Upgrade to okhttp3 or better yet, use a HTTP client facade like Feign

[asarkar]

I see that a 4.0.0.-beta-1 branch is in development. This will be a good time to upgrade the OkHttp client to the latest. The migration is relatively painless. The 2.7.5 version been used is almost 2.5 years old, and of course, has been abandoned in favor of okhttp3.

Another option, albeit more ambitious, would be to use a Facade like Feign that lets the users plugin in their own HTTP clients. That would be extremely useful in many projects where people heavily customize HTTP clients for timeouts, SSL settings and what not.

[brendandburns]

This code is all auto-generated by swagger-codegen:

https://github.com/swagger-api/swagger-codegen/tree/master/modules/swagger-codegen/src/main/resources/Java/libraries

I see that there is a feign generator, you could try re-generating with that generator...

Alternately you could upgrade the okhttp-gson client to use okhttp3:

https://github.com/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen/src/main/resources/Java/libraries/okhttp-gson/api.mustache

[asarkar]

@brendandburns I'm not clear on what you're suggesting. I'm not compiling the code myself, I'm picking up the 3.0.0 from Maven Central. I also checked the 4.0.0.-beta-1 pom.xml, and the version is clearly 2.7.5.

[brendandburns]

@asarkar I don't think that the 2.7 and 3.0 APIs are the same, thus I don't think we can just upgrade the pom file.

either way, we can't make changes to the generated code (or pom) in this repository, it needs to be done in the swagger-codegen repository.

[asarkar]

@brendandburns It's unlikely that swagger will agree to simply upgrading a client version; perhaps a new module could be created for okhttp3?
As for the API, from what i've seen, the difference is mostly in the package names, and addition of some fluent builders. It is true that the migration is not simply a POM change, but it is also true that it's very straightforward.

What do you think?

[brendandburns]

Maybe we should just try generating with the feign module instead?

I think either path would be fine. Let me know if you need pointers to the code to get started.

[tedli]

I use Spring Boot and Cloud out of cluster, and call in-cluster services by using kubernetes proxy api. By Config.fromConfig or Config.fromToken, I got an ApiClient instance, then a RestTemplate could be initialized like this

new RestTemplate(new OkHttpClientHttpRequestFactory(client.getHttpClient()))

Everything goes as expect.

However, after I upgrade Spring framework, okhttp2 had been removed, only OkHttp3ClientHttpRequestFactory available which can not constructed by using an okhttp2 client.

So it will be a great help if client-java upgrade okhttp to v3.*

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[asarkar]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[asarkar]

/remove-lifecycle stale

[alannakelly]

Since 20 August 2019 JFrog X-Ray is reporting a High Severity security issue with OkHttp 2.70-2.75:

"OkHttp Cached HTTP / HTTP/2 Headers Non-ASCII Character Handling Remote DoS"

This is getting flagged in a scan on a project using Java Kubernetes Client 5.0.0 as OkHttp 2.75 is a dependency.

[nicktrav]

I have a PR open on swagger to update the okhttp-gson client to version 3.x, if anyone is interested in chiming in: swagger-api/swagger-codegen#9632

I was also made aware today that swagger-codegen was forked last year into openapi-generator, and there is also a ticket to switch to using that library: kubernetes-client/gen/issues/93.

openapi-generator already uses 3.x of OkHttp, so this would most likely solve for this issue.

@brendanburns - thoughts on closing this out in favor of the openapi-generator route?

[nicktrav]

Here's the link to the equivalent client in openapi-generator using the latest 3.x version of OkHttp:
https://github.com/OpenAPITools/openapi-generator/blob/v4.1.1/modules/openapi-generator/src/main/resources/Java/libraries/okhttp-gson/pom.mustache#L312

[brendanburns]

We want to get to openapi-generator but there are currently build errors with their generated code, Min was looking into it a while ago...

…

On Tue, Aug 27, 2019, 7:42 AM Nick Travers ***@***.***> wrote: Here's the link to the equivalent client in openapi-generator using the latest 3.x version of OkHttp: https://github.com/OpenAPITools/openapi-generator/blob/v4.1.1/modules/openapi-generator/src/main/resources/Java/libraries/okhttp-gson/pom.mustache#L312 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#430?email_source=notifications&email_token=AAJZQXT7AE3HO7B2NN4B6MLQGU4M7A5CNFSM4GCXPUV2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5H7HJA#issuecomment-525333412>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJZQXWAJV6OLOQH2F43SJTQGU4M7ANCNFSM4GCXPUVQ> .

[brendandburns]

Update, we just merged the switch to openapi generator and okhttp3.

We will cut a 7.0.0 release soon.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[brendandburns]

Closing this as we have switched to okhttp3 in the latest clients.