kubernetes-client / kubernetes-client/python
Configure SSL CA CERTIFICATE with REQUESTS_CA_BUNDLE env var before certifi
- Dominant language
- Python
- Stars
- 7.7k
- Forks
- 3.5k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 18
Description
**What is the feature and why do you need it**:
The idea is to configure `ssl_ca_cert` using the `REQUESTS_CA_BUNDLE` env var before falling back to _certifi_ if no specific configuration has been provided.
Some applications that are using **kubernetes-client / python** do not provide a parameter to [client/configuration.py#L83](https://github.com/kubernetes-client/python/blob/master/kubernetes/client/configuration.py#L83). Using an env var before certifi will help such use cases.
Finally, it can be very useful in a container context, as we can pass this configuration via, once again, env vars.
**Describe the solution you'd like to see**:
In :
[client/rest.py#L70](https://github.com/kubernetes-client/python/blob/master/kubernetes/client/rest.py#L70)
At the moment, the code is the following :
```
# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()
```
We can add a new condition of the form :
```
# ca_certs
if configuration.ssl_ca_cert:
ca_certs = configuration.ssl_ca_cert
elif 'REQUESTS_CA_BUNDLE' in os.environ:
ca_certs = environ.get('REQUESTS_CA_BUNDLE')
else:
# if not set certificate file, use Mozilla's root certificates.
ca_certs = certifi.where()
```
The env var `REQUESTS_CA_BUNDLE` seems to be a good candidate as it is a common practice.
**Related issues**:
- https://github.com/kubernetes-client/python/issues/859
- https://github.com/kubernetes-client/python/issues/1017
Contributor guide
Assessment
This issue has not been assessed yet.