Lambda] local devel

Additional context
Add any other context about the problem here.
I try to solve the problem by diving into the source code. Here is some analysis for the problem: TooTallNate/proxy-agents#365, maybe it will help the community team to solve the problem~

[brendandburns]

It appears that you are connecting to 'localhost' as the API server, but that is not in the subject names that are in the certificate (as expected).

What is the server set to in your kubeconfig?

[warjiang]

yes, the problem is setting wrong host, which caused by socks-proxy-agent package, it will omit the host when create tls connection.

and the server in my kubeconfig is that:

BTW I have tested the same kubeconfig with client-go sdk, it works~.

[warjiang]

It seems not the problem of invoking, when send request to apiserver, the request lib(aka node-fetch) will set host according to server field in the kubeconfig:

the opts param passed in the connect method in socks-proxy-agent is still right:

here the invoke to apiserver is tls request, so it will create the tls socket based on socks5 socket, but it will ignore host which generated by node-fetch lib:

so the duo tls verify will be failed.

[brendandburns]

It seems like this is a bug in the socks-proxy-agent library?

[warjiang]

It seems like this is a bug in the socks-proxy-agent library?

Yes, i'm trying to prepare more snippet to prove that. BTW, is anyone tested the proxy-url feature? I want to make sure that is it a common problem ?

[warjiang]

@brendandburns already confirm the problem, it seems that socks-proxy-agent doesn't take bilateral tls verification into consideraion(because I've tested the http/https version, it doesn't works for scenario of bilateral tls verification)