Having trouble running example

I get 403 Forbidden when running Example.java. I tried setting KUBECONFIG to the absolute path of my ~/.kube/config file. I’m able to run kubectl get pods --all-namespaces. Is there something I’m missing?

null for gcp
Exception in thread "main" io.kubernetes.client.ApiException: Forbidden
	at io.kubernetes.client.ApiClient.handleResponse(ApiClient.java:882)
	at io.kubernetes.client.ApiClient.execute(ApiClient.java:798)
	at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespacesWithHttpInfo(CoreV1Api.java:18462)
	at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespaces(CoreV1Api.java:18440)
	at io.kubernetes.client.examples.Example.main(Example.java:40)

[neuromantik33]

Ok I figured it out 😃 So I noticed that my kubectl uses basic auth to connect to the cluster

$ kubectl get ns -v=7
I0109 18:22:33.143878   27156 loader.go:357] Config loaded from file /home/nestrada/.kube/config
...
I0109 18:22:33.153456   27156 round_trippers.go:414] GET https://35.189.xxx.xxx/api/v1/namespaces
I0109 18:22:33.153463   27156 round_trippers.go:421] Request Headers:
I0109 18:22:33.156114   27156 round_trippers.go:424]     Accept: application/json
I0109 18:22:33.156167   27156 round_trippers.go:424]     User-Agent: kubectl/v1.8.4 (linux/amd64) kubernetes/9befc2b
I0109 18:22:33.156212   27156 round_trippers.go:424]     Authorization: Basic REDACTED
I0109 18:22:33.202874   27156 round_trippers.go:439] Response Status: 200 OK in 46 milliseconds
NAME          STATUS    AGE
default       Active    67d

Yet after digging around in the master branch It seems to have been corrected but not in the 1.0.0-beta1 release. However the correction is not complete. Since my defaultConfig uses basic auth over https, it has a username, password and client certificate but no access token. My workaround was to create one without the factory method.

def username, password, endpoint // Defined elsewhere
def auth = "${username}:${password}".getBytes('ISO-8859-1')
def client = new ApiClient().with {
    basePath = "https://$endpoint"
    verifyingSsl = true
    sslCaCert = getClass().getResourceAsStream('/cluster.cert')
    apiKeyPrefix = 'Basic'
    apiKey = encoder.encodeToString(auth)
    it
}

And it works 😃

A more deeper question would be why create many Authentication methods (ApiKeyAuth, HttpBasicAuth, OAuth) if all API calls hardcode the BearerToken key requiring API only?

Anyhow hope this helps anyone else struggling with GKE 😃

[lwander]

Thanks - I don’t think the client fully supports the gcp authenticator (at the very minimum token refresh isn’t implemented). It looks like you’re running on GKE, so you could try

gcloud config set container/use_client_certificate True
gcloud container clusters get-credentials my-cluster

To get a credential format the client accepts in the meantime.