Error when connecting to gke cluster from kubernetes-incubator/client-python

10/31/2017

I'm trying to connect to my gke cluster using kubernetes-incubator/client-python library. I'm running just the basic query:

from kubernetes import client, config
# Configs can be set in Configuration class directly or using helper utility
config.load_kube_config()
v1 = client.CoreV1Api()
print("Listing pods with their IPs:")
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

And I'm getting an error:

--------------------------------------------------------------------------
RefreshError  Traceback (most recent call last)
<ipython-input-1-40695f414daf> in <module>()
      2 
      3 # Configs can be set in Configuration class directly or using helper utility
----> 4 config.load_kube_config()
      5 
      6 v1 = client.CoreV1Api()

/usr/local/lib/python2.7/distpackages/kubernetes/config/kube_config.pyc in 
load_kube_config(config_file, context, client_configuration, 
persist_config)
    359         config_file, active_context=context,
    360         client_configuration=client_configuration,    
--> 361         config_persister=config_persister).load_and_set()
    362 
    363 

/usr/local/lib/python2.7/dist-packages/kubernetes/config/kube_config.pyc in load_and_set(self)
    251 
    252     def load_and_set(self):
--> 253         self._load_authentication()
    254         self._load_cluster_info()
    255         self._set_config()

    /usr/local/lib/python2.7/dist-packages/kubernetes/config/kube_config.pyc in 
    _load_authentication(self)
        174         if not self._user:
        175             return

/usr/local/lib/python2.7/dist-packages/kubernetes/config/kube_config.pyc in _load_gcp_token(self)
    194                  _is_expired(provider['config']['expiry']))):
    195             # token is not available or expired, refresh it
--> 196             self._refresh_gcp_token()
    197 
    198         self.token = "Bearer %s" % provider['config']['access-token']

/usr/local/lib/python2.7/dist-packages/kubernetes/config/kube_config.pyc in _refresh_gcp_token(self)
    203             self._user['auth-provider'].value['config'] = {}
    204         provider = self._user['auth-provider']['config']
--> 205         credentials = self._get_google_credentials()
    206         provider.value['access-token'] = credentials.token
    207         provider.value['expiry'] = format_rfc3339(credentials.expiry)

/usr/local/lib/python2.7/dist-packages/kubernetes/config/kube_config.pyc in _refresh_credentials()
    133             credentials, project_id = google.auth.default()
    134             request = google.auth.transport.requests.Request()
--> 135             credentials.refresh(request)
    136             return credentials
    137 

/usr/local/lib/python2.7/dist-packages/google/oauth2/service_account.pyc in refresh(self, request)
    320         assertion = self._make_authorization_grant_assertion()
    321         access_token, expiry, _ = _client.jwt_grant(
--> 322             request, self._token_uri, assertion)
    323         self.token = access_token
    324         self.expiry = expiry

/usr/local/lib/python2.7/dist-packages/google/oauth2/_client.pyc in jwt_grant(request, token_uri, assertion)
    141     }
    142 
--> 143     response_data = _token_endpoint_request(request, token_uri, body)
    144 
    145     try:

/usr/local/lib/python2.7/dist-packages/google/oauth2/_client.pyc in _token_endpoint_request(request, token_uri, body)
    107 
    108     if response.status != http_client.OK:
--> 109         _handle_error_response(response_body)
    110 
    111     response_data = json.loads(response_body)

/usr/local/lib/python2.7/dist-packages/google/oauth2/_client.pyc in _handle_error_response(response_body)
     57 
     58     raise exceptions.RefreshError(
---> 59         error_details, response_body)
     60 
     61 

RefreshError: ('invalid_scope: Empty or missing scope not allowed.', u'{\n  "error" : "invalid_scope",\n  "error_description" : "Empty or missing scope not allowed."\n}')

I thought there was an issue with my kube.config file. So I removed it and created the cluster again in order to recreate a new kube.config file. The issue remained. Can you help me on this please?

-- Ayeshmantha Perera
authentication
google-kubernetes-engine
kubernetes
python

1 Answer

11/1/2017

This is an issue with your Google Cloud Platform credentials. They're not being found and you're not able to interact with the service. Here's some instructions on how to set those up. Either point the GOOGLE_APPLICATION_CREDENTIALS environment variable to your credentials file or authenticate through the SDK.

-- vascop
Source: StackOverflow