_refresh_oidc is broken if using a publicly signed cert

[linuxfreakus]

What happened (please include outputs or screenshots):

When I call config.load_kube_config() it bombs out loading the config when i have an OIDC auth method that talks to a host using a publicly signed cert

urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='my.hostname.com', port=443): Max retries exceeded with url: /auth/idp/k8sIdp/.well-known/openid-configuration (Caused by SSLError(SSLError(136, '[X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4149)')))

What you expected to happen:

No error should occur, the config works with every other client that I use it with, including kubectl.

How to reproduce it (as minimally and precisely as possible):

- name: username
  user:
    auth-provider:
      config:
        client-id: kubernetes
        client-secret: ''
        id-token: <redacted>
        idp-certificate-authority-data: ""
        idp-issuer-url: https://my.hostname.com/auth/idp/k8sIdp
        refresh-token: <redacted>
      name: oidc

Anything else we need to know?:

The problem is in this method: https://github.com/kubernetes-client/python/blob/9775a1276b98895fa0cdd56468c559421b59911f/kubernetes/base/config/kube_config.py#L422

The code finds that the idp-certificate-authority-data key exists, and tries to use it even though it is empty.... but furthermore, even if you were to remove that line, that would cause it to fall down to disable the ssl check!! This should not happen. It should fall back to using the system default public CA bundle.

If I set idp-certificate-authority: /etc/ssl/certs/ca-certificates.crt then it works, but that is brittle since not every system will have the same setup and it should just fall back to system defaults anyway.

Environment:

• Kubernetes version (kubectl version): Client Version: v1.32.1 Kustomize Version: v5.5.0 Server Version: v1.31.3

• OS (e.g., MacOS 10.13.6): Docker image python:3.11

• Python version (python --version): Python 3.11.11

• Python client version (pip list | grep kubernetes): 32.0.0

[roycaihw]

@linuxfreakus Would you like to send a fix for this method?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.