Skip to content

Refresh token/api-key periodically #741

Closed
kubernetes-client/python-base
#250
Closed
Refresh token/api-key periodically#741
kubernetes-client/python-base
#250
Assignees
roycaihw

Description

@aparamon
aparamon
opened on Jan 30, 2019

Currently, authorization token/api-key is only initialized on loading config:
https://github.com/kubernetes-client/python-base/blob/bd9a8525e9215f7f01c32a321beb9a605cf0402b/config/kube_config.py#L420
https://github.com/kubernetes-client/python-base/blob/bd9a8525e9215f7f01c32a321beb9a605cf0402b/config/kube_config.py#L510
When working with Amazon EKS via aws-iam-authenticator though, token/api-key expires relatively quickly.

It is proposed to introduce a configurable option to specify token/api-key time-to-live. On API call the time should be checked, and if expired the token/api-key should be refreshed by calling https://github.com/kubernetes-client/python-base/blob/bd9a8525e9215f7f01c32a321beb9a605cf0402b/config/kube_config.py#L350 again.
Alternatively, API client could check for 401 Unauthorized return code and refresh token (at most once per API call).

Activity

  1. aparamon
    changed the title [-]Refresh auth token periodically[/-] [+]Refresh token/api-key periodically[/+] on Jan 30, 2019

  2. marsewe commented on Mar 21, 2019

    @marsewe
    marsewe
    on Mar 21, 2019

    See also kubernetes-sigs/aws-iam-authenticator#63 and https://stackoverflow.com/questions/48151388/kubernetes-python-client-authentication-issue. Should the user of the client catch the 401 (and re-authenticate and retry) or is that a responsibility of the kubernetes-client?

  3. jmeickle commented on Jun 7, 2019

    @jmeickle
    jmeickle
    on Jun 7, 2019

    Calling config.load_kube_config() again doesn't seem to recreate a token in my case, even though the corresponding kubectl command would have automatically done so. So I think there's some staleness check here that isn't actually occurring.

  4. houqp commented on Aug 5, 2019

    @houqp
    houqp
    on Aug 5, 2019

    config for an existing client is cached unfortunately :( After calling load_kube_config, you will have to recreate a new api client to pick up the refreshed token. Currently, the expirationTimestamp returned from aws-iam-authenticator is ignored by KubeConfigLoader.

  5. wing328 commented on Aug 8, 2019

    @wing328
    wing328
    on Aug 8, 2019

    @houqp I wonder if you can send the patch upstream to OpenAPI Generator as that's what the project going to use moving forward to generate API clients: kubernetes-client/gen#93

  6. houqp commented on Aug 8, 2019

    @houqp
    houqp
    on Aug 8, 2019

    Good call @wing328, do you know if #738 and kubernetes-client/gen#97 are the right PRs to watch?

  7. houqp commented on Aug 8, 2019

    @houqp
    houqp
    on Aug 8, 2019

    @wing328 i have ported the patches to openapi-generator, could you help review them?

  8. roycaihw commented on Aug 27, 2019

    @roycaihw
    roycaihw
    on Aug 27, 2019
    Member

    /assign

  9. k8s-ci-robot
    assigned
    roycaihw
    on Aug 27, 2019

  10. roycaihw commented on Sep 18, 2019

    @roycaihw
    roycaihw
    on Sep 18, 2019
    Member

    kubernetes-client/gen#97 is merged. We used openapi-generator in 11.0.0a1 release #931

  11. jdamata commented on Nov 13, 2019

    @jdamata
    jdamata
    on Nov 13, 2019

    I'm using 11.0.0a1 but still getting intermittent 401's

    {"asctime": "2019-11-13 14:38:33,384", "name": "k8s", "levelname": "INFO", "message": "Sleeping for 60 seconds"}
Traceback (most recent call last):
  File "src/main.py", line 57, in <module>
    drain.run()
  File "/opt/git/stratus/stratus-eks/worker_node_rolling_update/src/k8s.py", line 42, in run
    self.drain()
  File "/opt/git/stratus/stratus-eks/worker_node_rolling_update/src/k8s.py", line 33, in drain
    if check_node_drained(self.v1api, node):
  File "/opt/git/stratus/stratus-eks/worker_node_rolling_update/src/k8s_helper.py", line 117, in check_node_drained
    node_body = api.read_node(node_name)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/api/core_v1_api.py", line 20565, in read_node
    (data) = self.read_node_with_http_info(name, **kwargs)  # noqa: E501
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/api/core_v1_api.py", line 20649, in read_node_with_http_info
    collection_formats=collection_formats)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 335, in call_api
    _preload_content, _request_timeout)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 166, in __call_api
    _request_timeout=_request_timeout)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/api_client.py", line 356, in request
    headers=headers)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/rest.py", line 241, in GET
    query_params=query_params)
  File "/Users/damatj/.local/share/virtualenvs/worker_node_rolling_update-n2X_lDEC/lib/python3.7/site-packages/kubernetes/client/rest.py", line 231, in request
    raise ApiException(http_resp=r)
kubernetes.client.rest.ApiException: (401)
Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Audit-Id': '96bc2da9-40a0-42b8-9303-3a99b5d77db1', 'Content-Type': 'application/json', 'Date': 'Wed, 13 Nov 2019 19:39:33 GMT', 'Content-Length': '129'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

  12. athom commented on Dec 11, 2019

    @athom
    athom
    on Dec 11, 2019

    11.0.0b2 also not work

       File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/airflow/contrib/kubernetes/pod_launcher.py", line 168, in read_pod
     return self._client.read_namespaced_pod(pod.name, pod.namespace)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/api/core_v1_api.py", line 19078, in read_namespaced_pod
     (data) = self.read_namespaced_pod_with_http_info(name, namespace, **kwargs)  # noqa: E501
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/api/core_v1_api.py", line 19169, in read_namespaced_pod_with_http_info
     collection_formats=collection_formats)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 335, in call_api
     _preload_content, _request_timeout)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 166, in __call_api
     _request_timeout=_request_timeout)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 356, in request
     headers=headers)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/rest.py", line 241, in GET
     query_params=query_params)
   File "/etc/airflow/.local/share/virtualenvs/airflow-bTdwlyD1/lib/python3.6/site-packages/kubernetes/client/rest.py", line 231, in request
     raise ApiException(http_resp=r)
 kubernetes.client.rest.ApiException: (401)
 Reason: Unauthorized
 HTTP response headers: HTTPHeaderDict({'Audit-Id': '685e7f66-8303-418c-9d1d-b82920ef2d0f', 'Content-Type': 'application/json', 'Date': 'Wed, 11 Dec 2019 04:12:24 GMT', 'Content-Length': '129'})
 HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

  13. fejta-bot commented on Mar 10, 2020

    @fejta-bot
    fejta-bot
    on Mar 10, 2020

    Issues go stale after 90d of inactivity.
    Mark the issue as fresh with /remove-lifecycle stale.
    Stale issues rot after an additional 30d of inactivity and eventually close.

    If this issue is safe to close now please do so with /close.

    Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
    /lifecycle stale

  14. k8s-ci-robot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Mar 10, 2020

  15. tbarrella commented on Mar 10, 2020

    @tbarrella
    tbarrella
    on Mar 10, 2020

    /remove-lifecycle stale

  16. 24 remaining items

  17. emenendez
    added a commit that references this issue on Jul 23, 2021

    Refresh exec-based API credentials when they expire (for Kubernetes c…

    76824d0
  18. emenendez
    added a commit that references this issue on Aug 27, 2021

    Refresh exec-based API credentials when they expire

    f6f9fb9
  19. emenendez
    added a commit that references this issue on Sep 3, 2021

    Refresh exec-based API credentials when they expire

    70b78cd

  20. k8s-triage-robot commented on Oct 18, 2021

    @k8s-triage-robot
    k8s-triage-robot
    on Oct 18, 2021

    The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

    This bot triages issues and PRs according to the following rules:

    • After 90d of inactivity, lifecycle/stale is applied
    • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
    • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

    You can:

    • Mark this issue or PR as fresh with /remove-lifecycle stale
    • Mark this issue or PR as rotten with /lifecycle rotten
    • Close this issue or PR with /close
    • Offer to help out with Issue Triage

    Please send feedback to sig-contributor-experience at kubernetes/community.

    /lifecycle stale

  21. k8s-ci-robot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Oct 18, 2021

  22. dinvlad commented on Oct 18, 2021

    @dinvlad
    dinvlad
    on Oct 18, 2021

    /remove-lifecycle stale

  23. k8s-ci-robot
    removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Oct 18, 2021
  24. k8s-ci-robot
    closed this as completedin python-base#250on Nov 30, 2021
  25. dudleyhunt86
    added a commit that references this issue on Oct 7, 2022

    Refresh exec-based API credentials when they expire

    e93537b
  26. sergiitk
    added a commit that references this issue on Jan 27, 2023

    xDS interop: Refresh k8s auth on 401 to pick up updated auth token (#…

    b734ade
  27. XuanWang-Amos
    added a commit that references this issue on May 1, 2023

    xDS interop: Refresh k8s auth on 401 to pick up updated auth token (g…

    397e99b
  28. wanlin31
    added a commit that references this issue on May 18, 2023

    xDS interop: Refresh k8s auth on 401 to pick up updated auth token (#…

    b10cdf8
  29. sergiitk
    added a commit that references this issue on Nov 8, 2023

    xDS interop: Refresh k8s auth on 401 to pick up updated auth token (#…

    c0a4f62
  30. bh0717-dev
    added a commit that references this issue on Apr 1, 2024

    Refresh exec-based API credentials when they expire

    5b38bfd
  31. sdevtop100-dot
    added a commit that references this issue on Feb 4, 2026

    Refresh exec-based API credentials when they expire

    7ec9f31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions