Merge pull request #63219 from liggitt/automated-cherry-pick-of-#62654-upstream-release-1.9

Automatic merge from submit-queue.

Automated cherry pick of #62654: Ensure service routing resolves kubernetes.default.svc

Cherry pick of #62654 on release-1.9.

#62654: Ensure service routing resolves kubernetes.default.svc

```release-note
Fixes the kubernetes.default.svc loopback service resolution to use a loopback configuration.
```

Kubernetes-commit: b6222f0609982f7b1ecf7caeef434e8f61e49194

transport/cache.go

@@ -59,7 +59,7 @@ func (c *tlsTransportCache) get(config *Config) (http.RoundTripper, error) {
 		return nil, err
 	}
 	// The options didn't require a custom TLS config
-	if tlsConfig == nil {
+	if tlsConfig == nil && config.Dial == nil {
 		return http.DefaultTransport, nil
 	}
 
@@ -88,5 +88,5 @@ func tlsConfigKey(c *Config) (string, error) {
 		return "", err
 	}
 	// Only include the things that actually affect the tls.Config
-	return fmt.Sprintf("%v/%x/%x/%x/%v", c.TLS.Insecure, c.TLS.CAData, c.TLS.CertData, c.TLS.KeyData, c.TLS.ServerName), nil
+	return fmt.Sprintf("%v/%x/%x/%x/%v/%v", c.TLS.Insecure, c.TLS.CAData, c.TLS.CertData, c.TLS.KeyData, c.TLS.ServerName, fmt.Sprintf("%p", c.Dial)), nil
 }

transport/cache_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package transport
 
 import (
+	"net"
 	"net/http"
 	"testing"
 )
@@ -53,6 +54,8 @@ func TestTLSConfigKey(t *testing.T) {
 	// Make sure config fields that affect the tls config affect the cache key
 	uniqueConfigurations := map[string]*Config{
 		"no tls":   {},
+		"dialer":   {Dial: net.Dial},
+		"dialer2":  {Dial: func(network, address string) (net.Conn, error) { return nil, nil }},
 		"insecure": {TLS: TLSConfig{Insecure: true}},
 		"cadata 1": {TLS: TLSConfig{CAData: []byte{1}}},
 		"cadata 2": {TLS: TLSConfig{CAData: []byte{2}}},
@@ -104,11 +107,6 @@ func TestTLSConfigKey(t *testing.T) {
 	}
 	for nameA, valueA := range uniqueConfigurations {
 		for nameB, valueB := range uniqueConfigurations {
-			// Don't compare to ourselves
-			if nameA == nameB {
-				continue
-			}
-
 			keyA, err := tlsConfigKey(valueA)
 			if err != nil {
 				t.Errorf("Unexpected error for %q: %v", nameA, err)
@@ -119,6 +117,15 @@ func TestTLSConfigKey(t *testing.T) {
 				t.Errorf("Unexpected error for %q: %v", nameB, err)
 				continue
 			}
+
+			// Make sure we get the same key on the same config
+			if nameA == nameB {
+				if keyA != keyB {
+					t.Errorf("Expected identical cache keys for %q and %q, got:\n\t%s\n\t%s", nameA, nameB, keyA, keyB)
+				}
+				continue
+			}
+
 			if keyA == keyB {
 				t.Errorf("Expected unique cache keys for %q and %q, got:\n\t%s\n\t%s", nameA, nameB, keyA, keyB)
 				continue

transport/transport.go

@@ -52,7 +52,7 @@ func New(config *Config) (http.RoundTripper, error) {
 // TLSConfigFor returns a tls.Config that will provide the transport level security defined
 // by the provided Config. Will return nil if no transport level security is requested.
 func TLSConfigFor(c *Config) (*tls.Config, error) {
-	if !(c.HasCA() || c.HasCertAuth() || c.TLS.Insecure) {
+	if !(c.HasCA() || c.HasCertAuth() || c.TLS.Insecure || len(c.TLS.ServerName) > 0) {
 		return nil, nil
 	}
 	if c.HasCA() && c.TLS.Insecure {

transport/transport_test.go

@@ -101,6 +101,13 @@ func TestNew(t *testing.T) {
 			Config:  &Config{},
 		},
 
+		"server name": {
+			TLS: true,
+			Config: &Config{TLS: TLSConfig{
+				ServerName: "foo",
+			}},
+		},
+
 		"ca transport": {
 			TLS: true,
 			Config: &Config{