K
Q

K8S API access with client certificate using python client

9/1/2019

My purpose is to access my k8s API from a remote server using python client and client certificate, which is working with curl like this:

curl --key /XXX/XXX.key --cert /XXX/XXX.crt --cacert /XXX/XXX.crt https://api-k8s.XXX-XXX.XXX-XXX-/api/v1/pods

My code is:

configuration = client.Configuration()

configuration.host = 'https://api-XXXX'
configuration.ssl_ca_cert = '/XXX/xxx.crt'
configuration.cert_file = '/XXX/xxx.crt'
configuration.key_file = '/XXX/xxx.key'
configuration.verify_ssl = True

v1 = client.CoreV1Api(client.ApiClient(configuration))

ret = v1.list_pod_for_all_namespaces()

but getting:

urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='XXX', port=443): Max retries exceeded with url: /api/v1/pods (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)'),))

If you have any ideas what I am missing would be greatly appreciated!

-- Georgios
kubernetes
kubernetes-python-client
python

Similar Questions

Is Istio a “must” in a Kubernetes cluster
Kubernetes build django + uwsgi + nginx show failed (111: Connection refused) while connecting to upstream
Best way to set-up kubernetes on google for housing several clients
How can I sniff all DNS records from kuberenetes?
deleting a kubernetes pod within dotnet app
Kubernetes ingress nginx redirect to https
Ingress return 404
How do I add sidecar containers on the prometheus stable Helm Charts values.yaml file?

1 Answer

9/1/2019

I just reproduced your scenario, and it works perfectly on python 2.7

This is the code:

from kubernetes import client

configuration = client.Configuration()

configuration.host = 'https://10.132.0.25:6443'
configuration.ssl_ca_cert = './ca.crt'
configuration.cert_file = './client.crt'
configuration.key_file = './client.key'
configuration.verify_ssl = True

v1 = client.CoreV1Api(client.ApiClient(configuration))

ret = v1.list_pod_for_all_namespaces()

for i in ret.items:
  print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

...and the result:

$ python test.py 
192.168.171.66  kube-system     calico-kube-controllers-65b8787765-h7qv7
10.132.0.25     kube-system     calico-node-t4r4v
10.132.0.26     kube-system     calico-node-zbtjm
192.168.171.65  kube-system     coredns-5c98db65d4-rm2qh
192.168.171.67  kube-system     coredns-5c98db65d4-sr67s
10.132.0.25     kube-system     etcd-master
10.132.0.25     kube-system     kube-apiserver-master
10.132.0.25     kube-system     kube-controller-manager-master
10.132.0.26     kube-system     kube-proxy-759gn
10.132.0.25     kube-system     kube-proxy-v5hvc
10.132.0.25     kube-system     kube-scheduler-master

I created the cluster with kubeadm. It is running 1.15.3

$ kubectl get no
NAME     STATUS   ROLES    AGE   VERSION
master   Ready    master   41m   v1.15.3
worker   Ready    worker   41m   v1.15.3

Finally, client libraries:

$ pip freeze | grep -E 'kubernetes|requests'
kubernetes==10.0.1
requests==2.22.0

To troubleshoot more, more information is needed; regarding versions especially. But your code works fine.

EDIT: It worked on python3 as well:

$ python3 test.py 
192.168.171.66  kube-system     calico-kube-controllers-65b8787765-h7qv7
10.132.0.25     kube-system     calico-node-t4r4v
10.132.0.26     kube-system     calico-node-zbtjm
192.168.171.65  kube-system     coredns-5c98db65d4-rm2qh
192.168.171.67  kube-system     coredns-5c98db65d4-sr67s
10.132.0.25     kube-system     etcd-master
10.132.0.25     kube-system     kube-apiserver-master
10.132.0.25     kube-system     kube-controller-manager-master
10.132.0.26     kube-system     kube-proxy-759gn
10.132.0.25     kube-system     kube-proxy-v5hvc
10.132.0.25     kube-system     kube-scheduler-master
-- suren
Source: StackOverflow