<p>I have created an Autopilot cluster on GKE</p>
<p>I want to connect and manage it with <a href="https://github.com/kubernetes-client/python" rel="nofollow noreferrer">Python Kubernetes Client</a></p>
<p>I am able to get the kubeconfig of cluster</p>
<p>I am able to access the cluster using kubectl on my local system using the command</p>
<blockquote>
<p>gcloud container clusters get-credentials</p>
</blockquote>
<p>When I try to connect with python-client-library of kubernetes, I get following error</p>
<pre><code>  File &quot;lib/python3.7/site-packages/urllib3/util/retry.py&quot;, line 399, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='xxx.xx.xxx.xxx', port=443): Max 
retries exceeded with url: /apis/extensions/v1beta1/namespaces/default/ingresses (Caused by 
SSLError(SSLError(136, '[X509] no certificate or crl found (_ssl.c:4140)')))
</code></pre>
<p>here is the code i am using</p>
<pre><code>os.environ[&quot;GOOGLE_APPLICATION_CREDENTIALS&quot;] = &quot;863924b908c7.json&quot;

credentials, project = google.auth.default(
    scopes=['https://www.googleapis.com/auth/cloud-platform', ])

credentials.refresh(google.auth.transport.requests.Request())

cluster_manager = ClusterManagerClient(credentials=credentials)
# cluster = cluster_manager.get_cluster(project)
config.load_kube_config('config.yaml')
</code></pre>

<p>Here's what I figured out. I think it's a good solution because it prevents man in the middle attacks (uses SSL) unlike other python snippets in the wild.</p>
<pre><code>from google.cloud.container_v1 import ClusterManagerClient
from kubernetes import client
from tempfile import NamedTemporaryFile
import base64
import google.auth

credentials, project = google.auth.default(scopes=['https://www.googleapis.com/auth/cloud-platform',])
credentials.refresh(google.auth.transport.requests.Request())
cluster_manager = ClusterManagerClient(credentials=credentials)
cluster = cluster_manager.get_cluster(name=f&quot;projects/{gcp_project_id}/locations/{cluster_zone_or_region}/clusters/{cluster_id}&quot;)

with NamedTemporaryFile(delete=False) as ca_cert:
 ca_cert.write(base64.b64decode(cluster.master_auth.cluster_ca_certificate))

config = client.Configuration()
config.host = f'https://{cluster.endpoint}:443'
config.verify_ssl = True
config.api_key = {&quot;authorization&quot;: &quot;Bearer &quot; + credentials.token}
config.username = credentials._service_account_email
config.ssl_ca_cert = ca_cert.name
client.Configuration.set_default(config)

# make calls with client
</code></pre>
<blockquote>
<p>On GKE, SSL Validation works on the IP automatically. If you are in an environment where it doesn't work for some reason, you can bind the IP to a hostname list this:</p>
<pre><code>from python_hosts.hosts import (Hosts, HostsEntry)
hosts = Hosts()
hosts.add([HostsEntry(entry_type='ipv4', address=cluster.endpoint, names=['kubernetes'])])
hosts.write()
config.host = &quot;https://kubernetes&quot;
</code></pre>
</blockquote>
