fix(watch): shutdown raw socket in stop() to prevent SSL read deadlocks

Author: aojea

kubernetes/base/watch/watch.py

@@ -93,6 +93,25 @@ def __init__(self, return_type=None):
 
     def stop(self):
         self._stop = True
+        if hasattr(self, '_resp') and self._resp:
+            import socket
+            try:
+                # Python SSL/socket GIL Workaround: Force-shutdown the raw socket under HTTP/1.1
+                # to immediately unblock the background thread blocked in CPython's ssl.read() recv_into
+                # call. This avoids deadlock where close() hangs waiting for SSL socket locks held by
+                # the blocked read call.
+                conn = getattr(self._resp, 'connection', None)
+                sock = getattr(conn, 'sock', None) if conn else None
+                if sock:
+                    sock.shutdown(socket.SHUT_RDWR)
+            except Exception:
+                pass
+            try:
+                self._resp.close()
+                self._resp.release_conn()
+            except Exception:
+                pass
+
 
     def get_return_type(self, func):
         if self._raw_return_type:
@@ -189,6 +208,7 @@ def stream(self, func, *args, **kwargs):
         deserialize = kwargs.pop('deserialize', True)
         while True:
             resp = func(*args, **kwargs)
+            self._resp = resp
             try:
                 for line in iter_resp_lines(resp):
                     # unmarshal when we are receiving events from watch,
@@ -226,6 +246,7 @@ def stream(self, func, *args, **kwargs):
             finally:
                 resp.close()
                 resp.release_conn()
+                self._resp = None
                 if self.resource_version is not None:
                     kwargs['resource_version'] = self.resource_version
                 else: