From e19267631952e4e7450f650cbc30bd7c9b1bab0c Mon Sep 17 00:00:00 2001
From: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Date: Thu, 13 Aug 2026 19:58:44 +0200
Subject: [PATCH] Read proxy-url from kubeconfig cluster

load_kube_config() ignored the cluster's proxy-url field, so
Configuration.proxy stayed unset and requests bypassed the proxy.
The async loader already handles it.
---
 kubernetes/base/config/kube_config.py      |  5 +++-
 kubernetes/base/config/kube_config_test.py | 35 ++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/kubernetes/base/config/kube_config.py b/kubernetes/base/config/kube_config.py
index 65d17b0c71..d9e735b9ab 100644
--- a/kubernetes/base/config/kube_config.py
+++ b/kubernetes/base/config/kube_config.py
@@ -523,6 +523,8 @@ def _load_cluster_info(self):
             self.verify_ssl = not self._cluster['insecure-skip-tls-verify']
         if 'tls-server-name' in self._cluster:
             self.tls_server_name = self._cluster['tls-server-name']
+        if 'proxy-url' in self._cluster:
+            self.proxy = self._cluster['proxy-url']
 
     def _set_config(self, client_configuration):
         if 'token' in self.__dict__:
@@ -534,7 +536,8 @@ def _refresh_api_key(client_configuration):
                 self._set_config(client_configuration)
             client_configuration.refresh_api_key_hook = _refresh_api_key
         # copy these keys directly from self to configuration object
-        keys = ['host', 'ssl_ca_cert', 'cert_file', 'key_file', 'verify_ssl','tls_server_name']
+        keys = ['host', 'ssl_ca_cert', 'cert_file', 'key_file', 'verify_ssl',
+                'tls_server_name', 'proxy']
         for key in keys:
             if key in self.__dict__:
                 setattr(client_configuration, key, getattr(self, key))
diff --git a/kubernetes/base/config/kube_config_test.py b/kubernetes/base/config/kube_config_test.py
index dce8522b0a..0b07859254 100644
--- a/kubernetes/base/config/kube_config_test.py
+++ b/kubernetes/base/config/kube_config_test.py
@@ -102,6 +102,7 @@ def _raise_exception(st):
 TEST_CLIENT_CERT = "client-cert"
 TEST_CLIENT_CERT_BASE64 = _base64(TEST_CLIENT_CERT)
 TEST_TLS_SERVER_NAME = "kubernetes.io"
+TEST_PROXY_URL = "http://proxy.example.com:3128"
 
 TEST_OIDC_TOKEN = "test-oidc-token"
 TEST_OIDC_INFO = "{\"name\": \"test\"}"
@@ -580,6 +581,13 @@ class TestKubeConfigLoader(BaseTestCase):
                     "user": "ssl"
                 }
             },
+            {
+                "name": "proxy_cluster_context",
+                "context": {
+                    "cluster": "proxy_cluster",
+                    "user": "simple_token"
+                }
+            },
         ],
         "clusters": [
             {
@@ -632,6 +640,13 @@ class TestKubeConfigLoader(BaseTestCase):
                     "tls-server-name": TEST_TLS_SERVER_NAME,
                 }
             },
+            {
+                "name": "proxy_cluster",
+                "cluster": {
+                    "server": TEST_HOST,
+                    "proxy-url": TEST_PROXY_URL,
+                }
+            },
         ],
         "users": [
             {
@@ -1136,6 +1151,18 @@ def test_tls_server_name(self):
             active_context="tls-server-name").load_and_set(actual)
         self.assertEqual(expected, actual)
 
+    def test_proxy_url_from_cluster(self):
+        expected = FakeConfig(
+            host=TEST_HOST,
+            token=BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
+            proxy=TEST_PROXY_URL,
+        )
+        actual = FakeConfig()
+        KubeConfigLoader(
+            config_dict=self.TEST_KUBE_CONFIG,
+            active_context="proxy_cluster_context").load_and_set(actual)
+        self.assertEqual(expected, actual)
+
     def test_list_contexts(self):
         loader = KubeConfigLoader(
             config_dict=self.TEST_KUBE_CONFIG,
@@ -1285,6 +1312,14 @@ def test_new_client_from_config(self):
         self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
                          client.configuration.api_key['BearerToken'])
 
+    def test_new_client_from_config_proxy(self):
+        config_file = self._create_temp_file(
+            yaml.safe_dump(self.TEST_KUBE_CONFIG))
+        client = new_client_from_config(
+            config_file=config_file, context="proxy_cluster_context")
+        self.assertEqual(TEST_HOST, client.configuration.host)
+        self.assertEqual(TEST_PROXY_URL, client.configuration.proxy)
+
     def test_new_client_from_config_dict(self):
         client = new_client_from_config_dict(
             config_dict=self.TEST_KUBE_CONFIG, context="simple_token")