code: def https_policy_from_config(config):
      
      server = config.cluster["server"]
      base_url = URL.fromText(native_string_to_unicode(server))
  
      ca_certs = pem.parse(config.cluster["certificate-authority"].bytes())
      if not ca_certs:
          raise ValueError("No certificate authority certificate found.")
      ca_cert = ca_certs[0]
  
      try:
          # Validate the certificate so we have early failures for garbage data.
          ssl.Certificate.load(ca_cert.as_bytes(), FILETYPE_PEM)
      except OpenSSLError as e:
          raise ValueError(
              "Invalid certificate authority certificate found.",
              str(e),
          )
  
      netloc = NetLocation(host=base_url.host, port=base_url.port)
      policy = ClientCertificatePolicyForHTTPS(
          credentials={},
          trust_roots={
              netloc: ca_cert,
          },
      )
      return policy
docs: Create an ``IPolicyForHTTPS`` which can authenticate a Kubernetes API
      server.
  
      :param KubeConfig config: A Kubernetes configuration containing an active
          context identifying a cluster.  The resulting ``IPolicyForHTTPS`` will
          authenticate the API server for that cluster.
  
      :return IPolicyForHTTPS: A TLS context which requires server certificates
          signed by the certificate authority certificate associated with the
          active context's cluster.