0

I have python code that:

I was using Kubernetes version 1.11, but on 12/9/2019 this version was removed from GKE so I switched to 1.12.

Since I moved to 1.12, interactions with kubernetes stopped working, with following error:

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "/usr/local/lib/python3.7/runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "/usr/local/lib/python3.7/site-packages/mypackage/__main__.py", line 89, in <module>
    function(**function_args)
  File "/usr/local/lib/python3.7/site-packages/mypackage/env.py", line 50, in create
    kubernetes.config.load_kube_config(config_file=mypackage.googlecloud.kubernetesengine.config)
  File "/usr/local/lib/python3.7/site-packages/kubernetes/config/kube_config.py", line 649, in load_kube_config
    loader.load_and_set(config)
  File "/usr/local/lib/python3.7/site-packages/kubernetes/config/kube_config.py", line 462, in load_and_set
    self._load_cluster_info()
  File "/usr/local/lib/python3.7/site-packages/kubernetes/config/kube_config.py", line 428, in _load_cluster_info
    file_base_path=base_path).as_file()
  File "/usr/local/lib/python3.7/site-packages/kubernetes/config/kube_config.py", line 101, in __init__
    self._data = obj[data_key_name]
  File "/usr/local/lib/python3.7/site-packages/kubernetes/config/kube_config.py", line 499, in __getitem__
    % (key, self.name))
kubernetes.config.config_exception.ConfigException: Invalid kube-config file. Expected key username in /root/.kube/config/{'name': 'my-user', 'user': {'username': None, 'password': None}}/user

It turns out my python code was building ~/.kube/config with empty username & password, because get_cluster() method is not anymore returning username & password in master_auth.

Not more success using command gcloud container clusters describe, field masterAuth is still pretty much empty.

Why does the GKE server not send anymore those information?

2 Answers 2

1

From Hardening your cluster's security:

Note: Basic authentication and client certificate issuance are disabled by default for clusters created with GKE 1.12 and higher.

The guide recommends disabling your cluster's client certificate and static password authentication methods. Given that the default has switched to disabled by default, it's possible it will no longer be possible to enable basic auth in the future, so you might investigate whether it is possible to rework your application to use a different method for authentication / authorization.

0

I specified username & password myself on cluster creation, and it fixed the issue:

import google.cloud.container_v1

client = google.cloud.container_v1.ClusterManagerClient()

client.create_cluster(

    # see https://github.com/googleapis/google-cloud-python/issues/8692#issuecomment-512442117
    project_id=None,
    zone=None,
    #

    cluster={
        "name": "name",
        "master_auth": {
            "username": my_username,
            "password": my_password
        }

        ...

    }
)

Now server is returning .master_auth.username & .master_auth.password on get_cluster().

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .