olitheolix/aiokubernetes

Asynchronous Kubernetes Client

aiokubernetes's Issues

Too many dependencies

I already have aiohttp, it seems silly to install requests. But aiokubernetes forces me to.

aiokubernetes doesn`t work with insecure-skip-tls-verify option

Hello,

When I used insecure-skip-tls-verify option in kubeconfig file I got an error

Traceback (most recent call last):
  File "/Users/obloshenkin/my_project/learn_angular/api_health_chek/examples/async_kubectl.py", line 42, in <module>
    loop.run_until_complete(main())
  File "/Users/obloshenkin/.pyenv/versions/3.6.5/lib/python3.6/asyncio/base_events.py", line 468, in run_until_complete
    return future.result()
  File "/Users/obloshenkin/my_project/learn_angular/api_health_chek/examples/async_kubectl.py", line 9, in main
    context='preprod'
  File "/Users/obloshenkin/.pyenv/versions/3.6.5/lib/python3.6/site-packages/aiokubernetes/config/kube_config.py", line 477, in new_client_from_config
    return ApiClient(configuration=client_config)
  File "/Users/obloshenkin/.pyenv/versions/3.6.5/lib/python3.6/site-packages/aiokubernetes/api_client.py", line 88, in __init__
    verify_ssl=configuration.verify_ssl
  File "/Users/obloshenkin/.pyenv/versions/3.6.5/lib/python3.6/site-packages/aiohttp/connector.py", line 643, in __init__
    fingerprint)
  File "/Users/obloshenkin/.pyenv/versions/3.6.5/lib/python3.6/site-packages/aiohttp/client_reqrep.py", line 118, in _merge_ssl_params
    raise ValueError("verify_ssl, ssl_context, fingerprint and ssl "
ValueError: verify_ssl, ssl_context, fingerprint and ssl parameters are mutually exclusive

My kubeconfig:

apiVersion: v1
kind: Config
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://hostname-address:6443
  name: preprod

This error raised for me because in the module init() contains these changes:

ssl_context = ssl.create_default_context(cafile=ca_certs)
        if configuration.cert_file:
            ssl_context.load_cert_chain(
                configuration.cert_file, keyfile=configuration.key_file
            )

        connector = aiohttp.TCPConnector(
            limit=4,
            ssl_context=ssl_context,
            verify_ssl=configuration.verify_ssl
        )

Please help me.

Thank you.

JWT tokens fail to load when not padded (as specced by RFC7515)

_load_oid_token() currently doesn't support in-the-wild JWT tokens, which expect to be unpadded base64. https://www.rfc-editor.org/rfc/rfc7515.txt

   Base64url Encoding
      Base64 encoding using the URL- and filename-safe character set
      defined in Section 5 of RFC 4648 [RFC4648], with all trailing '='
      characters omitted (as permitted by Section 3.2) and without the
      inclusion of any line breaks, whitespace, or other additional
      characters.  Note that the base64url encoding of the empty octet
      sequence is the empty string.  (See Appendix C for notes on
      implementing base64url encoding without padding.)

to fix, https://github.com/olitheolix/aiokubernetes/blob/master/aiokubernetes/config/kube_config.py#L233 should look more like

jwt_data = parts[1]
jwt_data += '=' * (4 - len(jwt_data) % 4)
jwt_attributes = json.loads(base64.b64decode(jwt_data).decode('utf-8'))

Would PR this but it seems to have more implications in test than I have a jiffy fix for atm, so posting an issue for posterity