feat: add timeouts when default client is in use

Go's default client has no timeouts and relies on the kernel timeouts,
which goes against the recommended practice of setting timeouts at
application-level whenever possible.

This change ensures that if the default client is used, it is used with
proper timeouts for TCP handshake, TLS handshake and HTTP
request-response lifecycle.

There is no emperical data for the value of 10 seconds.
It is a good starting point and a sane default. Users are encouraged to
create their own http.Client and many users already do so to control
TLSConfig.

kong/client.go

@@ -4,17 +4,24 @@ import (
 	"context"
 	"encoding/json"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
 	"os"
+	"time"
 
 	"github.com/pkg/errors"
 
 	"github.com/kong/go-kong/kong/custom"
 )
 
-const defaultBaseURL = "http://localhost:8001"
+const (
+	defaultBaseURL = "http://localhost:8001"
+	// DefaultTimeout is the timeout used for network connections and requests
+	// including TCP, TLS and HTTP layers.
+	DefaultTimeout = 60 * time.Second
+)
 
 var pageSize = 1000
 
@@ -87,7 +94,16 @@ type Status struct {
 // NewClient returns a Client which talks to Admin API of Kong
 func NewClient(baseURL *string, client *http.Client) (*Client, error) {
 	if client == nil {
-		client = http.DefaultClient
+		transport := &http.Transport{
+			DialContext: (&net.Dialer{
+				Timeout: DefaultTimeout,
+			}).DialContext,
+			TLSHandshakeTimeout: DefaultTimeout,
+		}
+		client = &http.Client{
+			Timeout:   DefaultTimeout,
+			Transport: transport,
+		}
 	}
 	kong := new(Client)
 	kong.client = client