Python: Reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)

[abhi-paul]

Hi all,
I am not able to use connect_get_namespaced_pod_exec() method to execute any coomand in k8s cluster Pod, but able call any list method like self.core_api_instance.list_namespaced_pod()
I am able to run kubectl client command, if certificate was issue i couldn't have able to run kubectl command, i am using Python 2.7.5 and

pip3 list
appdirs (1.4.3)
Babel (2.3.4)
certifi (2017.4.17)
chardet (3.0.3)
cliff (2.8.0)
cmd2 (0.7.5)
debtcollector (1.17.0)
docker (2.4.2)
docker-pycreds (0.2.1)
freeze (1.0.10)
httplib2 (0.10.3)
idna (2.5)
ipaddress (1.0.18)
iso8601 (0.1.11)
kafka (1.3.3)
keystoneauth1 (3.0.0)
kubernetes (2.0.0)
kubernetes-py (1.5.6.22)
monotonic (1.3)
msgpack-python (0.4.8)
netaddr (0.7.19)
netifaces (0.10.6)
oauth2client (4.1.2)
os-client-config (1.28.0)
osc-lib (1.7.0)
oslo.i18n (3.17.0)
oslo.serialization (2.20.0)
oslo.utils (3.28.0)
pbr (3.1.1)
pip (9.0.1)
positional (1.1.1)
prettytable (0.7.2)
pyasn1 (0.2.3)
pyasn1-modules (0.0.9)
pyparsing (2.2.0)
pyperclip (1.5.27)
python-dateutil (2.6.1)
python-heatclient (1.10.0)
python-novaclient (9.0.1)
python-swiftclient (3.3.0)
pytz (2017.2)
PyYAML (3.12)
requests (2.15.1)
requestsexceptions (1.3.0)
rsa (3.4.2)
setuptools (36.2.0)
simplejson (3.11.1)
six (1.10.0)
stevedore (1.25.0)
urllib3 (1.22)
uuid (1.30)
websocket-client (0.44.0)
wrapt (1.10.10)

also using following ~/.kube/config,

from kubernetes import client, config
config.load_kube_config()

any folks can tell root cause behind this error.

[mbohlool]

We test with python 2.7.12. Are you on Mac? Or Anaconda? What is the error?

[abhi-paul]

I am on linux-red hat, error is,

Exception when calling connect_get_namespaced_pod_exec: (0)
Reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)

all certificate & authorization key of my k8s cluster are mentioned at ~/.kube/config file.
same error even with python 3

[abhi-paul]

folks any update regarding this issue or any workaround??

[mbohlool]

Can you give more detail please? what is your cluster? (gke, gce, etc.) Also a redacted version of your kube config file is useful. Please set configuration.debug to True and provide the full output.

[abhi-paul]

can any one tell where to set configuration.debug to True ?

[mbohlool]

from kubernetes.client import configuration
configuration.debug=True

[abhi-paul]

debug set to True, but still same output

Command to be executed ls
Exception when calling the                     connect_get_namespaced_pod_exec (0)
Reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)
Exception when calling the                     connect_get_namespaced_pod_exec (0)
Reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720)

kubectl version
Client Version: version.Info{Major:"1", Minor:"7"}
Server Version: version.Info{Major:"1", Minor:"6"}

[mbohlool]

You probably need to downgrade your websocket package. it is 0.44 that is not supported according to this line from requirements.txt file:

websocket-client>=0.32.0,<=0.40.0

Also there is an exec example in examples folder.

[abhi-paul]

@mbohlool Thanks a lot!!! it's worked out...websocket-client downgrade to 0.40.0 and it's run smoothly. Can you also please mention how you suspect that websocket-client version is the culprit? &
Where is mention this requirements.txt file? any link?
Is there any matrix kind of things are there for kubernetes-incubator/client-python dependent packages?
Again Thanks...:)

[mbohlool]

The file is on repo's root: https://github.com/kubernetes-incubator/client-python/blob/master/requirements.txt

ref: https://github.com/kubernetes-incubator/client-python#hostname-doesnt-match