无法用 python 客户端完成 kube.netes 集群认证步骤

Question

I want to authenticate to a kube.netes cluster through python client library from here . The cluster information:

Kube.netes control plane is running at https://127.0.0.1:34823
CoreDNS is running at https://127.0.0.1:34823/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

I did all the steps with no problem. But in:

curl -s -k -XGET -H "Authorization: Bearer $KIND_TOKEN" -H "Accept: application/json, */*" -H "Content-Type: application/json" \
    -H "kubernetes/$Format" 'https://127.0.0.1:34823/api/v1/namespaces/default/pods/example' | jq .status.phase

got error:

jq: error (at:12): Cannot index string with string "phase"

Also once I tried to test:

from kubernetes import client
import os

configuration = client.Configuration()
configuration.api_key_prefix["authorization"] = "Bearer"
configuration.host = "https://127.0.0.1:34823"
configuration.api_key["authorization"] = os.getenv("KIND_TOKEN", None)
configuration.verify_ssl = False  # Only for testing with KinD!
api_client = client.ApiClient(configuration)
v1 = client.CoreV1Api(api_client)

ret = v1.list_namespaced_pod(namespace="default", watch=False)
for pod in ret.items:
    print(f"Name: {pod.metadata.name}, Namespace: {pod.metadata.namespace} IP: {pod.status.pod_ip}")

An other error:

MaxRetryError: HTTPConnectionPool(host=' https', port=80): Max retries exceeded with url: //127.0.0.1:34823/api/v1/namespaces/default/pods?watch=False (Caused by ProtocolError('Connection aborted.', InvalidURL("URL can't contain control characters. ' https' (found at least ' ')")))

The jq version is jq-1.6 .

Answer 1

This document helps you to know more about bearer token authentication

Here are the steps for bearer token authentication.

First, create a file with the following contents to create a service account in the desired namespace.

apiVersion: v1 
kind: ServiceAccount 
metadata: 
name: <name_of_service_account>

The service account will then be created using this file.

kubectl create -f <path_to_file> --namespace=<namespace_name>

A bearer token that is linked to each service account can be used for authentication. The namespace automatically mounts this bearer token as a secret. Use the secret's name (of the form " service_account_name>-token-random_string> ) to get to the content in order to determine what this token is.

# To search for out service account's token name kubectl get secrets --namespace=<namespace_name>


# To find the token name
 kubectl describe secret/<secret_name>

After this, you should be able to determine the API server's IP address and the kube.netes cluster's Cluster CA certificate. Go to the Google Cloud Console kube.netes engine detail page to accomplish this. Put the certificate's content into a local file.

The bearer token can now be used to authenticate with the kube.netes python client in the following ways:

from kubernetes import client
configuration = client.Configuration() 
configuration.api_key["authorization"] = '<bearer_token>’
configuration.api_key_prefix['authorization'] = 'Bearer'
 configuration.host = 'https://<ip_of_api_server>' 
configuration.ssl_ca_cert = '<path_to_cluster_ca_certificate>'
v1 = client.CoreV1Api(client.ApiClient(configuration))

Refer this stack link 1 and stack link 2 will be helpful to resolve your issue