manully sync up to 1634d8f9f72a626b16c55573d78e8da2d75e6356

(merging https://github.com/kubernetes/kubernetes/pull/42084). For the new publish
script to work, client-go has to be synced up to when k8s.io/kubernetes doesn't
include _vendor

rest/config.go

@@ -83,10 +83,6 @@ type Config struct {
 	// TLSClientConfig contains settings to enable transport layer security
 	TLSClientConfig
 
-	// Server should be accessed without verifying the TLS
-	// certificate. For testing only.
-	Insecure bool
-
 	// UserAgent is an optional field that specifies the caller of this request.
 	UserAgent string
 
@@ -132,6 +128,13 @@ type ImpersonationConfig struct {
 
 // TLSClientConfig contains settings to enable transport layer security
 type TLSClientConfig struct {
+	// Server should be accessed without verifying the TLS certificate. For testing only.
+	Insecure bool
+	// ServerName is passed to the server for SNI and is used in the client to check server
+	// ceritificates against. If ServerName is empty, the hostname used to contact the
+	// server is used.
+	ServerName string
+
 	// Server requires TLS client certificate authentication
 	CertFile string
 	// Server requires TLS client certificate authentication
@@ -365,11 +368,12 @@ func AnonymousClientConfig(config *Config) *Config {
 		Prefix:        config.Prefix,
 		ContentConfig: config.ContentConfig,
 		TLSClientConfig: TLSClientConfig{
-			CAFile: config.TLSClientConfig.CAFile,
-			CAData: config.TLSClientConfig.CAData,
+			Insecure:   config.Insecure,
+			ServerName: config.ServerName,
+			CAFile:     config.TLSClientConfig.CAFile,
+			CAData:     config.TLSClientConfig.CAData,
 		},
 		RateLimiter:   config.RateLimiter,
-		Insecure:      config.Insecure,
 		UserAgent:     config.UserAgent,
 		Transport:     config.Transport,
 		WrapTransport: config.WrapTransport,

rest/config_test.go

@@ -70,8 +70,10 @@ func TestIsConfigTransportTLS(t *testing.T) {
 		},
 		{
 			Config: &Config{
-				Host:     "1.2.3.4:567",
-				Insecure: true,
+				Host: "1.2.3.4:567",
+				TLSClientConfig: TLSClientConfig{
+					Insecure: true,
+				},
 			},
 			TransportTLS: true,
 		},

rest/transport.go

@@ -78,13 +78,14 @@ func (c *Config) TransportConfig() (*transport.Config, error) {
 		Transport:     c.Transport,
 		WrapTransport: wt,
 		TLS: transport.TLSConfig{
-			CAFile:   c.CAFile,
-			CAData:   c.CAData,
-			CertFile: c.CertFile,
-			CertData: c.CertData,
-			KeyFile:  c.KeyFile,
-			KeyData:  c.KeyData,
-			Insecure: c.Insecure,
+			Insecure:   c.Insecure,
+			ServerName: c.ServerName,
+			CAFile:     c.CAFile,
+			CAData:     c.CAData,
+			CertFile:   c.CertFile,
+			CertData:   c.CertData,
+			KeyFile:    c.KeyFile,
+			KeyData:    c.KeyData,
 		},
 		Username:    c.Username,
 		Password:    c.Password,