<p>I'm trying to connect to my microk8s Kubernetes cluster which is listening on port 16443 with the <a href="https://github.com/kubernetes-client/python" rel="nofollow noreferrer">Python Kubernetes client</a>:</p>

<pre><code>#!/usr/bin/python3

import kubernetes
from kubernetes import client
from kubernetes.client import ApiClient


def setup_cluster():
    configuration = kubernetes.client.configuration.Configuration()
    configuration.host = "https://localhost:16443"
    #configuration.cert_file = "ca.crt"
    #configuration.key_file = "ca.key"
    configuration.api_key["authorization"] = "[the token which I got from kubectl -n kube-system describe secret default-token-abc123]"

    api_client = ApiClient(configuration=configuration)

    v1 = client.CoreV1Api(api_client=api_client)

    print("Listing pods with their IPs:")
    ret = v1.list_pod_for_all_namespaces(watch=False)
    for i in ret.items:
        print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))


if __name__ == "__main__":
    setup_cluster()
</code></pre>

<p>If I set none of the fields <code>cert_file</code>, <code>key_file</code> or <code>api_key</code> of the configuration in the example, the connection fails due to</p>

<pre><code>Traceback (most recent call last):
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/kubernetes_python_port_ignored.py", line 26, in &lt;module&gt;
    setup_cluster()
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/kubernetes_python_port_ignored.py", line 20, in setup_cluster
    ret = v1.list_pod_for_all_namespaces(watch=False)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 13630, in list_pod_for_all_namespaces
    (data) = self.list_pod_for_all_namespaces_with_http_info(**kwargs)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 13724, in list_pod_for_all_namespaces_with_http_info
    collection_formats=collection_formats)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 334, in call_api
    _return_http_data_only, collection_formats, _preload_content, _request_timeout)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 168, in __call_api
    _request_timeout=_request_timeout)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 355, in request
    headers=headers)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/rest.py", line 231, in GET
    query_params=query_params)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/kubernetes/client/rest.py", line 205, in request
    headers=headers)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/request.py", line 68, in request
    **urlopen_kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/request.py", line 89, in request_encode_url
    return self.urlopen(method, url, **extra_kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/poolmanager.py", line 326, in urlopen
    response = conn.urlopen(method, u.request_uri, **kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/connectionpool.py", line 670, in urlopen
    **response_kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/connectionpool.py", line 670, in urlopen
    **response_kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/connectionpool.py", line 670, in urlopen
    **response_kw)
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/connectionpool.py", line 641, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=16443): Max retries exceeded with url: /api/v1/pods?watch=False (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
</code></pre>

<p>If I specify the <code>api_key</code> as shown in the code above I get</p>

<pre><code>  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=16443): Max retries exceeded with url: /api/v1/pods?watch=False (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
</code></pre>

<p>I tried setting some certificates like <code>ca.crt</code> and <code>ca.key</code> from <code>/var/snap/microk8s/current/certs</code> as shown, but this then fails due to</p>

<pre><code>  File "/home/richter/examples/kubernetes-python/kubernetes-python-port-ignored/venv/lib/python3.7/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=16443): Max retries exceeded with url: /api/v1/pods?watch=False (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
</code></pre>

<p>I'm using microk8s 1.15.0 (695) on Ubuntu 19.04 with Python 3.7 and Kubernetes Python client 10.0.0.</p>

Kalle Richter
<p>you need to pass path to ca.crt file at <code>configuration.ssl_ca_cert = 'ca.crt'</code>.</p>

<pre><code>configuration = kubernetes.client.Configuration()
configuration.ssl_ca_cert = 'ca.crt' #&lt;&lt;&lt; look here&gt;&gt;&gt;
configuration.api_key['authorization'] = 'ZXXXXXXXXXXdw=='
configuration.api_key_prefix['authorization'] = 'Bearer'
configuration.host = 'https://aaaaaaaaaaaaaaa.gr7.us-east-1.eks.amazonaws.com'

</code></pre>

<p>other options are important as well or else you can use default kubeconfig location by adding following line in your code.</p>

<pre><code>config.load_kube_config()
</code></pre>

<p>Generally we can authenticate our client in different ways here i will give example for two ways. </p>

<ol>
<li>By using default location of config file at <strong>~/.kube/config</strong>.</li>
</ol>

<p>If you are using this method make sure you have, config file at <strong>~/.kube/config</strong></p>

<p>If there is no file present at this location, use <code>kubectl config view</code> to get the content of config file and save it to <strong>config</strong> file and place that file at <strong>~/.kube/config</strong></p>

<p><strong>Example for first case:</strong></p>

<p><em>following code will give you listofpods in default namespace</em></p>

<pre><code>from kubernetes import client, config

#&lt;&lt;&lt;observe below line of code &gt;&gt;&gt;
#uses default config file loccated at ~/.kube/config
config.load_kube_config()

v1 = client.CoreV1Api()
print("Listing pods with their IPs:")
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
    print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

res = v1.list_namespaced_pod(namespace='default',watch=False)
for i in res.items:
    print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
</code></pre>

<ol start="2">
<li>By defining certs and bearer token.</li>
</ol>

<p><strong>Example for second case</strong> </p>

<p><em>This code lists names of namespaces</em></p>

<pre><code>import kubernetes.client

&lt;&lt;&lt;pay attention here next five lines of code&gt;&gt;&gt;
configuration = kubernetes.client.Configuration()
configuration.ssl_ca_cert = 'ca.crt'
configuration.api_key['authorization'] = 'ZXXXXXXXXXXdw=='
configuration.api_key_prefix['authorization'] = 'Bearer'
configuration.host = 'https://aaaaaaaaaaaaaaa.gr7.us-east-1.eks.amazonaws.com'

api_instance = kubernetes.client.CoreV1Api(kubernetes.client.ApiClient(configuration))

api_response = api_instance.list_namespace()
for i in api_response.items:
    print(i.metadata.name)
</code></pre>

<p><strong>for more info refer official GitHub repository for examples</strong></p>

<p><strong>refer: <a href="https://stackoverflow.com/questions/57158867/having-problem-in-authenticating-kubernetes-python-client">my answer to similar problem</a></strong></p>
