diff --git a/lightkube/config/client_adapter.py b/lightkube/config/client_adapter.py index eb0b04d..e3af5c6 100644 --- a/lightkube/config/client_adapter.py +++ b/lightkube/config/client_adapter.py @@ -1,5 +1,6 @@ import json import os +import ssl import subprocess from typing import Optional import asyncio.subprocess @@ -37,8 +38,7 @@ def httpx_parameters(config: SingleConfig, timeout: httpx.Timeout, trust_env: bo return dict( timeout=timeout, base_url=config.cluster.server, - verify=verify_cluster(config.cluster, config.abs_file), - cert=user_cert(config.user, config.abs_file), + verify=verify_cluster(config.cluster, config.user, config.abs_file, trust_env=trust_env), auth=user_auth(config.user), trust_env=trust_env, ) @@ -153,12 +153,15 @@ def user_cert(user: User, abs_file): return None -def verify_cluster(cluster: Cluster, abs_file): +def verify_cluster(cluster: Cluster, user: User, abs_file, trust_env: bool = True): """setup certificate verification""" if cluster.certificate_auth: - return abs_file(cluster.certificate_auth) + ctx = ssl.create_default_context(cafile=abs_file(cluster.certificate_auth)) elif cluster.certificate_auth_data: - return FileStr(cluster.certificate_auth_data) - elif cluster.insecure: - return False - return True + ctx = ssl.create_default_context(cafile=FileStr(cluster.certificate_auth_data)) + else: + ctx = httpx.create_ssl_context(verify=not cluster.insecure, trust_env=trust_env) + cert = user_cert(user, abs_file) + if cert: + ctx.load_cert_chain(*cert) + return ctx diff --git a/setup.py b/setup.py index 32f576e..62a9cc2 100644 --- a/setup.py +++ b/setup.py @@ -3,7 +3,7 @@ setup( name='lightkube', - version="0.15.7", + version="0.15.8", description='Lightweight kubernetes client library', long_description=Path("README.md").read_text(), long_description_content_type="text/markdown", @@ -15,13 +15,13 @@ package_data={'lightkube': ['py.typed']}, install_requires=[ 'lightkube-models >= 1.15.12.0', - 'httpx >= 0.24.0, < 0.28.0, < 1.0.0', + 'httpx >= 0.24.0, < 1.0.0', 'PyYAML' ], extras_require={ "dev": [ "pytest", - "pytest-asyncio<0.17.0", + "pytest-asyncio", "respx" ] },