Kubernetes python client: authentication issue

I have a python container using the Kubernetes client, and was looking for a way to have it use a service account when executing in cluster, but load a mounted kube config when executing locally. It took me a while to find load_incluster_config(), which will automatically configure based on the service account of the container when executing in cluster. I now switch on an env var when running locally. This might be helpful for you :

https://github.com/kubernetes-client/python/blob/master/examples/in_cluster_config.py

In the end we have solved this by using bearer token authentication, instead of relying on the default gcloud authentication method.

Here are the steps that I did to achieve this.

First create a service account in the desired namespace, by creating a file with the following content.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: <name_of_service_account>

Then use this file to create the service account

kubectl create -f <path_to_file> --namespace=<namespace_name>

Each service account has a bearer token linked to it, which can be used for authentication. This bearer token is automatically mounted as a secret into the namespace. To find out what this token is, first find the name of the secret (is of the form <service_account_name>-token-<random_string>) and then use that name to get to content.

# To search for out service account's token name
kubectl get secrets --namespace=<namespace_name>

# To find the token name
kubectl describe secret/<secret_name>

After this you should find out the ip address of the API server, and the Cluster CA certificate of the kubernetes cluster. This can be done by going to the kubernetes engine detail page on google cloud console. Copy the content of the certificate into a local file.

You can now use the bearer token to authenticate via the kubernetes python client, as follows:

from kubernetes import client

configuration = client.Configuration()
configuration.api_key["authorization"] = '<bearer_token>'
configuration.api_key_prefix['authorization'] = 'Bearer'
configuration.host = 'https://<ip_of_api_server>'
configuration.ssl_ca_cert = '<path_to_cluster_ca_certificate>'

v1 = client.CoreV1Api(client.ApiClient(configuration))