Empty auth-provider/config key raises ConfigException

[pbrumblay]

I'm trying to write a dockerized application to crawl k8s clusters and extract configuration information. I don't wish to install gcloud/kubectl in the application container so I'm following this suggestion on constructing a kube config file: kubernetes/kubernetes#30617 (comment)

With this config file:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <REDACTED>
    server: https://<REDACTED>
  name: foo-cluster
contexts:
- context:
    cluster: foo-cluster
    user: foo-cluster
  name: foo-cluster
current-context: foo-cluster
kind: Config
preferences: {}
users:
- name: foo-cluster
  user:
    auth-provider:
      config: null
      name: gcp

And this code:

from kubernetes import config, client

config.load_kube_config('myconfig')

I get this error:

<SNIP!>
  File "/Users/peter/python3/py3/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 196, in _load_gcp_token
    self._refresh_gcp_token()
  File "/Users/peter/python3/py3/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 204, in _refresh_gcp_token
    provider = self._user['auth-provider']['config']
  File "/Users/peter/python3/py3/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 290, in __getitem__
    % (key, self.name))
kubernetes.config.config_exception.ConfigException: Invalid kube-config file. Expected key config in kube-config/users[name=foo-cluster]/user/auth-provider

The key is present - what the heck? This threw me for a while until I cracked open the code.

I believe this is because line 203 of https://github.com/kubernetes-client/python-base/blob/ab3fc5446714ac19100c0f97072c53cbd81c3b87/config/kube_config.py sets the value to the empty dict {} and line 287 in __getitem__ only tests for boolean true (and empty dicts are False in python).

My workaround is to add a bogus attribute under config to my yaml file to make the dict non-empty. It appears that the intent is to allow people to have missing/empty/invalid/expired auth-provider/config entries and to then generate the config entry when such a case is detected. I'm new to python but I suppose this is a common problem because of the way that python evaluates empty dicts to False.

I'm not sure what the right fix would be, whether to have __getitem__ allow empty structures or to simply add a bogus value to make the dict non-empty in line 203. Or maybe I should have just known this and tried adding a bogus attribute to config right off the bat...

[mbohlool]

It is a reasonable request to have getitem allow empty dict. I say we should check check for none here: https://github.com/kubernetes-client/python-base/blob/ab3fc5446714ac19100c0f97072c53cbd81c3b87/config/kube_config.py#L287

if v is not None: ...

[pbrumblay]

Cool. I'm not terribly concerned if there is an incoming fix or not, but hopefully this issue documents an ok (findable!) workaround so others don't stumble as much as I did.

[iamneha]

/assign @iamneha

[k8s-ci-robot]

@iamneha: GitHub didn't allow me to assign the following users: iamneha.

Note that only kubernetes-client members and repo collaborators can be assigned.
For more information please see the contributor guide

In response to this:

/assign @iamneha

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pvanderlinden]

@pbrumblay I don't think it's a good to have a work around instead of a fix. The library should be able to read config files which are generated/read by other standard kubernetes tools, and kubectl reads this just fine. This bug doesn't exist in version 8.0.0.

[pbrumblay]

@pvanderlinden Great! I'm glad it's been fixed. I've moved on from this work and don't have time to verify it. Feel free to close this. As I said above, I mainly opened this to save others pain.

@pbrumblay I don't think it's a good to have a work around instead of a fix. The library should be able to read config files which are generated/read by other standard kubernetes tools, and kubectl reads this just fine. This bug doesn't exist in version 8.0.0.

[pvanderlinden]

@pbrumblay It's not actually fixed. That's just an older version which doesn't have the bug.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.