Buggy conditional in kube_config.py (TypeError: '<' not supported between instances of 'int' and 'time.struct_time')

[wunzeco]

python-base/config/kube_config.py

Line 211 in d68e456

if int(provider['config']['expires-on']) < time.gmtime():

The line above fails with the error:

 File "/Users/ogonna/virtualenvs/k8stlsingress-Q6OI3mKm/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 505, in load_kube_config
    loader.load_and_set(config)
  File "/Users/ogonna/virtualenvs/k8stlsingress-Q6OI3mKm/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 386, in load_and_set
    self._load_authentication()
  File "/Users/ogonna/virtualenvs/k8stlsingress-Q6OI3mKm/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 183, in _load_authentication
    if self._load_auth_provider_token():
  File "/Users/ogonna/virtualenvs/k8stlsingress-Q6OI3mKm/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 198, in _load_auth_provider_token
    return self._load_azure_token(provider)
  File "/Users/ogonna/virtualenvs/k8stlsingress-Q6OI3mKm/lib/python3.6/site-packages/kubernetes/config/kube_config.py", line 209, in _load_azure_token
    if int(provider['config']['expires-on']) < time.gmtime():
TypeError: '<' not supported between instances of 'int' and 'time.struct_time'

Suggested fix:

            if time.gmtime(int(provider['config']['expires-on'])) < time.gmtime():
                self._refresh_azure_token(provider['config'])

[sdktr]

This fix (and the original behavior as well) causes issues for me. My assumption is the date format when the kubeconfig is accessed by Windows as well, since I'm running on Windows Subsystem for Linux and use a mounted file as Kubeconfig?

        if time.gmtime(int(provider['config']['expires-on'])) < time.gmtime():
    ValueError: invalid literal for int() with base 10: '2018-10-18 00:52:29.044727'

[mathieuherbert]

Hi,
I have the same error with AKS and AAD authentication. Is there any update on this issue ?
Thanks !

[savitharaghunathan]

I also have the same error with AKS integrated with AAD. Any updates on how to resolve this?

Thanks!

[richard-reece]

I'm seeing the same issue as @sdktr with the expires-on value being '2019-03-15 13:36:54.245657'

[fatal-exception]

The problem is that expires-on is sometimes an integer (time after epoch?) and sometimes a datestring in %Y-%m-%d %H:%M:%S.%f format.

I believe this is the solution that is needed to fit both cases

       if 'expires-on' in provider['config']:
            try:
                 if time.gmtime(int(provider['config']['expires-on'])) < time.gmtime():
                    self._refresh_azure_token(provider['config'])
            except ValueError:  # sometimes expires-on is not an int, but a datestring
                if time.strptime(provider['config']['expires-on'], '%Y-%m-%d %H:%M:%S.%f') < time.gmtime():
                    self._refresh_azure_token(provider['config'])

[fatal-exception]

Can @richard-reece and @wunzeco confirm that this works for both use cases?

[richard-reece]

Looks good to me, thanks! And indeed during my testing it was sometimes an epoch integer. Yay.

[wunzeco]

Looks good to me too. Awesome!

[fatal-exception]

after further discussion with @wunzeco I'm going to raise this as a separate PR

[Sephtex]

I'm encountering the same issue. Seems when kubectl is initially getting the config, expires-on is an integer, which is ok. But when _refresh_azure_token is called from site-packages/kubernetes/config/kube_config.py the refreshed token will return a timestamp like '2019-04-25 11:41:40.204877'. And the 2nd time you call the module, it fails.
Checking and comparing it with az, the expires-on is always a timestamp.

[rabidang3ls]

@Sephtex I just encountered the same thing. If you update kubernetes/config/kube_config.py with @fatal-exception 's fix, it works. Manually editing isn't awesome, but it looks like a pull request is open to fix this issue.

[edit]
Just checked, it has the wrong code in the pull request. Left a comment with updated code.

[tundeaoni]

Thanks , this worked for me too. Implemented this fix via monkey patching _load_azure_token method pending the merging the PR addressing the issue.

[codemug]

Facing the same issue, waiting for the fix to merge

[paltryeffort]

I use AKS with AAD authentication and I have the same issue. The fix is working for me.

[bitsofinfo]

same issue

[blurLake]

The same issue with kubernetes 10.0.1

[jhaumont]

The same issue with kubernetes 10.0.1

Same for me. Fix if I force the version to 11.0.0b2