Fix regressions in Configuration.get_api_key_with_prefix bearer-token prefix lookup by HaimLC · Pull Request #2618 · kubernetes-client/python

HaimLC · 2026-07-02T08:59:04Z

What type of PR is this?

/kind bug
/kind regression

What this PR does / why we need it:

#2604 restored the api_key['authorization'] fallback in auth_settings() by calling get_api_key_with_prefix('BearerToken', alias='authorization'), but get_api_key_with_prefix only applies the alias fallback to the api_key lookup, not the api_key_prefix lookup:

key=self.api_key.get(identifier, self.api_key.get(alias) ifaliasisnotNoneelseNone)
ifkey:
prefix=self.api_key_prefix.get(identifier) # never checks `alias`

So callers that set the prefix under the legacy 'authorization' key (rather than embedding "Bearer " directly in the token string) get a bearer token with no "Bearer " prefix in the resulting Authorization header. Most API servers — and specifically GKE's anonymous-auth fallback — don't recognize an unprefixed token as a valid bearer credential, so the request is treated as system:anonymous.

This reproduces with a plain manual Configuration(), no load_incluster_config()/load_kube_config() involved:

fromkubernetesimportclientconfiguration=client.Configuration()
configuration.api_key["authorization"] ="<token>"configuration.api_key_prefix["authorization"] ="Bearer"print(configuration.auth_settings())
# before this PR: value = '<token>' (missing "Bearer " prefix)# after this PR: value = 'Bearer <token>' (correct)

This PR applies the same alias fallback already used for the key lookup to the prefix lookup, symmetrically in the sync (kubernetes/client/configuration.py) and async (kubernetes/aio/client/configuration.py) variants.

Verified against a real cluster in production: a service using this exact pattern (manual Configuration with api_key/api_key_prefix under 'authorization', talking to an external GKE cluster) was hitting system:anonymous on 36.0.2. Built this fix into that service via a git+ dependency pointing at this branch and confirmed it now authenticates correctly against the live cluster with zero code changes on the caller's side.

Which issue(s) this PR fixes:

Fixes#2592

Comments in v36.0.0 regression: load_incluster_config() sends requests as system:anonymous on GKE #2592 from @markafarrell and @anastasiyatolstikenableu independently confirm 36.0.2 doesn't fully fix this for callers outside load_incluster_config()/load_kube_config(), matching this root cause.
Applied symmetrically to the sync and async variants, matching the precedent set by Restore bearer-token fallback in Configuration.auth_settings() #2604.
Added a regression test, test_auth_settings_with_authorization_key_and_prefix, covering the split key/prefix case that the existing Restore bearer-token fallback in Configuration.auth_settings() #2604 tests didn't exercise (those set the full 'Bearer abc123' string directly in api_key['authorization'], which doesn't touch the prefix lookup at all).
I did not touch scripts/apply-hotfixes.sh in this PR since it needs this commit's final SHA — happy to follow up with that once this merges, same as was done for 5621a4c after Restore bearer-token fallback in Configuration.auth_settings() #2604.

Does this PR introduce a user-facing change?

Fixed a regression where `Configuration.auth_settings()` would drop the `"Bearer "` prefix for callers using the legacy `api_key['authorization']` / `api_key_prefix['authorization']` convention, causing requests to be sent without a valid Authorization header and rejected as `system:anonymous`. This is a follow-up to the fix in #2604, which restored the key fallback but missed the prefix fallback.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

linux-foundation-easycla · 2026-07-02T08:59:11Z

The committers listed above are authorized under a signed CLA.

✅ login: HaimLC / name: HaimLC (5a8b6a5)

kubernetes-prow · 2026-07-02T08:59:14Z

Welcome @HaimLC!

It looks like this is your first PR to kubernetes-client/python 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-client/python has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

PR 2604 restored the api_key['authorization'] fallback in auth_settings() by calling get_api_key_with_prefix('BearerToken', alias='authorization'), but get_api_key_with_prefix only applied `alias` to the api_key lookup, not the api_key_prefix lookup. Callers that set the prefix under the legacy 'authorization' key (rather than embedding "Bearer " directly in the token) get a bearer token with no "Bearer " prefix, which most API servers (and GKE's anonymous-auth fallback) don't recognize as a valid Authorization header -> system:anonymous. Apply the same alias fallback to the prefix lookup, symmetrically in the sync (kubernetes/client/configuration.py) and async (kubernetes/aio/client/configuration.py) variants, matching the pattern PR 2604 already established for the key lookup. See kubernetes-client#2592 Signed-off-by: HaimLC <110099998+HaimLC@users.noreply.github.com>

Copilot

Pull request overview

Fixes a regression in Configuration.get_api_key_with_prefix() where the alias= fallback was applied to api_key but not to api_key_prefix, causing legacy bearer-token configurations (token and "Bearer" prefix stored separately under 'authorization') to emit an unprefixed Authorization header value.

Changes:

Apply alias fallback to api_key_prefix lookup in the sync Configuration.get_api_key_with_prefix().
Apply the same alias fallback to api_key_prefix lookup in the async aioConfiguration.get_api_key_with_prefix().
Add a regression test covering the legacy split token/prefix case for the sync configuration.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
kubernetes/client/configuration.py	Adds alias fallback to the prefix lookup so legacy `'authorization'` prefix keys are honored.
kubernetes/aio/client/configuration.py	Mirrors the same alias fallback behavior in the async configuration implementation.
kubernetes/test/test_api_client.py	Adds a regression test ensuring split `api_key`/`api_key_prefix` under `'authorization'` produces a properly prefixed bearer value.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

yliaog · 2026-07-06T23:22:39Z

 key = self.api_key.get(identifier, self.api_key.get(alias) if alias is not None else None)
 if key:
- prefix = self.api_key_prefix.get(identifier)
+ prefix = self.api_key_prefix.get(
+ identifier, self.api_key_prefix.get(alias) if alias is not None else None)
 if prefix:


could you please add a test case for async, similar to the sync case?

@HaimLC friendly ping ...

sorry didnt saw it in conversation :) fixing.

yliaog · 2026-07-04T01:04:20Z

please sign the CLA

HaimLC · 2026-07-06T22:44:53Z

signed

yliaog · 2026-07-08T20:34:03Z

@kramaranya could you review this PR ?

Mirror the sync test_auth_settings_with_authorization_key_and_prefix added in this PR, covering the same path in the async variant of get_api_key_with_prefix() via auth_settings(). Also fixes InClusterConfigTest base class from unittest.TestCase to IsolatedAsyncioTestCase so the existing async test_refresh_token actually runs. Signed-off-by: HaimLC <110099998+HaimLC@users.noreply.github.com>

yliaog · 2026-07-13T16:31:39Z

/lgtm
/approve

kubernetes-prow · 2026-07-13T16:31:44Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HaimLC, yliaog

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [yliaog]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yliaog · 2026-07-13T16:31:46Z

thanks for the PR

CopilotAI review requested due to automatic review settings July 2, 2026 08:59

kubernetes-prowBot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 2, 2026

HaimLC mentioned this pull request Jul 2, 2026
v36.0.0 regression: load_incluster_config() sends requests as system:anonymous on GKE #2592
Closed

kubernetes-prowBot requested review from roycaihw and yliaog July 2, 2026 08:59

Copilotstarted reviewing on behalf of HaimLC July 2, 2026 08:59 View session

HaimLC changed the title ~~Apply alias fallback to prefix lookup in get_api_key_with_prefix~~Fix regressions in Configuration.get_api_key_with_prefix bearer-token prefix lookupJul 2, 2026

HaimLC force-pushed the bearer-token-prefix-alias-fix branch from 1b5a8f8 to 5a8b6a5Compare July 2, 2026 09:01

kubernetes-prowBot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Jul 2, 2026

CopilotAI reviewed Jul 2, 2026
View reviewed changes

kubernetes-prowBot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jul 6, 2026

kramaranya mentioned this pull request Jul 7, 2026
fix: support kubernetes client v35-v36 token keys kubeflow/mlflow-integration#33
Merged
8 tasks

kubernetes-prowBot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 13, 2026

HaimLC force-pushed the bearer-token-prefix-alias-fix branch from 5e2c78c to c77c246Compare July 13, 2026 09:40

kubernetes-prowBot assigned yliaog Jul 13, 2026

kubernetes-prowBot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 13, 2026

kubernetes-prowBot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 13, 2026

kubernetes-prowBot merged commit e003e85 into kubernetes-client:masterJul 13, 2026
10 checks passed

tuzonghua mentioned this pull request Aug 17, 2026
Restore kubernetes-client 36.x support in cncf.kubernetes and google providers (401 auth regression) apache/airflow#69023
Open
3 tasks

Navigation Menu

Uh oh!

Fix regressions in Configuration.get_api_key_with_prefix bearer-token prefix lookup - #2618

Fix regressions in Configuration.get_api_key_with_prefix bearer-token prefix lookup#2618
kubernetes-prow[bot] merged 2 commits into
kubernetes-client:masterfrom
HaimLC:bearer-token-prefix-alias-fix

HaimLC commented Jul 2, 2026•
edited
Loading

Uh oh!

linux-foundation-easyclaBot commented Jul 2, 2026•
edited
Loading

Uh oh!

kubernetes-prowBot commented Jul 2, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

yliaogJul 6, 2026

Uh oh!

yliaogJul 8, 2026

Uh oh!

HaimLCJul 13, 2026

Uh oh!

yliaog commented Jul 4, 2026

Uh oh!

HaimLC commented Jul 6, 2026

Uh oh!

yliaog commented Jul 8, 2026

Uh oh!

yliaog commented Jul 13, 2026

Uh oh!

kubernetes-prowBot commented Jul 13, 2026

Uh oh!

yliaog commented Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

HaimLC commented Jul 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

linux-foundation-easyclaBot commented Jul 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kubernetes-prowBot commented Jul 2, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

yliaogJul 6, 2026

Choose a reason for hiding this comment

Uh oh!

yliaogJul 8, 2026

Choose a reason for hiding this comment

Uh oh!

HaimLCJul 13, 2026

Choose a reason for hiding this comment

Uh oh!

yliaog commented Jul 4, 2026

Uh oh!

HaimLC commented Jul 6, 2026

Uh oh!

yliaog commented Jul 8, 2026

Uh oh!

yliaog commented Jul 13, 2026

Uh oh!

kubernetes-prowBot commented Jul 13, 2026

Uh oh!

yliaog commented Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

HaimLC commented Jul 2, 2026•
edited
Loading

linux-foundation-easyclaBot commented Jul 2, 2026•
edited
Loading