Skip to content

Commit f3b6a1f

Browse files
sajjadghfsajjadghf
committed
fix: add disable_strict_ssl_verification to sync client (Python 3.13 RFC 5280 compat)
1 parent f8c3ba2 commit f3b6a1f

5 files changed

Lines changed: 104 additions & 9 deletions

File tree

‎kubernetes/aio/client/rest.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,8 @@ def __init__(self, configuration, pools_size=4, maxsize=None):
6262
ssl_context.check_hostname = False
6363
ssl_context.verify_mode = ssl.CERT_NONE
6464
if configuration.disable_strict_ssl_verification:
65-
ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
65+
if hasattr(ssl, 'VERIFY_X509_STRICT') and hasattr(ssl_context, 'verify_flags'):
66+
ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
6667

6768
connector = aiohttp.TCPConnector(
6869
limit=maxsize,

‎kubernetes/client/configuration.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,14 @@ def __init__(self, host=None,
179179
Set this to false to skip verifying SSL certificate when calling API
180180
from https server.
181181
"""
182+
self.disable_strict_ssl_verification = False
183+
"""Set to true, to accept certificates violate X509 strict certificate
184+
verification requirements, like missing the following extensions:
185+
- X509v3 Subject Key Identifier
186+
- X509v3 Authority Key Identifier
187+
- X509v3 Subject Alternative Name
188+
(It is implemented by removing ssl.VERIFY_X509_STRICT from SSLContext.verify_flags)
189+
"""
182190
self.ssl_ca_cert = ssl_ca_cert
183191
"""Set this to customize the certificate file to verify the peer.
184192
"""

‎kubernetes/client/rest.py‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,27 +81,41 @@ def __init__(self, configuration, pools_size=4, maxsize=None):
8181
else:
8282
maxsize = 4
8383

84+
if configuration.disable_strict_ssl_verification:
85+
ssl_context = ssl.create_default_context(cafile=configuration.ssl_ca_cert)
86+
if configuration.cert_file:
87+
ssl_context.load_cert_chain(
88+
configuration.cert_file, keyfile=configuration.key_file
89+
)
90+
if not configuration.verify_ssl:
91+
ssl_context.check_hostname = False
92+
ssl_context.verify_mode = ssl.CERT_NONE
93+
if hasattr(ssl, 'VERIFY_X509_STRICT') and hasattr(ssl_context, 'verify_flags'):
94+
ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
95+
ssl_pool_kwargs = {'ssl_context': ssl_context}
96+
else:
97+
ssl_pool_kwargs = {
98+
'cert_reqs': cert_reqs,
99+
'ca_certs': configuration.ssl_ca_cert,
100+
'cert_file': configuration.cert_file,
101+
'key_file': configuration.key_file,
102+
}
103+
84104
# https pool manager
85105
if configuration.proxy and not should_bypass_proxies(configuration.host, no_proxy=configuration.no_proxy or ''):
86106
self.pool_manager = urllib3.ProxyManager(
87107
num_pools=pools_size,
88108
maxsize=maxsize,
89-
cert_reqs=cert_reqs,
90-
ca_certs=configuration.ssl_ca_cert,
91-
cert_file=configuration.cert_file,
92-
key_file=configuration.key_file,
93109
proxy_url=configuration.proxy,
94110
proxy_headers=configuration.proxy_headers,
111+
**ssl_pool_kwargs,
95112
**addition_pool_args
96113
)
97114
else:
98115
self.pool_manager = urllib3.PoolManager(
99116
num_pools=pools_size,
100117
maxsize=maxsize,
101-
cert_reqs=cert_reqs,
102-
ca_certs=configuration.ssl_ca_cert,
103-
cert_file=configuration.cert_file,
104-
key_file=configuration.key_file,
118+
**ssl_pool_kwargs,
105119
**addition_pool_args
106120
)
107121

‎scripts/client_configuration_disable_ssl_strict_verification_patch.diff‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
diff --git a/kubernetes/client/configuration.py b/kubernetes/client/configuration.py
2+
index d113df1e6..92ef01ec2 100644
3+
--- a/kubernetes/client/configuration.py
4+
+++ b/kubernetes/client/configuration.py
5+
@@ -179,6 +179,14 @@ conf = client.Configuration(
6+
Set this to false to skip verifying SSL certificate when calling API
7+
from https server.
8+
"""
9+
+ self.disable_strict_ssl_verification = False
10+
+ """Set to true, to accept certificates violate X509 strict certificate
11+
+ verification requirements, like missing the following extensions:
12+
+ - X509v3 Subject Key Identifier
13+
+ - X509v3 Authority Key Identifier
14+
+ - X509v3 Subject Alternative Name
15+
+ (It is implemented by removing ssl.VERIFY_X509_STRICT from SSLContext.verify_flags)
16+
+ """
17+
self.ssl_ca_cert = ssl_ca_cert
18+
"""Set this to customize the certificate file to verify the peer.
19+
"""

‎scripts/rest_client_disable_ssl_strict_verification_patch.diff‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
diff --git a/kubernetes/client/rest.py b/kubernetes/client/rest.py
2+
index 7c461b32e..e88290ef7 100644
3+
--- a/kubernetes/client/rest.py
4+
+++ b/kubernetes/client/rest.py
5+
@@ -81,27 +81,40 @@ class RESTClientObject(object):
6+
else:
7+
maxsize = 4
8+
9+
+ if configuration.disable_strict_ssl_verification:
10+
+ ssl_context = ssl.create_default_context(cafile=configuration.ssl_ca_cert)
11+
+ if configuration.cert_file:
12+
+ ssl_context.load_cert_chain(
13+
+ configuration.cert_file, keyfile=configuration.key_file
14+
+ )
15+
+ if not configuration.verify_ssl:
16+
+ ssl_context.check_hostname = False
17+
+ ssl_context.verify_mode = ssl.CERT_NONE
18+
+ if hasattr(ssl, 'VERIFY_X509_STRICT') and hasattr(ssl_context, 'verify_flags'):
19+
+ ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
20+
+ ssl_pool_kwargs = {'ssl_context': ssl_context}
21+
+ else:
22+
+ ssl_pool_kwargs = {
23+
+ 'cert_reqs': cert_reqs,
24+
+ 'ca_certs': configuration.ssl_ca_cert,
25+
+ 'cert_file': configuration.cert_file,
26+
+ 'key_file': configuration.key_file,
27+
+ }
28+
+
29+
# https pool manager
30+
if configuration.proxy and not should_bypass_proxies(configuration.host, no_proxy=configuration.no_proxy or ''):
31+
self.pool_manager = urllib3.ProxyManager(
32+
num_pools=pools_size,
33+
maxsize=maxsize,
34+
- cert_reqs=cert_reqs,
35+
- ca_certs=configuration.ssl_ca_cert,
36+
- cert_file=configuration.cert_file,
37+
- key_file=configuration.key_file,
38+
proxy_url=configuration.proxy,
39+
proxy_headers=configuration.proxy_headers,
40+
+ **ssl_pool_kwargs,
41+
**addition_pool_args
42+
)
43+
else:
44+
self.pool_manager = urllib3.PoolManager(
45+
num_pools=pools_size,
46+
maxsize=maxsize,
47+
- cert_reqs=cert_reqs,
48+
- ca_certs=configuration.ssl_ca_cert,
49+
- cert_file=configuration.cert_file,
50+
- key_file=configuration.key_file,
51+
+ **ssl_pool_kwargs,
52+
**addition_pool_args
53+
)

0 commit comments

Comments
 (0)