kubernetes-client / kubernetes-client/python

Configure SSL CA CERTIFICATE with REQUESTS_CA_BUNDLE env var before certifi

Open
#1,131 9 comments 9 reactions 1 assignee Claimed by @palnabarun View on GitHub
kind/feature lifecycle/frozen
Dominant language
Python
Stars
7.7k
Forks
3.5k
Avg merge
1d 14h
Merged PRs (30d)
18

Description

**What is the feature and why do you need it**:

The idea is to configure `ssl_ca_cert` using the `REQUESTS_CA_BUNDLE` env var before falling back to _certifi_ if no specific configuration has been provided.

Some applications that are using **kubernetes-client / python** do not provide a parameter to [client/configuration.py#L83](https://github.com/kubernetes-client/python/blob/master/kubernetes/client/configuration.py#L83). Using an env var before certifi will help such use cases.

Finally, it can be very useful in a container context, as we can pass this configuration via, once again, env vars.

**Describe the solution you'd like to see**:

In :
[client/rest.py#L70](https://github.com/kubernetes-client/python/blob/master/kubernetes/client/rest.py#L70)

At the moment, the code is the following :
```
# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()
```

We can add a new condition of the form :
```
# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
elif 'REQUESTS_CA_BUNDLE' in os.environ:
ca_certs = environ.get('REQUESTS_CA_BUNDLE')
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()
```

The env var `REQUESTS_CA_BUNDLE` seems to be a good candidate as it is a common practice.

**Related issues**:
- https://github.com/kubernetes-client/python/issues/859
- https://github.com/kubernetes-client/python/issues/1017

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.