prow/kube/client.go
func NewClient(c *Cluster, namespace string) (*Client, error) {
	// Relies on json encoding/decoding []byte as base64
	// https://golang.org/pkg/encoding/json/#Marshal
	cc := c.ClientCertificate
	ck := c.ClientKey
	ca := c.ClusterCACertificate

	cert, err := tls.X509KeyPair(cc, ck)
	if err != nil {
		return nil, err
	}

	cp := x509.NewCertPool()
	cp.AppendCertsFromPEM(ca)

	tr := &http.Transport{
		TLSClientConfig: &tls.Config{
			MinVersion:   tls.VersionTLS12,
			Certificates: []tls.Certificate{cert},
			RootCAs:      cp,
		},
	}
	return &Client{
		logger:    logrus.WithField("client", "kube"),
		baseURL:   c.Endpoint,
		client:    &http.Client{Transport: tr, Timeout: requestTimeout},
		namespace: namespace,
	}, nil
}
func NewClient(c *Cluster, namespace string) (*Client, error) {
	// Relies on json encoding/decoding []byte as base64
	// https://golang.org/pkg/encoding/json/#Marshal
	cc := c.ClientCertificate
	ck := c.ClientKey
	ca := c.ClusterCACertificate

	cert, err := tls.X509KeyPair(cc, ck)
	if err != nil {
		return nil, err
	}

	cp := x509.NewCertPool()
	cp.AppendCertsFromPEM(ca)

	tr := &http.Transport{
		TLSClientConfig: &tls.Config{
			MinVersion:   tls.VersionTLS12,
			Certificates: []tls.Certificate{cert},
			RootCAs:      cp,
		},
	}
	return &Client{
		logger:    logrus.WithField("client", "kube"),
		baseURL:   c.Endpoint,
		client:    &http.Client{Transport: tr, Timeout: requestTimeout},
		namespace: namespace,
	}, nil
}
// NewClient returns an authenticated Client using the keys in the Cluster.