how to get kubectl configuration from azure aks with python?

Question

I create a k8s deployment script with python, and to get the configuration from kubectl, I use the python command:

from kubernetes import client, config

config.load_kube_config()

to get the azure aks configuration I use the following az commands:

az login
az aks get-credentials --resource-group [resource group name] --name [aks name]

is there any way to get azure aks credential only from python and without the need of the az commands?

thanks!

Foliated

yeah, use python sdk and call the same api directly (or without using sdk, just do an http request to the api). but, just doing something subprocess.check_call('az aks get-credentials --resource-group [resource group name] --name [aks name]', shell=True) would be a lot easier – Sufism

I don't want to use the subprocess solution because I don't want to login to Azure in az command (i don't want to depend on a az package, only on python). – Foliated

well, you have to authenticate either way, its up to you. python sdk github.com/Azure/azure-sdk-for-python. and this is probably the call you are interested it: github.com/Azure/azure-sdk-for-python/blob/master/… – Sufism

thank you very much! i use list_cluster_admin_credential to get my configuration – Foliated

I don't like calling a sub process because defeats the purpose of having pythonic code. TBH, There should be a way to use Kubectl Python Client along with Azure Python SDK. – Mccrory

Answer 1

In this case the solution was to use Azure Python SDK to retrieve cluster credentials directly from Azure API bypassing Az Cli.

https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/containerservice/azure-mgmt-containerservice/azure/mgmt/containerservice/v2019_11_01/operations/_managed_clusters_operations.py#L320

Sufism

Broken link. @Sufism do you happen to have a valid link? Thank you. – Brindled

github.com/Azure/azure-sdk-for-python/blob/master/sdk/… – Sufism

@Sufism could you edit this to have a snippet where you use that? the lack of documentation in the azure github is driving me insane.. – Radiocarbon

please create a new question for this – Sufism

see also meta.stackexchange.com/questions/8231/… and meta.stackexchange.com/questions/225370/… why should I ask the same question as OP again? a link is not an answer – Radiocarbon

a link is not an answer, who accepts these things. The file that was shared is about 10K in size, how can we find the correct part from that file. – Durgy

Answer 2

Yes, this can be done with the Azure Python SDK.

from azure.identity import DefaultAzureCredential
from azure.mgmt.containerservice import ContainerServiceClient

credential = DefaultAzureCredential(exclude_cli_credential=True)
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]
container_service_client = ContainerServiceClient(credential, subscription_id)

kubeconfig = container_service_client.managed_clusters.list_cluster_user_credentials("resourcegroup-name", "cluster-name").kubeconfigs[0]

Caines

Once I have received the kubeconfig, how do I use it with Kubectl Python Client? I am using from kubernetes import client, config. Any help appreciated much! – Mccrory

Answer 3

Just expanding on @user1110502's excellent answer, the kubeconfig you get is a CredentialResult object. You can turn that into a yaml string which can then be saved as a file like below:

aks_client = ContainerServiceClient(credential, subscription_id)
result: CredentialResult = aks_client.managed_clusters.list_cluster_user_credentials(
    "resourcegroup-name", "cluster-name"
).kubeconfigs[0]
kubeconfig: str = result.value.decode("utf-8")

To then use this config in the kubernetes python library you could save it as a file and load it in the usual manner with kubernetes.config.load_kube_config, however the same can be achieved without the unnecessary disk IO like below:

import yaml
import kubernetes
from kubernetes.config.kube_config import KubeConfigLoader

cfg_dict = yaml.safe_load(kubeconfig)
loader = KubeConfigLoader(cfg_dict)
config = client.Configuration()
loader.load_and_set(config)
client.Configuration.set_default(config)

The kubernetes library can then be connected to your AKS cluster:

with kubernetes.client.ApiClient(config) as api_client:
    api = client.WellKnownApi(api_client)
    resp = api.get_service_account_issuer_open_id_configuration()
    print(resp)

Baryram