Question

我无法连接到python kubernetes客户端，但是运行curl -k https://ip-address:30000/pods时却遇到此404 URL not found错误，这是我编写的连接到kubernetes和列表容器的端点。我正在通过minikube在本地运行，有关该怎么做的任何建议？

错误：

Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '129', 'Date': 'Wed, 18 Jul 2018 01:08:30 GMT'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

我如何连接到api：

from kubernetes import config,client
from kubernetes.client import Configuration, ApiClient

config = Configuration()
config.api_key = {'authorization': 'Bearer my-key-here'}
config.ssl_ca_cert = '/etc/secret-volume/ca-cert'
config.cert_file = 'ca-cert.crt'
config.key_file = '/etc/secret-volume/secret-key'
config.assert_hostname = False
api_client = ApiClient(configuration=config)
v1 = client.CoreV1Api(api_client)

#I've also tried using below, but it gives sslcertifificate max retry error 
#so I opted for manual config above
try: 
   config.load_incluster_config()
except: 
   config.load_kube_config()
v1 = client.CoreV1Api()

我获取api密钥的方法是从我创建的服务帐户中获取已解码的令牌，但是根据文档here 它说

在配置了令牌身份验证和匿名访问的服务器上启用后，提供无效承载令牌的请求将收到 401未经授权的错误。不提供承载令牌的请求将是被视为匿名请求。

所以我的api令牌似乎无效吗？但是，我按照步骤解码了所有内容。我非常关注this

我的Yaml文件：

apiVersion: apps/v1beta1 
kind: Deployment
metadata:
  name: first-app
  namespace: test-ns
spec:
  selector:
    matchLabels:
      app: first-app
  replicas: 3 
  template: 
    metadata:
      labels:
        app: first-app
    spec:
      serviceAccountName: test-sa
      containers:
      - name: first-app
        image: first-app
        imagePullPolicy: IfNotPresent

        volumeMounts:
        - name: secret-volume
          mountPath: /etc/secret-volume
        ports: 
        - containerPort: 80
        env:
        - name: "SECRET_KEY"
          value: /etc/secret-volume/secret-key
        - name: "SECRET_CRT"
          value: /etc/secret-volume/secret-crt
        - name: "CA_CRT"
          value: /etc/secret-volume/ca-cert
      volumes:
        - name: secret-volume
          secret: 
            secretName: test-secret

---
apiVersion: v1
kind: Service
metadata:
  name: first-app
  namespace: test-ns
spec:
  type: NodePort
  selector:
    app: first-app
  ports:
  - protocol: TCP
    port: 443 
    nodePort: 30000

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test-ns

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: system:test-app
  namespace: test-ns
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - services
  verbs:
  - '*'

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:test-app
  namespace: test-ns
subjects:
  - kind: ServiceAccount
    name: test-sa
    namespace: test-ns
roleRef:
  kind: ClusterRole
  name: system:test-app
  apiGroup: rbac.authorization.k8s.io

python kubernetes api连接未授权401

0 个答案: