Skip to content

Commit 46989af

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2585 from Jmacek/fix-incluster-auth-v36-bearertoken-key
config: write api_key['BearerToken'] so v36+ SDK auth works
2 parents 3abc8c1 + 7cc2c57 commit 46989af

6 files changed

Lines changed: 38 additions & 21 deletions

File tree

‎kubernetes/base/config/incluster_config.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ def _set_config(self, client_configuration):
8888
client_configuration.host = self.host
8989
client_configuration.ssl_ca_cert = self.ssl_ca_cert
9090
if self.token is not None:
91-
client_configuration.api_key['authorization'] = self.token
91+
client_configuration.api_key['BearerToken'] = self.token
9292
if not self._try_refresh_token:
9393
return
9494

‎kubernetes/base/config/incluster_config_test.py‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ def test_refresh_token(self):
9191
loader.load_and_set(config)
9292

9393
self.assertEqual('bearer ' + _TEST_TOKEN,
94-
config.get_api_key_with_prefix('authorization'))
94+
config.get_api_key_with_prefix('BearerToken'))
9595
self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
9696
self.assertIsNotNone(loader.token_expires_at)
9797

@@ -100,14 +100,31 @@ def test_refresh_token(self):
100100
loader._token_filename = self._create_file_with_temp_content(
101101
_TEST_NEW_TOKEN)
102102
self.assertEqual('bearer ' + _TEST_TOKEN,
103-
config.get_api_key_with_prefix('authorization'))
103+
config.get_api_key_with_prefix('BearerToken'))
104104

105105
loader.token_expires_at = datetime.datetime.now()
106106
self.assertEqual('bearer ' + _TEST_NEW_TOKEN,
107-
config.get_api_key_with_prefix('authorization'))
107+
config.get_api_key_with_prefix('BearerToken'))
108108
self.assertEqual('bearer ' + _TEST_NEW_TOKEN, loader.token)
109109
self.assertGreater(loader.token_expires_at, old_token_expires_at)
110110

111+
def test_load_incluster_sets_request_authorization_header(self):
112+
from kubernetes.client import ApiClient
113+
cert_filename = self._create_file_with_temp_content(_TEST_CERT)
114+
loader = self.get_test_loader(cert_filename=cert_filename)
115+
config = Configuration()
116+
loader.load_and_set(config)
117+
118+
api_client = ApiClient(config)
119+
headers = {}
120+
api_client.update_params_for_auth(headers, [], ['BearerToken'])
121+
122+
self.assertIn('authorization', headers)
123+
self.assertTrue(
124+
headers['authorization'].lower().startswith('bearer '),
125+
"Expected a Bearer authorization header, got: %r"
126+
% headers['authorization'])
127+
111128
def _should_fail_load(self, config_loader, reason):
112129
try:
113130
config_loader.load_and_set()

‎kubernetes/base/config/kube_config.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -527,7 +527,7 @@ def _load_cluster_info(self):
527527

528528
def _set_config(self, client_configuration):
529529
if 'token' in self.__dict__:
530-
client_configuration.api_key['authorization'] = self.token
530+
client_configuration.api_key['BearerToken'] = self.token
531531

532532
def _refresh_api_key(client_configuration):
533533
if ('expiry' in self.__dict__ and _is_expired(self.expiry)):

‎kubernetes/base/config/kube_config_test.py‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -369,7 +369,7 @@ def __init__(self, token=None, **kwargs):
369369
# Provided by the OpenAPI-generated Configuration class
370370
self.refresh_api_key_hook = None
371371
if token:
372-
self.api_key['authorization'] = token
372+
self.api_key['BearerToken'] = token
373373

374374
self.__dict__.update(kwargs)
375375

@@ -905,7 +905,7 @@ def test_gcp_no_refresh(self):
905905
self.assertIsNotNone(fake_config.refresh_api_key_hook)
906906
self.assertEqual(TEST_HOST, fake_config.host)
907907
self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
908-
fake_config.api_key['authorization'])
908+
fake_config.api_key['BearerToken'])
909909

910910
def test_load_gcp_token_no_refresh(self):
911911
loader = KubeConfigLoader(
@@ -1283,14 +1283,14 @@ def test_new_client_from_config(self):
12831283
config_file=config_file, context="simple_token")
12841284
self.assertEqual(TEST_HOST, client.configuration.host)
12851285
self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
1286-
client.configuration.api_key['authorization'])
1286+
client.configuration.api_key['BearerToken'])
12871287

12881288
def test_new_client_from_config_dict(self):
12891289
client = new_client_from_config_dict(
12901290
config_dict=self.TEST_KUBE_CONFIG, context="simple_token")
12911291
self.assertEqual(TEST_HOST, client.configuration.host)
12921292
self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
1293-
client.configuration.api_key['authorization'])
1293+
client.configuration.api_key['BearerToken'])
12941294

12951295
def test_no_users_section(self):
12961296
expected = FakeConfig(host=TEST_HOST)
@@ -1317,7 +1317,7 @@ def test_user_exec_auth(self, mock):
13171317
"token": token
13181318
}
13191319
expected = FakeConfig(host=TEST_HOST, api_key={
1320-
"authorization": BEARER_TOKEN_FORMAT % token})
1320+
"BearerToken": BEARER_TOKEN_FORMAT % token})
13211321
actual = FakeConfig()
13221322
KubeConfigLoader(
13231323
config_dict=self.TEST_KUBE_CONFIG,
@@ -1347,13 +1347,13 @@ def test_user_exec_auth_with_expiry(self, mock):
13471347
active_context="exec_cred_user").load_and_set(fake_config)
13481348
# The kube config should use the first token returned from the
13491349
# exec provider.
1350-
self.assertEqual(fake_config.api_key["authorization"],
1350+
self.assertEqual(fake_config.api_key["BearerToken"],
13511351
BEARER_TOKEN_FORMAT % expired_token)
13521352
# Should now be populated with a method to refresh expired tokens.
13531353
self.assertIsNotNone(fake_config.refresh_api_key_hook)
13541354
# Refresh the token; the kube config should be updated.
13551355
fake_config.refresh_api_key_hook(fake_config)
1356-
self.assertEqual(fake_config.api_key["authorization"],
1356+
self.assertEqual(fake_config.api_key["BearerToken"],
13571357
BEARER_TOKEN_FORMAT % current_token)
13581358

13591359
@mock.patch('kubernetes.config.kube_config.ExecProvider.run')
@@ -1395,7 +1395,7 @@ def test_user_cmd_path(self):
13951395
return_value = A(token, parse_rfc3339(datetime.datetime.now()))
13961396
CommandTokenSource.token = mock.Mock(return_value=return_value)
13971397
expected = FakeConfig(api_key={
1398-
"authorization": BEARER_TOKEN_FORMAT % token})
1398+
"BearerToken": BEARER_TOKEN_FORMAT % token})
13991399
actual = FakeConfig()
14001400
KubeConfigLoader(
14011401
config_dict=self.TEST_KUBE_CONFIG,
@@ -1408,7 +1408,7 @@ def test_user_cmd_path_empty(self):
14081408
return_value = A(token, parse_rfc3339(datetime.datetime.now()))
14091409
CommandTokenSource.token = mock.Mock(return_value=return_value)
14101410
expected = FakeConfig(api_key={
1411-
"authorization": BEARER_TOKEN_FORMAT % token})
1411+
"BearerToken": BEARER_TOKEN_FORMAT % token})
14121412
actual = FakeConfig()
14131413
self.expect_exception(lambda: KubeConfigLoader(
14141414
config_dict=self.TEST_KUBE_CONFIG,
@@ -1422,7 +1422,7 @@ def test_user_cmd_path_with_scope(self):
14221422
return_value = A(token, parse_rfc3339(datetime.datetime.now()))
14231423
CommandTokenSource.token = mock.Mock(return_value=return_value)
14241424
expected = FakeConfig(api_key={
1425-
"authorization": BEARER_TOKEN_FORMAT % token})
1425+
"BearerToken": BEARER_TOKEN_FORMAT % token})
14261426
actual = FakeConfig()
14271427
self.expect_exception(lambda: KubeConfigLoader(
14281428
config_dict=self.TEST_KUBE_CONFIG,
@@ -1723,7 +1723,7 @@ def test_new_client_from_config(self):
17231723
config_file=kubeconfigs, context="simple_token")
17241724
self.assertEqual(TEST_HOST, client.configuration.host)
17251725
self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
1726-
client.configuration.api_key['authorization'])
1726+
client.configuration.api_key['BearerToken'])
17271727

17281728
def test_merge_with_context_in_different_file(self):
17291729
kubeconfigs = self._create_multi_config(self.TEST_KUBE_CONFIG_SET2)
@@ -1739,7 +1739,7 @@ def test_merge_with_context_in_different_file(self):
17391739
self.assertEqual(active_context, expected_contexts[0])
17401740
self.assertEqual(TEST_HOST, client.configuration.host)
17411741
self.assertEqual(BEARER_TOKEN_FORMAT % TEST_DATA_BASE64,
1742-
client.configuration.api_key['authorization'])
1742+
client.configuration.api_key['BearerToken'])
17431743

17441744
def test_save_changes(self):
17451745
kubeconfigs = self._create_multi_config(self.TEST_KUBE_CONFIG_SET1)

‎kubernetes_asyncio/config/incluster_config.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ def _set_config(self, client_configuration):
8888
client_configuration.host = self.host
8989
client_configuration.ssl_ca_cert = self.ssl_ca_cert
9090
if self.token is not None:
91-
client_configuration.api_key['authorization'] = self.token
91+
client_configuration.api_key['BearerToken'] = self.token
9292
if not self._try_refresh_token:
9393
return
9494

‎kubernetes_asyncio/config/incluster_config_test.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ async def test_refresh_token(self):
9191
loader.load_and_set(config)
9292

9393
self.assertEqual('bearer ' + _TEST_TOKEN,
94-
await config.get_api_key_with_prefix('authorization'))
94+
await config.get_api_key_with_prefix('BearerToken'))
9595
self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
9696
self.assertIsNotNone(loader.token_expires_at)
9797

@@ -100,11 +100,11 @@ async def test_refresh_token(self):
100100
loader._token_filename = self._create_file_with_temp_content(
101101
_TEST_NEW_TOKEN)
102102
self.assertEqual('bearer ' + _TEST_TOKEN,
103-
await config.get_api_key_with_prefix('authorization'))
103+
await config.get_api_key_with_prefix('BearerToken'))
104104

105105
loader.token_expires_at = datetime.datetime.now()
106106
self.assertEqual('bearer ' + _TEST_NEW_TOKEN,
107-
await config.get_api_key_with_prefix('authorization'))
107+
await config.get_api_key_with_prefix('BearerToken'))
108108
self.assertEqual('bearer ' + _TEST_NEW_TOKEN, loader.token)
109109
self.assertGreater(loader.token_expires_at, old_token_expires_at)
110110

0 commit comments

Comments
 (0)