How to get the kubeconfig from pinniped via Python?

[junoriosity]

I install everything Pinniped-related in my K8s cluster via

kubectl apply -f https://get.pinniped.dev/v0.13.0/install-pinniped-concierge-crds.yaml
kubectl apply -f https://get.pinniped.dev/v0.13.0/install-pinniped-concierge-resources.yaml

cat <<EOF | kubectl apply -f -
kind: JWTAuthenticator
apiVersion: authentication.concierge.pinniped.dev/v1alpha1
metadata:
  name: jwt-authenticator
spec:
  issuer: https://my-auth.eu.auth0.com/
  audience: my-client-id
  claims:
    groups: groups
    username: email
EOF

cat <<EOF | kubectl apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubeapps-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: test@test.com
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: kubeapps-operators
EOF

Normally I would generate a kubeconfig file like

pinniped get kubeconfig \
  --concierge-authenticator-type jwt \
  --concierge-authenticator-name jwt-authenticator \
  --oidc-client-id my-client-id \
  --oidc-scopes openid,email \
  --oidc-listen-port 12345 \
  > my-cluster.yaml

But I want to generate the kubeconfig file via Python. Hence, I started this Python code with

from kubernetes import client, config

config.load_kube_config("/path/to/my/config", context="my-context")
client_corev1api= client.CoreV1Api()

api_response = client_corev1api_region.api_client.call_api(
    '/api/v1/namespaces/pinniped-concierge/services/pinniped-concierge-api:443/', 'GET',
    auth_settings = ['BearerToken'], response_type='json', _preload_content=False,
    query_params = {
        'concierge-authenticator-type': 'jwt', 
        'concierge-authenticator-name': 'jwt-authenticator', 
        'oidc-client-id': 'my-client-id', 
        'oidc-scopes': 'openid,email', 
        'oidc-listen-port': '12345'
    }
)

print(json.loads(api_response[0].read().decode("utf-8")))

but I receive

ApiException: (404)
Reason: Not Found
HTTP response headers: HTTPHeaderDict({'Audit-Id': 'cf86832b-93dc-4aba-af46-40285ba0a407', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'X-Kubernetes-Pf-Flowschema-Uid': 'b482d70b-591b-4084-a402-543dcdf508ba', 'X-Kubernetes-Pf-Prioritylevel-Uid': 'a5bc4bf9-fbc2-4eeb-a56a-adbd45767f54', 'Date': 'Thu, 24 Feb 2022 20:03:34 GMT', 'Content-Length': '228'})
HTTP response body: b'{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"services \\"pinniped-concierge-api:443\\" not found","reason":"NotFound","details":{"name":"pinniped-concierge-api:443","kind":"services"},"code":404}\n'

Do you know how to make it possible to retrieve that via Python? :)

[cfryanr]

Hi @junoriosity,

pinniped get kubeconfig is a CLI command (written in Golang) which performs a lot of client-side business logic. It makes various API calls to the cluster to discover its configuration, and then it makes some client-side choices and generates the kubeconfig file client-side. You can see the implementation here. There is not a corresponding server-side API that can do the same thing.

Perhaps in your Python code you can exec the pinniped CLI as a subprocess to generate the kubeconfig? I don't think I have enough context on what you're trying to accomplish by using Python to know if this suggestion is helpful or not.

[junoriosity]

Many thanks for your reply. That was already very helpful

Okay, using the CLI as a subprocess is definitely something I can do. I was rather thinking whether there are any APIs I could call instead.

So, when I have several clusters, I want to create a combined kubeconfig. To me, there are two ways of achieving that:

• Pinniped calls one cluster after the other (Is there an elegant way to switch between clusters in the Pinniped CLI?)
• Pinniped calls all clusters combined

Could you give me a code snippet at hand to do that?

[cfryanr]

Yes, the typical way would be to use pinniped get kubeconfig multiple times, once for each cluster. Each invocation can point to a different cluster by using --kubeconfig and, if needed, --kubeconfig-context, or using the KUBECONFIG env var. These invocations will generate a new kubeconfig file per cluster.

If you wanted to create a single combined kubeconfig file for all of those clusters, you could merge the individual kubeconfig files into a single file using kubectl. See https://pinniped.dev/docs/tutorials/concierge-and-supervisor-demo/ for an example of doing that (search for "merge" within that doc).