Skip to content

Problem with load_kube_config() #1335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
spestua opened this issue Nov 25, 2020 · 10 comments
Closed

Problem with load_kube_config() #1335

spestua opened this issue Nov 25, 2020 · 10 comments
Labels
kind/bug Categorizes issue or PR as related to a bug. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.

Comments

@spestua
Copy link

spestua commented Nov 25, 2020

Hi, everyone!

I have a very strange problem with using my kubeconf.
When I try to execute the example code from README, but at the stage config.load_kube_config() an error appears:


Error Traceback (most recent call last)
in
63
64 apply_oid_token_monkey_patch()
---> 65 config.load_kube_config()
66
67 # v1 = client.CoreV1Api()

~/miniconda3/lib/python3.8/site-packages/kubernetes/config/kube_config.py in load_kube_config(config_file, context, client_configuration, persist_config)
796 if client_configuration is None:
797 config = type.call(Configuration)
--> 798 loader.load_and_set(config)
799 Configuration.set_default(config)
800 else:

~/miniconda3/lib/python3.8/site-packages/kubernetes/config/kube_config.py in load_and_set(self, client_configuration)
574
575 def load_and_set(self, client_configuration):
--> 576 self._load_authentication()
577 self._load_cluster_info()
578 self._set_config(client_configuration)

~/miniconda3/lib/python3.8/site-packages/kubernetes/config/kube_config.py in _load_authentication(self)
278 if not self._user:
279 return
--> 280 if self._load_auth_provider_token():
281 return
282 if self._load_user_token():

~/miniconda3/lib/python3.8/site-packages/kubernetes/config/kube_config.py in _load_auth_provider_token(self)
297 return self._load_azure_token(provider)
298 if provider['name'] == 'oidc':
--> 299 return self._load_oid_token(provider)
300
301 def _azure_is_expired(self, provider):

in load_oid_token_trace(self, provider)
39 if PY3:
40 jwt_attributes = json.loads(
---> 41 base64.b64decode(parts[1] + padding).decode('utf-8')
42 )
43 else:

~/miniconda3/lib/python3.8/base64.py in b64decode(s, altchars, validate)
85 if validate and not re.fullmatch(b'[A-Za-z0-9+/]*={0,2}', s):
86 raise binascii.Error('Non-base64 digit found')
---> 87 return binascii.a2b_base64(s)
88
89
Error: Incorrect padding

I changed one line in source a little bit:
FROM
https://github.com/kubernetes-client/python-base/blob/2da2b981ca806b25487ad92d01a2164815c18517/config/kube_config.py#L391
TO
base64.b64decode(parts[1].replace('-', '+') + padding).decode('utf-8')

And there were no more errors. Why? I can fix it in my configuration file, but it will break down here:
https://github.com/kubernetes-client/python-base/blob/2da2b981ca806b25487ad92d01a2164815c18517/config/kube_config.py#L374

You can see this problem in the following example:

import base64

part = 'eyJhY3IiOiIxIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiLQnNCw0LvQutC-0LIiLCJncm91cHMiOltdLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJrZW1hbGtvdiIsImZhbWlseV9uYW1lIjoi0JzQsNC70LrQvtCyIiwiZW1haWwiOiJrZW1hbGtvdkBiZWVsaW5lLnJ1In0'
padding = (4 - len(part) % 4) * '=' # padding = 1*'='
print(base64.b64decode(part+'=').decode('utf-8')) # > Error: Incorrect padding
print(base64.b64decode(part+'==').decode('utf-8')) # > UnicodeDecodeError
print(base64.b64decode(part.replace('-', '+')+'=').decode('utf-8')) # Work fine
print(base64.b64decode(part.replace('-', '+')+'==').decode('utf-8')) # Work fine

Python version: 3.8.3
Kubernetes-client version: 12.0.1
MacOS 10.15.7

@spestua spestua added the kind/bug Categorizes issue or PR as related to a bug. label Nov 25, 2020
spestua added a commit to spestua/python-base that referenced this issue Nov 30, 2020
Fixed the bug from kubernetes-client/python#1335

- added exception to JWT validation
- added a rule to fix the url unsafe characters
- changed base64.b64decode to base64.urlsafe_b64decode for correct oidc token encoding
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 24, 2021
@spestua
Copy link
Author

spestua commented Mar 2, 2021

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 2, 2021
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 31, 2021
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jun 30, 2021
@JiffsMaverick
Copy link

JiffsMaverick commented Jul 1, 2021

I have this problem too. File from kubernetes-client/python-base#220 solved this problem, but it hasn't merged yet.

@k8s-triage-robot
Copy link

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

@k8s-ci-robot
Copy link
Contributor

@k8s-triage-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot
Copy link
Contributor

@JiffsMaverick: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@JiffsMaverick
Copy link

This problem is still relevant. PR kubernetes-client/python-base#220 can solve this problem. Please, reopen.

@iicky
Copy link

iicky commented Jul 2, 2022

I'm also having this issue - any merge for the PR yet?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.
Projects
None yet
Development

No branches or pull requests

6 participants