Fix Godeps.json to point to kubernetes-1.9.12-beta.0 tags

Automated cherry pick of #65799: Escape illegal characters in remote extra keys

Kubernetes-commit: da2670acf516d03b4e8b9889f403602669704507

Godeps/Godeps.json

@@ -380,331 +380,331 @@
 		},
 		{
 			"ImportPath": "k8s.io/api/admissionregistration/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/admissionregistration/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1beta2",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/authentication/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/authentication/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/authorization/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/authorization/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/autoscaling/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/autoscaling/v2beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v2alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/certificates/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/core/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/events/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/extensions/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/imagepolicy/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/networking/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/policy/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/scheduling/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/settings/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1alpha1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1beta1",
-			"Rev": "9273ee02527c608cecc74969b3e489f5dba686da"
+			"Rev": "1c927e0d5dea6770c2d95a8bcaddd8632b5a5c42"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/equality",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/errors",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/meta",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/resource",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/testing",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/testing/fuzzer",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/testing/roundtrip",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apimachinery",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apimachinery/announced",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apimachinery/registered",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/fuzzer",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/internalversion",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1alpha1",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/conversion",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/conversion/queryparams",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/fields",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/labels",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/schema",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/json",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/protobuf",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/recognizer",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/streaming",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/versioning",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/selection",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/types",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/cache",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/clock",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/diff",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/errors",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/framer",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/httpstream",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/httpstream/spdy",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/intstr",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/json",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/mergepatch",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/net",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/remotecommand",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/runtime",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/sets",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/strategicpatch",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/validation",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/validation/field",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/wait",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/yaml",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/version",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/watch",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/json",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/netutil",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/reflect",
-			"Rev": "fb40df2b502912cbe3a93aa61c2b2487f39cb42f"
+			"Rev": "1926e7bb5c13e9c651830fe950cb623071bb03d2"
 		},
 		{
 			"ImportPath": "k8s.io/kube-openapi/pkg/common",

scale/client_test.go

@@ -99,7 +99,7 @@ func fakeScaleClient(t *testing.T) (ScalesGetter, []schema.GroupResource) {
 
 	restMapperRes, err := discovery.GetAPIGroupResources(fakeDiscoveryClient)
 	if err != nil {
-		t.Fatalf("unexpected error while constructing resource list from fake discovery client: %v")
+		t.Fatalf("unexpected error while constructing resource list from fake discovery client: %v", err)
 	}
 	restMapper := discovery.NewRESTMapper(restMapperRes, apimeta.InterfacesForUnstructured)
 

transport/round_trippers.go

@@ -17,6 +17,7 @@ limitations under the License.
 package transport
 
 import (
+	"bytes"
 	"fmt"
 	"net/http"
 	"path/filepath"
@@ -160,7 +161,7 @@ func SetAuthProxyHeaders(req *http.Request, username string, groups []string, ex
 	}
 	for key, values := range extra {
 		for _, value := range values {
-			req.Header.Add("X-Remote-Extra-"+key, value)
+			req.Header.Add("X-Remote-Extra-"+headerKeyEscape(key), value)
 		}
 	}
 }
@@ -277,7 +278,7 @@ func (rt *impersonatingRoundTripper) RoundTrip(req *http.Request) (*http.Respons
 	}
 	for k, vv := range rt.impersonate.Extra {
 		for _, v := range vv {
-			req.Header.Add(ImpersonateUserExtraHeaderPrefix+k, v)
+			req.Header.Add(ImpersonateUserExtraHeaderPrefix+headerKeyEscape(k), v)
 		}
 	}
 
@@ -453,3 +454,110 @@ func (rt *debuggingRoundTripper) RoundTrip(req *http.Request) (*http.Response, e
 func (rt *debuggingRoundTripper) WrappedRoundTripper() http.RoundTripper {
 	return rt.delegatedRoundTripper
 }
+
+func legalHeaderByte(b byte) bool {
+	return int(b) < len(legalHeaderKeyBytes) && legalHeaderKeyBytes[b]
+}
+
+func shouldEscape(b byte) bool {
+	// url.PathUnescape() returns an error if any '%' is not followed by two
+	// hexadecimal digits, so we'll intentionally encode it.
+	return !legalHeaderByte(b) || b == '%'
+}
+
+func headerKeyEscape(key string) string {
+	var buf bytes.Buffer
+	for i := 0; i < len(key); i++ {
+		b := key[i]
+		if shouldEscape(b) {
+			// %-encode bytes that should be escaped:
+			// https://tools.ietf.org/html/rfc3986#section-2.1
+			fmt.Fprintf(&buf, "%%%02X", b)
+			continue
+		}
+		buf.WriteByte(b)
+	}
+	return buf.String()
+}
+
+// legalHeaderKeyBytes was copied from net/http/lex.go's isTokenTable.
+// See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
+var legalHeaderKeyBytes = [127]bool{
+	'%':  true,
+	'!':  true,
+	'#':  true,
+	'$':  true,
+	'&':  true,
+	'\'': true,
+	'*':  true,
+	'+':  true,
+	'-':  true,
+	'.':  true,
+	'0':  true,
+	'1':  true,
+	'2':  true,
+	'3':  true,
+	'4':  true,
+	'5':  true,
+	'6':  true,
+	'7':  true,
+	'8':  true,
+	'9':  true,
+	'A':  true,
+	'B':  true,
+	'C':  true,
+	'D':  true,
+	'E':  true,
+	'F':  true,
+	'G':  true,
+	'H':  true,
+	'I':  true,
+	'J':  true,
+	'K':  true,
+	'L':  true,
+	'M':  true,
+	'N':  true,
+	'O':  true,
+	'P':  true,
+	'Q':  true,
+	'R':  true,
+	'S':  true,
+	'T':  true,
+	'U':  true,
+	'W':  true,
+	'V':  true,
+	'X':  true,
+	'Y':  true,
+	'Z':  true,
+	'^':  true,
+	'_':  true,
+	'`':  true,
+	'a':  true,
+	'b':  true,
+	'c':  true,
+	'd':  true,
+	'e':  true,
+	'f':  true,
+	'g':  true,
+	'h':  true,
+	'i':  true,
+	'j':  true,
+	'k':  true,
+	'l':  true,
+	'm':  true,
+	'n':  true,
+	'o':  true,
+	'p':  true,
+	'q':  true,
+	'r':  true,
+	's':  true,
+	't':  true,
+	'u':  true,
+	'v':  true,
+	'w':  true,
+	'x':  true,
+	'y':  true,
+	'z':  true,
+	'|':  true,
+	'~':  true,
+}

transport/round_trippers_test.go

@@ -129,6 +129,32 @@ func TestImpersonationRoundTripper(t *testing.T) {
 				ImpersonateUserExtraHeaderPrefix + "Second": {"B", "b"},
 			},
 		},
+		{
+			name: "escape handling",
+			impersonationConfig: ImpersonationConfig{
+				UserName: "user",
+				Extra: map[string][]string{
+					"test.example.com/thing.thing": {"A", "a"},
+				},
+			},
+			expected: map[string][]string{
+				ImpersonateUserHeader:                                               {"user"},
+				ImpersonateUserExtraHeaderPrefix + `Test.example.com%2fthing.thing`: {"A", "a"},
+			},
+		},
+		{
+			name: "double escape handling",
+			impersonationConfig: ImpersonationConfig{
+				UserName: "user",
+				Extra: map[string][]string{
+					"test.example.com/thing.thing%20another.thing": {"A", "a"},
+				},
+			},
+			expected: map[string][]string{
+				ImpersonateUserHeader: {"user"},
+				ImpersonateUserExtraHeaderPrefix + `Test.example.com%2fthing.thing%2520another.thing`: {"A", "a"},
+			},
+		},
 	}
 
 	for _, tc := range tcs {
@@ -163,9 +189,10 @@ func TestImpersonationRoundTripper(t *testing.T) {
 
 func TestAuthProxyRoundTripper(t *testing.T) {
 	for n, tc := range map[string]struct {
-		username string
-		groups   []string
-		extra    map[string][]string
+		username      string
+		groups        []string
+		extra         map[string][]string
+		expectedExtra map[string][]string
 	}{
 		"allfields": {
 			username: "user",
@@ -174,6 +201,34 @@ func TestAuthProxyRoundTripper(t *testing.T) {
 				"one": {"alpha", "bravo"},
 				"two": {"charlie", "delta"},
 			},
+			expectedExtra: map[string][]string{
+				"one": {"alpha", "bravo"},
+				"two": {"charlie", "delta"},
+			},
+		},
+		"escaped extra": {
+			username: "user",
+			groups:   []string{"groupA", "groupB"},
+			extra: map[string][]string{
+				"one":             {"alpha", "bravo"},
+				"example.com/two": {"charlie", "delta"},
+			},
+			expectedExtra: map[string][]string{
+				"one":               {"alpha", "bravo"},
+				"example.com%2ftwo": {"charlie", "delta"},
+			},
+		},
+		"double escaped extra": {
+			username: "user",
+			groups:   []string{"groupA", "groupB"},
+			extra: map[string][]string{
+				"one": {"alpha", "bravo"},
+				"example.com/two%20three": {"charlie", "delta"},
+			},
+			expectedExtra: map[string][]string{
+				"one": {"alpha", "bravo"},
+				"example.com%2ftwo%2520three": {"charlie", "delta"},
+			},
 		},
 	} {
 		rt := &testRoundTripper{}
@@ -214,7 +269,7 @@ func TestAuthProxyRoundTripper(t *testing.T) {
 				actualExtra[extraKey] = append(actualExtra[key], values...)
 			}
 		}
-		if e, a := tc.extra, actualExtra; !reflect.DeepEqual(e, a) {
+		if e, a := tc.expectedExtra, actualExtra; !reflect.DeepEqual(e, a) {
 			t.Errorf("%s expected %v, got %v", n, e, a)
 			continue
 		}
@@ -277,3 +332,58 @@ func TestCacheRoundTripper(t *testing.T) {
 		t.Errorf("Invalid content read from cache %q", string(content))
 	}
 }
+
+// TestHeaderEscapeRoundTrip tests to see if foo == url.PathUnescape(headerEscape(foo))
+// This behavior is important for client -> API server transmission of extra values.
+func TestHeaderEscapeRoundTrip(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name string
+		key  string
+	}{
+		{
+			name: "alpha",
+			key:  "alphabetical",
+		},
+		{
+			name: "alphanumeric",
+			key:  "alph4num3r1c",
+		},
+		{
+			name: "percent encoded",
+			key:  "percent%20encoded",
+		},
+		{
+			name: "almost percent encoded",
+			key:  "almost%zzpercent%xxencoded",
+		},
+		{
+			name: "illegal char & percent encoding",
+			key:  "example.com/percent%20encoded",
+		},
+		{
+			name: "weird unicode stuff",
+			key:  "example.com/ᛒᚥᛏᛖᚥᚢとロビン",
+		},
+		{
+			name: "header legal chars",
+			key:  "abc123!#$+.-_*\\^`~|'",
+		},
+		{
+			name: "legal path, illegal header",
+			key:  "@=:",
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			escaped := headerKeyEscape(tc.key)
+			unescaped, err := url.PathUnescape(escaped)
+			if err != nil {
+				t.Fatalf("url.PathUnescape(%q) returned error: %v", escaped, err)
+			}
+			if tc.key != unescaped {
+				t.Errorf("url.PathUnescape(headerKeyEscape(%q)) returned %q, wanted %q", tc.key, unescaped, tc.key)
+			}
+		})
+	}
+}