Skip to content

Commit c0c7ac6

Browse files
author
Sajjad Ghafarian
committed
fix: add disable_strict_ssl_verification to sync client (Python 3.13 RFC 5280 compat)
1 parent f8c3ba2 commit c0c7ac6

4 files changed

Lines changed: 100 additions & 8 deletions

File tree

‎kubernetes/client/configuration.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,14 @@ def __init__(self, host=None,
179179
Set this to false to skip verifying SSL certificate when calling API
180180
from https server.
181181
"""
182+
self.disable_strict_ssl_verification = False
183+
"""Set to true, to accept certificates violate X509 strict certificate
184+
verification requirements, like missing the following extensions:
185+
- X509v3 Subject Key Identifier
186+
- X509v3 Authority Key Identifier
187+
- X509v3 Subject Alternative Name
188+
(It is implemented by removing ssl.VERIFY_X509_STRICT from SSLContext.verify_flags)
189+
"""
182190
self.ssl_ca_cert = ssl_ca_cert
183191
"""Set this to customize the certificate file to verify the peer.
184192
"""

‎kubernetes/client/rest.py‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,27 +81,40 @@ def __init__(self, configuration, pools_size=4, maxsize=None):
8181
else:
8282
maxsize = 4
8383

84+
if configuration.disable_strict_ssl_verification:
85+
ssl_context = ssl.create_default_context(cafile=configuration.ssl_ca_cert)
86+
if configuration.cert_file:
87+
ssl_context.load_cert_chain(
88+
configuration.cert_file, keyfile=configuration.key_file
89+
)
90+
if not configuration.verify_ssl:
91+
ssl_context.check_hostname = False
92+
ssl_context.verify_mode = ssl.CERT_NONE
93+
ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
94+
ssl_pool_kwargs = {'ssl_context': ssl_context}
95+
else:
96+
ssl_pool_kwargs = {
97+
'cert_reqs': cert_reqs,
98+
'ca_certs': configuration.ssl_ca_cert,
99+
'cert_file': configuration.cert_file,
100+
'key_file': configuration.key_file,
101+
}
102+
84103
# https pool manager
85104
if configuration.proxy and not should_bypass_proxies(configuration.host, no_proxy=configuration.no_proxy or ''):
86105
self.pool_manager = urllib3.ProxyManager(
87106
num_pools=pools_size,
88107
maxsize=maxsize,
89-
cert_reqs=cert_reqs,
90-
ca_certs=configuration.ssl_ca_cert,
91-
cert_file=configuration.cert_file,
92-
key_file=configuration.key_file,
93108
proxy_url=configuration.proxy,
94109
proxy_headers=configuration.proxy_headers,
110+
**ssl_pool_kwargs,
95111
**addition_pool_args
96112
)
97113
else:
98114
self.pool_manager = urllib3.PoolManager(
99115
num_pools=pools_size,
100116
maxsize=maxsize,
101-
cert_reqs=cert_reqs,
102-
ca_certs=configuration.ssl_ca_cert,
103-
cert_file=configuration.cert_file,
104-
key_file=configuration.key_file,
117+
**ssl_pool_kwargs,
105118
**addition_pool_args
106119
)
107120

‎scripts/client_configuration_disable_ssl_strict_verification_patch.diff‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
diff --git a/kubernetes/client/configuration.py b/kubernetes/client/configuration.py
2+
index d113df1e6..92ef01ec2 100644
3+
--- a/kubernetes/client/configuration.py
4+
+++ b/kubernetes/client/configuration.py
5+
@@ -179,6 +179,14 @@ conf = client.Configuration(
6+
Set this to false to skip verifying SSL certificate when calling API
7+
from https server.
8+
"""
9+
+ self.disable_strict_ssl_verification = False
10+
+ """Set to true, to accept certificates violate X509 strict certificate
11+
+ verification requirements, like missing the following extensions:
12+
+ - X509v3 Subject Key Identifier
13+
+ - X509v3 Authority Key Identifier
14+
+ - X509v3 Subject Alternative Name
15+
+ (It is implemented by removing ssl.VERIFY_X509_STRICT from SSLContext.verify_flags)
16+
+ """
17+
self.ssl_ca_cert = ssl_ca_cert
18+
"""Set this to customize the certificate file to verify the peer.
19+
"""

‎scripts/rest_client_disable_ssl_strict_verification_patch.diff‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
diff --git a/kubernetes/client/rest.py b/kubernetes/client/rest.py
2+
index 7c461b32e..e88290ef7 100644
3+
--- a/kubernetes/client/rest.py
4+
+++ b/kubernetes/client/rest.py
5+
@@ -81,27 +81,40 @@ class RESTClientObject(object):
6+
else:
7+
maxsize = 4
8+
9+
+ if configuration.disable_strict_ssl_verification:
10+
+ ssl_context = ssl.create_default_context(cafile=configuration.ssl_ca_cert)
11+
+ if configuration.cert_file:
12+
+ ssl_context.load_cert_chain(
13+
+ configuration.cert_file, keyfile=configuration.key_file
14+
+ )
15+
+ if not configuration.verify_ssl:
16+
+ ssl_context.check_hostname = False
17+
+ ssl_context.verify_mode = ssl.CERT_NONE
18+
+ ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
19+
+ ssl_pool_kwargs = {'ssl_context': ssl_context}
20+
+ else:
21+
+ ssl_pool_kwargs = {
22+
+ 'cert_reqs': cert_reqs,
23+
+ 'ca_certs': configuration.ssl_ca_cert,
24+
+ 'cert_file': configuration.cert_file,
25+
+ 'key_file': configuration.key_file,
26+
+ }
27+
+
28+
# https pool manager
29+
if configuration.proxy and not should_bypass_proxies(configuration.host, no_proxy=configuration.no_proxy or ''):
30+
self.pool_manager = urllib3.ProxyManager(
31+
num_pools=pools_size,
32+
maxsize=maxsize,
33+
- cert_reqs=cert_reqs,
34+
- ca_certs=configuration.ssl_ca_cert,
35+
- cert_file=configuration.cert_file,
36+
- key_file=configuration.key_file,
37+
proxy_url=configuration.proxy,
38+
proxy_headers=configuration.proxy_headers,
39+
+ **ssl_pool_kwargs,
40+
**addition_pool_args
41+
)
42+
else:
43+
self.pool_manager = urllib3.PoolManager(
44+
num_pools=pools_size,
45+
maxsize=maxsize,
46+
- cert_reqs=cert_reqs,
47+
- ca_certs=configuration.ssl_ca_cert,
48+
- cert_file=configuration.cert_file,
49+
- key_file=configuration.key_file,
50+
+ **ssl_pool_kwargs,
51+
**addition_pool_args
52+
)

0 commit comments

Comments
 (0)