func HTTPWrappersForConfig(config *Config, rt http.RoundTripper) (http.RoundTripper, error) {
	hasBasicAuth := config.Username != "" || config.Password != ""
	if hasBasicAuth && config.BearerToken != "" {
		return nil, fmt.Errorf("username/password or bearer token may be set, but not both")
	}
	switch {
	case config.BearerToken != "":
		rt = NewBearerAuthRoundTripper(config.BearerToken, rt)
	case hasBasicAuth:
		rt = NewBasicAuthRoundTripper(config.Username, config.Password, rt)
	}
	if len(config.UserAgent) > 0 {
		rt = NewUserAgentRoundTripper(config.UserAgent, rt)
	}
	return rt, nil
}
HTTPWrappersForConfig wraps a round tripper with any relevant layered behavior from the
config. Exposed to allow more clients that need HTTP-like behavior but then must hijack
the underlying connection (like WebSocket or HTTP2 clients). Pure HTTP clients should use
the higher level TransportFor or RESTClientFor methods.
package client
import (
	"fmt"
	"net"
	"net/http"
	"net/url"
	"os"
	"path"
	"reflect"
	gruntime "runtime"
	"strings"
	"time"
	"github.com/GoogleCloudPlatform/kubernetes/pkg/api/latest"
	"github.com/GoogleCloudPlatform/kubernetes/pkg/runtime"
	"github.com/GoogleCloudPlatform/kubernetes/pkg/version"
)
type Config struct {
	Host string
	Prefix string
	Version string
	LegacyBehavior bool
	Codec runtime.Codec
	Username string
	Password string
	BearerToken string
	TLSClientConfig
	Insecure bool
	UserAgent string
	Transport http.RoundTripper
}
type KubeletConfig struct {
	Port        uint
	EnableHttps bool
	TLSClientConfig
}
type TLSClientConfig struct {
	CertFile string
	KeyFile string
	CAFile string
	CertData []byte
	KeyData []byte
	CAData []byte
}
func New(c *Config) (*Client, error) {
	config := *c
	if err := SetKubernetesDefaults(&config); err != nil {
		return nil, err
	}
	client, err := RESTClientFor(&config)
	if err != nil {
		return nil, err
	}
	return &Client{client}, nil
}
func MatchesServerVersion(c *Config) error {
	client, err := New(c)
	if err != nil {
		return err
	}
	clientVersion := version.Get()
	serverVersion, err := client.ServerVersion()
	if err != nil {
		return fmt.Errorf("couldn't read version from server: %v\n", err)
	}
	if s := *serverVersion; !reflect.DeepEqual(clientVersion, s) {
		return fmt.Errorf("server version (%#v) differs from client version (%#v)!\n", s, clientVersion)
	}
	return nil
}
func NewOrDie(c *Config) *Client {
	client, err := New(c)
	if err != nil {
		panic(err)
	}
	return client
}
func SetKubernetesDefaults(config *Config) error {
	if config.Prefix == "" {
		config.Prefix = "/api"
	}
	if len(config.UserAgent) == 0 {
		config.UserAgent = DefaultKubernetesUserAgent()
	}
	if len(config.Version) == 0 {
		config.Version = defaultVersionFor(config)
	}
	version := config.Version
	versionInterfaces, err := latest.InterfacesFor(version)
	if err != nil {
		return fmt.Errorf("API version '%s' is not recognized (valid values: %s)", version, strings.Join(latest.Versions, ", "))
	}
	if config.Codec == nil {
		config.Codec = versionInterfaces.Codec
	}
	config.LegacyBehavior = (version == "v1beta1" || version == "v1beta2")
	return nil
}
func RESTClientFor(config *Config) (*RESTClient, error) {
	if len(config.Version) == 0 {
		return nil, fmt.Errorf("version is required when initializing a RESTClient")
	}
	if config.Codec == nil {
		return nil, fmt.Errorf("Codec is required when initializing a RESTClient")
	}
	baseURL, err := defaultServerUrlFor(config)
	if err != nil {
		return nil, err
	}
	client := NewRESTClient(baseURL, config.Version, config.Codec, config.LegacyBehavior)
	transport, err := TransportFor(config)
	if err != nil {
		return nil, err
	}
	if transport != http.DefaultTransport {
		client.Client = &http.Client{Transport: transport}
	}
	return client, nil
}
func TransportFor(config *Config) (http.RoundTripper, error) {
	hasCA := len(config.CAFile) > 0 || len(config.CAData) > 0
	hasCert := len(config.CertFile) > 0 || len(config.CertData) > 0
	if config.Transport != nil && (hasCA || hasCert || config.Insecure) {
		return nil, fmt.Errorf("using a custom transport with TLS certificate options or the insecure flag is not allowed")
	}
	tlsConfig, err := TLSConfigFor(config)
	if err != nil {
		return nil, err
	}
	var transport http.RoundTripper
	if config.Transport != nil {
		transport = config.Transport
	} else {
		if tlsConfig != nil {
			transport = &http.Transport{
				TLSClientConfig: tlsConfig,
				Proxy:           http.ProxyFromEnvironment,
				Dial: (&net.Dialer{
					Timeout:   30 * time.Second,
					KeepAlive: 30 * time.Second,
				}).Dial,
				TLSHandshakeTimeout: 10 * time.Second,
			}
		} else {
			transport = http.DefaultTransport
		}
	}
	transport, err = HTTPWrappersForConfig(config, transport)
	if err != nil {
		return nil, err
	}
	return transport, nil
}