You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "antonio-mello-ai (via GitHub)" <gi...@apache.org> on 2026/03/12 21:01:29 UTC
[PR] fix(providers/cncf-kubernetes): apply verify_ssl=False to returned ApiClient in KubernetesHook [airflow]
antonio-mello-ai opened a new pull request, #63478:
URL: https://github.com/apache/airflow/pull/63478
## Summary
- Fix `KubernetesHook` so that `disable_verify_ssl=True` actually disables SSL verification on the returned `ApiClient`
- The root cause: `load_kube_config()` overwrites `Configuration.set_default()` with a fresh `Configuration(verify_ssl=True)`, so the earlier `_disable_verify_ssl()` call is lost
- Fix: re-apply `verify_ssl=False` after each config load, and pass the configuration explicitly to `_TimeoutK8sApiClient`
## Root Cause
`_disable_verify_ssl()` calls `Configuration.set_default()` to register `verify_ssl=False` globally. However, `load_kube_config()` (called right after) creates a new `Configuration` instance with `verify_ssl=True` by default and overwrites the global default. The `_TimeoutK8sApiClient()` then gets `verify_ssl=True` from `get_default_copy()`.
## Test Plan
- [x] New parametrized test covering all 4 config paths (`kube_config_path`, `kube_config`, `config_dict`, `default_client`)
- [x] All 138 tests pass
- [x] All pre-commit hooks pass (`prek`)
Closes #56432
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(providers/cncf-kubernetes): apply verify_ssl=False to returned ApiClient in KubernetesHook [airflow]
Posted by "antonio-mello-ai (via GitHub)" <gi...@apache.org>.
antonio-mello-ai commented on code in PR #63478:
URL: https://github.com/apache/airflow/pull/63478#discussion_r2928064345
##########
providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/hooks/kubernetes.py:
##########
@@ -295,6 +295,8 @@ def get_conn(self) -> client.ApiClient:
if disable_verify_ssl is True:
_disable_verify_ssl()
+ if self.client_configuration is None:
+ self.client_configuration = client.Configuration.get_default_copy()
Review Comment:
Great suggestion — refactored in 83910f3. `_TimeoutK8sApiClient.__init__` now accepts a `disable_verify_ssl` keyword argument and handles the `configuration.verify_ssl = False` logic internally (creating a default config copy if none was passed). All call sites now just forward the flag:
```python
return _TimeoutK8sApiClient(
configuration=self.client_configuration,
disable_verify_ssl=disable_verify_ssl is True,
)
```
138 tests still passing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(providers/cncf-kubernetes): apply verify_ssl=False to returned ApiClient in KubernetesHook [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #63478:
URL: https://github.com/apache/airflow/pull/63478#issuecomment-4057504644
@jscheffl — Could you please check whether your review feedback on this PR has been addressed? @antonio-mello-ai appears to have responded to your comments. @antonio-mello-ai, do you believe the reviewer's concerns have been resolved?
If the concerns are resolved, please resolve the conversation threads. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(providers/cncf-kubernetes): apply verify_ssl=False to returned ApiClient in KubernetesHook [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #63478:
URL: https://github.com/apache/airflow/pull/63478
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(providers/cncf-kubernetes): apply verify_ssl=False to returned ApiClient in KubernetesHook [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on code in PR #63478:
URL: https://github.com/apache/airflow/pull/63478#discussion_r2927487935
##########
providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/hooks/kubernetes.py:
##########
@@ -295,6 +295,8 @@ def get_conn(self) -> client.ApiClient:
if disable_verify_ssl is True:
_disable_verify_ssl()
+ if self.client_configuration is None:
+ self.client_configuration = client.Configuration.get_default_copy()
Review Comment:
Can you maybe use the extended constructor of `_TimeoutK8sApiClient` to pass the bool `disable_verify_ssl`? Then you do not need to adjust client config on so many places but can centralize this. Less risk for future inconsistency.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org