Repository: kubernetes-incubator/client-python (python)

Issue:
Contents of service account token mounted in POD is being base64 encoded
A project I have is using the client-python and using the mounted tokens wasn't working. After some investigation I figured out that the token file contents is being encoded in base64. From my understanding this content should not be encoded after read, the token should be ready to use.

The problem is in the [KubeConfigLoader#_load_user_token](https://github.com/kubernetes-incubator/client-python/blob/master/kubernetes/config/kube_config.py#L164-L170) which uses the class `FileOrData#as_data` and encode the contents of the file after read.

I have created a small project that illustrates the problem. I create a [ConfigMap](https://github.com/rafaelcaricio/kube-pods-lister/blob/0.1.0/deployment.yaml#L32-L57) which uses the service account token from the filesystem in a custom `kubeconfig`. Then I use the function [`new_client_from_config`](https://github.com/rafaelcaricio/kube-pods-lister/blob/0.1.0/pods_lister.py#L35) in my app passing this custom `kubeconfig`.

A work around I used for now is to split the `Bearer ` part of the header and decode the token and concat it back.
```python
authotization = config.api_key.get('authorization')
k, v = authorization.split(' ')
v = base64.decodebytes(v.encode())
request.headers['Authorization'] = "{} {}".format(k, v.decode())
```

Maybe I am missing the reason why the contents of the token file is being encoded in base64?

Pull request:
BUGFIX: token file should not be decoded
Fixes #182

Also patch this to Release 1.0.

Patch:
diff --git a/kubernetes/config/kube_config.py b/kubernetes/config/kube_config.py
index b33b9c9d7..b0ddeaa6a 100644
--- a/kubernetes/config/kube_config.py
+++ b/kubernetes/config/kube_config.py
@@ -59,14 +59,18 @@ class FileOrData(object):
      content of obj[%file_key_name] and represent it as file or data.
      Note that the data is preferred. The obj[%file_key_name] will be used iff
      obj['%data_key_name'] is not set or empty. Assumption is file content is
-     raw data and data field is base64 string."""
+     raw data and data field is base64 string. The assumption can be changed
+     with base64_file_content flag. If set to False, the content of the file
+     will assumed to be base64 and read as is. The default True value will
+     result in base64 encode of the file content after read."""
 
     def __init__(self, obj, file_key_name, data_key_name=None,
-                 file_base_path=""):
+                 file_base_path="", base64_file_content=True):
         if not data_key_name:
             data_key_name = file_key_name + "-data"
         self._file = None
         self._data = None
+        self._base64_file_content = base64_file_content
         if data_key_name in obj:
             self._data = obj[data_key_name]
         elif file_key_name in obj:
@@ -78,8 +82,11 @@ class FileOrData(object):
         decoded obj[%data_key_name] content otherwise obj[%file_key_name]."""
         use_data_if_no_file = not self._file and self._data
         if use_data_if_no_file:
-            self._file = _create_temp_file_with_content(
-                base64.decodestring(self._data.encode()))
+            if self._base64_file_content:
+                self._file = _create_temp_file_with_content(
+                    base64.decodestring(self._data.encode()))
+            else:
+                self._file = _create_temp_file_with_content(self._data)
         if self._file and not os.path.isfile(self._file):
             raise ConfigException("File does not exists: %s" % self._file)
         return self._file
@@ -90,8 +97,11 @@ class FileOrData(object):
         use_file_if_no_data = not self._data and self._file
         if use_file_if_no_data:
             with open(self._file) as f:
-                self._data = bytes.decode(
-                    base64.encodestring(str.encode(f.read())))
+                if self._base64_file_content:
+                    self._data = bytes.decode(
+                        base64.encodestring(str.encode(f.read())))
+                else:
+                    self._data = f.read()
         return self._data
 
 
@@ -164,7 +174,8 @@ class KubeConfigLoader(object):
     def _load_user_token(self):
         token = FileOrData(
             self._user, 'tokenFile', 'token',
-            file_base_path=self._config_base_path).as_data()
+            file_base_path=self._config_base_path,
+            base64_file_content=False).as_data()
         if token:
             self.token = "Bearer %s" % token
             return True


Test patch:
diff --git a/kubernetes/config/kube_config_test.py b/kubernetes/config/kube_config_test.py
index 649648641..6784b75b6 100644
--- a/kubernetes/config/kube_config_test.py
+++ b/kubernetes/config/kube_config_test.py
@@ -108,6 +108,12 @@ class TestFileOrData(BaseTestCase):
                        data_key_name=TEST_DATA_KEY)
         self.assertEqual(TEST_DATA, self.get_file_content(t.as_file()))
 
+    def test_file_given_data_no_base64(self):
+        obj = {TEST_DATA_KEY: TEST_DATA}
+        t = FileOrData(obj=obj, file_key_name=TEST_FILE_KEY,
+                       data_key_name=TEST_DATA_KEY, base64_file_content=False)
+        self.assertEqual(TEST_DATA, self.get_file_content(t.as_file()))
+
     def test_data_given_data(self):
         obj = {TEST_DATA_KEY: TEST_DATA_BASE64}
         t = FileOrData(obj=obj, file_key_name=TEST_FILE_KEY,
@@ -120,6 +126,13 @@ class TestFileOrData(BaseTestCase):
         t = FileOrData(obj=obj, file_key_name=TEST_FILE_KEY)
         self.assertEqual(TEST_DATA_BASE64, t.as_data())
 
+    def test_data_given_file_no_base64(self):
+        obj = {
+            TEST_FILE_KEY: self._create_temp_file(content=TEST_DATA)}
+        t = FileOrData(obj=obj, file_key_name=TEST_FILE_KEY,
+                       base64_file_content=False)
+        self.assertEqual(TEST_DATA, t.as_data())
+
     def test_data_given_file_and_data(self):
         obj = {
             TEST_DATA_KEY: TEST_DATA_BASE64,
@@ -562,7 +575,7 @@ class TestKubeConfigLoader(BaseTestCase):
             with open(os.path.join(temp_dir, "client_key"), "wb") as fd:
                 fd.write(TEST_CLIENT_KEY.encode())
             with open(os.path.join(temp_dir, "token_file"), "wb") as fd:
-                fd.write(TEST_DATA.encode())
+                fd.write(TEST_DATA_BASE64.encode())
             KubeConfigLoader(
                 config_dict=self.TEST_KUBE_CONFIG,
                 active_context="ssl-local-file",