update to hyper 1

Signed-off-by: tottoto <[email protected]>

Cargo.toml

@@ -29,13 +29,15 @@ form_urlencoded = "1.2.0"
 futures = "0.3.17"
 hashbrown = "0.14.0"
 home = "0.5.4"
-http = "0.2.9"
-http-body = "0.4.2"
-hyper = "0.14.27"
-hyper-openssl = "0.9.2"
-hyper-rustls = "0.24.0"
-hyper-socks2 = { version = "0.8.0", default-features = false }
-hyper-timeout = "0.4.1"
+http = "1.1.0"
+http-body = "1.0.0"
+http-body-util = "0.1.1"
+hyper = "1.2.0"
+hyper-util = "0.1.3"
+hyper-openssl = "0.10.2"
+hyper-rustls = "0.26.0"
+hyper-socks2 = { version = "0.9.0", default-features = false }
+hyper-timeout = "0.5.1"
 json-patch = "1.0.0"
 jsonpath-rust = "0.5.0"
 k8s-openapi = { version = "0.21.0", default-features = false }
@@ -47,24 +49,24 @@ pin-project = "1.0.4"
 proc-macro2 = "1.0.29"
 quote = "1.0.10"
 rand = "0.8.3"
-rustls = "0.21.4"
-rustls-pemfile = "1.0.0"
+rustls = "0.22.0"
+rustls-pemfile = "2.0.0"
 schemars = "0.8.6"
 secrecy = "0.8.0"
 serde = "1.0.130"
 serde_json = "1.0.68"
 serde_yaml = "0.9.19"
 smallvec = "1.7.0"
 syn = "2.0.38"
-tame-oauth = "0.9.1"
+tame-oauth = "0.10.0"
 tempfile = "3.1.0"
 thiserror = "1.0.29"
 tokio = "1.14.0"
 tokio-test = "0.4.0"
-tokio-tungstenite = "0.20.0"
+tokio-tungstenite = "0.21.0"
 tokio-util = "0.7.0"
 tower = "0.4.13"
-tower-http = "0.4.0"
+tower-http = "0.5.2"
 tower-test = "0.4.0"
 tracing = "0.1.36"
 tracing-subscriber = "0.3.17"

examples/Cargo.toml

@@ -46,11 +46,14 @@ tar = "0.4.37"
 tracing.workspace = true
 tracing-subscriber.workspace = true
 warp = { version = "0.3", default-features = false, features = ["tls"] }
+bytes.workspace = true
 http.workspace = true
+http-body-util.workspace = true
 json-patch.workspace = true
 tower = { workspace = true, features = ["limit"] }
 tower-http = { workspace = true, features = ["trace", "decompression-gzip"] }
-hyper = { workspace = true, features = ["client", "http1", "stream", "tcp"] }
+hyper = { workspace = true, features = ["client", "http1"] }
+hyper-util = { workspace = true, features = ["client-legacy", "http1", "tokio"] }
 thiserror.workspace = true
 backoff.workspace = true
 clap = { version = "4.0", default-features = false, features = ["std", "cargo", "derive"] }

examples/custom_client.rs

@@ -1,3 +1,4 @@
+use hyper_util::rt::TokioExecutor;
 // Minimal custom client example.
 use k8s_openapi::api::core::v1::Pod;
 use tracing::*;
@@ -14,7 +15,7 @@ async fn main() -> anyhow::Result<()> {
     let service = tower::ServiceBuilder::new()
         .layer(config.base_uri_layer())
         .option_layer(config.auth_layer()?)
-        .service(hyper::Client::builder().build(https));
+        .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
     let client = Client::new(service, config.default_namespace);
 
     let pods: Api<Pod> = Api::default_namespaced(client);

examples/custom_client_tls.rs

@@ -1,3 +1,4 @@
+use hyper_util::rt::TokioExecutor;
 // Custom client supporting both openssl-tls and rustls-tls
 // Must enable `rustls-tls` feature to run this.
 // Run with `USE_RUSTLS=1` to pick rustls.
@@ -19,13 +20,13 @@ async fn main() -> anyhow::Result<()> {
         let https = config.openssl_https_connector()?;
         let service = ServiceBuilder::new()
             .layer(config.base_uri_layer())
-            .service(hyper::Client::builder().build(https));
+            .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
         Client::new(service, config.default_namespace)
     } else {
         let https = config.rustls_https_connector()?;
         let service = ServiceBuilder::new()
             .layer(config.base_uri_layer())
-            .service(hyper::Client::builder().build(https));
+            .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
         Client::new(service, config.default_namespace)
     };
 

examples/custom_client_trace.rs

@@ -1,13 +1,17 @@
 // Custom client example with TraceLayer.
 use http::{Request, Response};
-use hyper::Body;
+use hyper::body::Incoming;
+use hyper_util::rt::TokioExecutor;
 use k8s_openapi::api::core::v1::Pod;
 use std::time::Duration;
 use tower::ServiceBuilder;
 use tower_http::{decompression::DecompressionLayer, trace::TraceLayer};
 use tracing::{Span, *};
 
-use kube::{client::ConfigExt, Api, Client, Config, ResourceExt};
+use kube::{
+    client::{Body, ConfigExt},
+    Api, Client, Config, ResourceExt,
+};
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -40,7 +44,7 @@ async fn main() -> anyhow::Result<()> {
                 .on_request(|request: &Request<Body>, _span: &Span| {
                     tracing::debug!("payload: {:?} headers: {:?}", request.body(), request.headers())
                 })
-                .on_response(|response: &Response<Body>, latency: Duration, span: &Span| {
+                .on_response(|response: &Response<Incoming>, latency: Duration, span: &Span| {
                     let status = response.status();
                     span.record("http.status_code", status.as_u16());
                     if status.is_client_error() || status.is_server_error() {
@@ -49,7 +53,7 @@ async fn main() -> anyhow::Result<()> {
                     tracing::debug!("finished in {}ms", latency.as_millis())
                 }),
         )
-        .service(hyper::Client::builder().build(https));
+        .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
 
     let client = Client::new(service, config.default_namespace);
 

examples/pod_portforward_hyper_http.rs

@@ -1,3 +1,5 @@
+use bytes::Bytes;
+use hyper_util::rt::TokioIo;
 use k8s_openapi::api::core::v1::Pod;
 use kube::{
     api::{Api, DeleteParams, PostParams},
@@ -6,7 +8,8 @@ use kube::{
 };
 use tracing::*;
 
-use hyper::{body, Body, Request};
+use http::Request;
+use http_body_util::BodyExt;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -37,7 +40,7 @@ async fn main() -> anyhow::Result<()> {
     let port = pf.take_stream(80).unwrap();
 
     // let hyper drive the HTTP state in our DuplexStream via a task
-    let (mut sender, connection) = hyper::client::conn::handshake(port).await?;
+    let (mut sender, connection) = hyper::client::conn::http1::handshake(TokioIo::new(port)).await?;
     tokio::spawn(async move {
         if let Err(e) = connection.await {
             warn!("Error in connection: {}", e);
@@ -49,13 +52,13 @@ async fn main() -> anyhow::Result<()> {
         .header("Connection", "close")
         .header("Host", "127.0.0.1")
         .method("GET")
-        .body(Body::from(""))
+        .body(http_body_util::Empty::<Bytes>::new())
         .unwrap();
 
     let (parts, body) = sender.send_request(http_req).await?.into_parts();
     assert!(parts.status == 200);
 
-    let body_bytes = body::to_bytes(body).await?;
+    let body_bytes = body.collect().await?.to_bytes();
     let body_str = std::str::from_utf8(&body_bytes)?;
     assert!(body_str.contains("Welcome to nginx!"));
 

kube-client/Cargo.toml

@@ -24,7 +24,7 @@ kubelet-debug = ["ws", "kube-core/kubelet-debug"]
 oauth = ["client", "tame-oauth"]
 oidc = ["client", "form_urlencoded"]
 gzip = ["client", "tower-http/decompression-gzip"]
-client = ["config", "__non_core", "hyper", "http-body", "tower", "tower-http", "hyper-timeout", "pin-project", "chrono", "jsonpath-rust", "bytes", "futures", "tokio", "tokio-util", "either"]
+client = ["config", "__non_core", "hyper", "hyper-util", "http-body", "http-body-util", "tower", "tower-http", "hyper-timeout", "pin-project", "chrono", "jsonpath-rust", "bytes", "futures", "tokio", "tokio-util", "either"]
 jsonpatch = ["kube-core/jsonpatch"]
 admission = ["kube-core/admission"]
 config = ["__non_core", "pem", "home"]
@@ -48,19 +48,21 @@ serde_json.workspace = true
 serde_yaml = { workspace = true, optional = true }
 http.workspace = true
 http-body = { workspace = true, optional = true }
+http-body-util = { workspace = true, optional = true }
 either = { workspace = true, optional = true }
 thiserror.workspace = true
 futures = { workspace = true, optional = true }
 pem = { workspace = true, optional = true }
 openssl = { workspace = true, optional = true }
-rustls = { workspace = true, features = ["dangerous_configuration"], optional = true }
+rustls = { workspace = true, optional = true }
 rustls-pemfile = { workspace = true, optional = true }
 bytes = { workspace = true, optional = true }
 tokio = { workspace = true, features = ["time", "signal", "sync"], optional = true }
 kube-core = { path = "../kube-core", version = "=0.88.1" }
 jsonpath-rust = { workspace = true, optional = true }
 tokio-util = { workspace = true, features = ["io", "codec"], optional = true }
-hyper = { workspace = true, features = ["client", "http1", "stream", "tcp"], optional = true }
+hyper = { workspace = true, features = ["client", "http1"], optional = true }
+hyper-util = { workspace = true, features = ["client", "client-legacy", "http1", "tokio"], optional = true }
 hyper-rustls = { workspace = true, optional = true }
 hyper-socks2 = { workspace = true, optional = true }
 tokio-tungstenite = { workspace = true, optional = true }
@@ -72,7 +74,7 @@ pin-project = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
 secrecy = { workspace = true, features = ["alloc", "serde"] }
 tracing = { workspace = true, features = ["log"], optional = true }
-hyper-openssl = { workspace = true, optional = true }
+hyper-openssl = { workspace = true, features = ["client-legacy"], optional = true }
 form_urlencoded = { workspace = true, optional = true }
 k8s-openapi= { workspace = true, features = [] }
 

kube-client/src/api/mod.rs

@@ -1,12 +1,16 @@
 //! API helpers for structured interaction with the Kubernetes API
 
 mod core_methods;
-#[cfg(feature = "ws")] mod remote_command;
+#[cfg(feature = "ws")]
+mod remote_command;
 use std::fmt::Debug;
 
-#[cfg(feature = "ws")] pub use remote_command::{AttachedProcess, TerminalSize};
-#[cfg(feature = "ws")] mod portforward;
-#[cfg(feature = "ws")] pub use portforward::Portforwarder;
+#[cfg(feature = "ws")]
+pub use remote_command::{AttachedProcess, TerminalSize};
+#[cfg(feature = "ws")]
+mod portforward;
+#[cfg(feature = "ws")]
+pub use portforward::Portforwarder;
 
 mod subresource;
 #[cfg(feature = "ws")]
@@ -252,11 +256,10 @@ impl<K> Debug for Api<K> {
 /// Sanity test on scope restrictions
 #[cfg(test)]
 mod test {
-    use crate::{Api, Client};
+    use crate::{client::Body, Api, Client};
     use k8s_openapi::api::core::v1 as corev1;
 
     use http::{Request, Response};
-    use hyper::Body;
     use tower_test::mock;
 
     #[tokio::test]

kube-client/src/client/auth/mod.rs

@@ -19,11 +19,16 @@ use tower::{filter::AsyncPredicate, BoxError};
 
 use crate::config::{AuthInfo, AuthProviderConfig, ExecAuthCluster, ExecConfig, ExecInteractiveMode};
 
-#[cfg(feature = "oauth")] mod oauth;
-#[cfg(feature = "oauth")] pub use oauth::Error as OAuthError;
-#[cfg(feature = "oidc")] mod oidc;
-#[cfg(feature = "oidc")] pub use oidc::errors as oidc_errors;
-#[cfg(target_os = "windows")] use std::os::windows::process::CommandExt;
+#[cfg(feature = "oauth")]
+mod oauth;
+#[cfg(feature = "oauth")]
+pub use oauth::Error as OAuthError;
+#[cfg(feature = "oidc")]
+mod oidc;
+#[cfg(feature = "oidc")]
+pub use oidc::errors as oidc_errors;
+#[cfg(target_os = "windows")]
+use std::os::windows::process::CommandExt;
 
 #[derive(Error, Debug)]
 /// Client auth errors
@@ -102,6 +107,10 @@ pub enum Error {
     /// cluster spec missing while `provideClusterInfo` is true
     #[error("Cluster spec must be populated when `provideClusterInfo` is true")]
     ExecMissingClusterInfo,
+
+    /// No valid native root CA certificates found
+    #[error("No valid native root CA certificates found")]
+    NoValidNativeRootCA(#[source] std::io::Error),
 }
 
 #[derive(Debug, Clone)]

kube-client/src/client/auth/oauth.rs

@@ -1,9 +1,13 @@
+use http_body_util::BodyExt;
+use hyper_util::rt::TokioExecutor;
 use tame_oauth::{
     gcp::{TokenOrRequest, TokenProvider, TokenProviderWrapper},
     Token,
 };
 use thiserror::Error;
 
+use crate::client::Body;
+
 #[derive(Error, Debug)]
 /// Possible errors when requesting token with OAuth
 pub enum Error {
@@ -33,7 +37,7 @@ pub enum Error {
 
     /// Failed to request token
     #[error("failed to request token: {0}")]
-    RequestToken(#[source] hyper::Error),
+    RequestToken(#[source] hyper_util::client::legacy::Error),
 
     /// Failed to retrieve new credential
     #[error("failed to retrieve new credential {0:?}")]
@@ -51,6 +55,10 @@ pub enum Error {
     #[error("failed to build request: {0}")]
     BuildRequest(#[source] http::Error),
 
+    /// No valid native root CA certificates found
+    #[error("No valid native root CA certificates found")]
+    NoValidNativeRootCA(#[source] std::io::Error),
+
     /// OAuth failed with unknown reason
     #[error("unknown OAuth error: {0}")]
     Unknown(String),
@@ -113,22 +121,23 @@ impl Gcp {
                 #[cfg(feature = "rustls-tls")]
                 let https = hyper_rustls::HttpsConnectorBuilder::new()
                     .with_native_roots()
+                    .map_err(Error::NoValidNativeRootCA)?
                     .https_only()
                     .enable_http1()
                     .build();
                 #[cfg(all(not(feature = "rustls-tls"), feature = "openssl-tls"))]
                 let https =
                     hyper_openssl::HttpsConnector::new().map_err(Error::CreateOpensslHttpsConnector)?;
 
-                let client = hyper::Client::builder().build::<_, hyper::Body>(https);
+                let client = hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https);
 
                 let res = client
-                    .request(request.map(hyper::Body::from))
+                    .request(request.map(Body::from))
                     .await
                     .map_err(Error::RequestToken)?;
                 // Convert response body to `Vec<u8>` for parsing.
                 let (parts, body) = res.into_parts();
-                let bytes = hyper::body::to_bytes(body).await.map_err(Error::ConcatBuffers)?;
+                let bytes = body.collect().await.map_err(Error::ConcatBuffers)?.to_bytes();
                 let response = http::Response::from_parts(parts, bytes.to_vec());
                 match self.provider.parse_token_response(scope_hash, response) {
                     Ok(token) => Ok(token),