KubernetesClientConfiguration is not thread-safe

[PSanetra]

Describe the bug
KubernetesClientConfiguration is mutated by the Kubernetes.Dispose() Method as the Kubernetes constructor just copies the reference to the SslCaCerts property and Kubernetes.Dispose() disposes that collection, which is actually coming from the KubernetesClientConfiguration instance.

See

csharp/src/KubernetesClient/Kubernetes.ConfigInit.cs

Line 26 in f55d1fa

CaCerts = config.SslCaCerts;

And

csharp/src/KubernetesClient/Kubernetes.cs

Lines 213 to 222 in f55d1fa

	// Dispose the certificates
	if (CaCerts is not null)
	{
	foreach (var caCert in CaCerts)
	{
	caCert.Dispose();
	}
	CaCerts.Clear();
	}

Kubernetes C# SDK Client Version
12.1.1

Server Kubernetes Version
v1.27.3

Dotnet Runtime Version
net7

To Reproduce

• Load a KubernetesClientConfiguration instance which contains SslCaCerts entries
• Pass that instance to the Kubernetes constructor
• Dispose the Kubernetes instance
• Check the KuberenetesClientConfiguration.SSlCaCerts collection
  • The collection is now empty

Expected behavior
The KubernetesClientConfiguration should not be modified. Maybe expose a Dispose method on the KubernetesClientConfiguration to dispose the CaCerts.

Alternatively document explicitly that a KubernetesClientConfiguration can be used only by exactly on Kubernetes instance and must be abandoned after passing it to a single Kubernetes constructor.

[tg123]

hmmm this is indeed an issue.
it is a bad design

let me re-think, your ideas are welcomed (assume no one read doc)

[PSanetra]

@tg123 I would suggest to replace the KubernetesClientConfiguration.SslCaCerts with simple string? ClusterEndpointCaCertData and string? ClusterEndpointCaCertPath properties and maybe provide a GetSslCaCerts() method for convenience. It would be the task of the caller of GetSslCaCerts() to dispose the returned collection and the included entries. One caller would be the Kubernetes class constructor.

For partial backwards compatibility SslCaCerts could become a get property and call the GetSslCaCerts() method internally. You could mark that property with the [ObsoleteAttribute]. This way most code bases would be notified about this change, but would not need to update for now if their usage is safe (create one KubernetesClientConfiguration instance per Kubernetes instance).