Kube-rs: In-cluster config uses an IP address instead of recommended DNS name

[RobinMcCorkell]

When inferring in-cluster config, the code looks for KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT and creates a URL based on that, e.g. https://10.43.0.1:443. This breaks when using rustls-tls instead of openssl, due to missing support in the upstream libraries as noted in https://github.com/clux/kube-rs/pull/123#issue-372765967 and other places.

The recommended way to access the API server from a pod is with the kubernetes.default.svc DNS name, not with the service IP, which would avoid the rustls issue entirely. Is there a reason kube-rs uses the service IP directly?

[RobinMcCorkell]

As an immediate workaround, it appears that adding an environment variable KUBERNETES_SERVICE_HOST = kubernetes.default.svc at least allows rustls builds to work.

[clux]

Oh interesting. Based on that documentation it looks like we are using a legacy / misguided method. Our method is not mentioned there anymore, and can test + fix this pretty easily. Thanks for the report!

[RobinMcCorkell]

I assume this crate was modelled off the Golang libraries, where I found this interesting little comment ;) https://github.com/kubernetes/client-go/blob/7a90b08589bbf0d36a27041d5491b7b8d5430f15/rest/config.go#L506-L512

[clux]

hah! that's actually current master! practice what you preach, hey.

[clux]

Draft PR for this at in #597
Have not had the time to test it, and probably won't for a little while, so any help is appreciated.