# Buggy code
def _setup_conn(**kwargs):
    """
    Setup kubernetes API connection singleton
    """
    host = __salt__["config.option"]("kubernetes.api_url", "http://localhost:8080")
    username = __salt__["config.option"]("kubernetes.user")
    password = __salt__["config.option"]("kubernetes.password")
    ca_cert = __salt__["config.option"]("kubernetes.certificate-authority-data")
    client_cert = __salt__["config.option"]("kubernetes.client-certificate-data")
    client_key = __salt__["config.option"]("kubernetes.client-key-data")
    ca_cert_file = __salt__["config.option"]("kubernetes.certificate-authority-file")
    client_cert_file = __salt__["config.option"]("kubernetes.client-certificate-file")
    client_key_file = __salt__["config.option"]("kubernetes.client-key-file")

    # Override default API settings when settings are provided
    if "api_url" in kwargs:
        host = kwargs.get("api_url")

    if "api_user" in kwargs:
        username = kwargs.get("api_user")

    if "api_password" in kwargs:
        password = kwargs.get("api_password")

    if "api_certificate_authority_file" in kwargs:
        ca_cert_file = kwargs.get("api_certificate_authority_file")

    if "api_client_certificate_file" in kwargs:
        client_cert_file = kwargs.get("api_client_certificate_file")

    if "api_client_key_file" in kwargs:
        client_key_file = kwargs.get("api_client_key_file")

    if (
        kubernetes.client.configuration.host != host
        or kubernetes.client.configuration.user != username
        or kubernetes.client.configuration.password != password
    ):
        # Recreates API connection if settings are changed
        kubernetes.client.configuration.__init__()

    kubernetes.client.configuration.host = host
    kubernetes.client.configuration.user = username
    kubernetes.client.configuration.passwd = password

    if ca_cert_file:
        kubernetes.client.configuration.ssl_ca_cert = ca_cert_file
    elif ca_cert:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as ca:
            ca.write(base64.b64decode(ca_cert))
            kubernetes.client.configuration.ssl_ca_cert = ca.name
    else:
        kubernetes.client.configuration.ssl_ca_cert = None

    if client_cert_file:
        kubernetes.client.configuration.cert_file = client_cert_file
    elif client_cert:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as c:
            c.write(base64.b64decode(client_cert))
            kubernetes.client.configuration.cert_file = c.name
    else:
        kubernetes.client.configuration.cert_file = None

    if client_key_file:
        kubernetes.client.configuration.key_file = client_key_file
    if client_key:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as k:
            k.write(base64.b64decode(client_key))
            kubernetes.client.configuration.key_file = k.name
    else:
        kubernetes.client.configuration.key_file = None


# Traceback (MaxRetryError)
(ve) [root@omniscience salt]# salt-call kubernetes.nodes
[WARNING ] /home/jeff/git/salt/salt/utils/__init__.py:794: DeprecationWarning: Use of 'salt.utils.fopen' detected. This function has been moved to 'salt.utils.files.fopen' as of Salt Oxygen. This warning will be removed in Salt Neon.

2017-10-21 19:35:22,944 WARNING Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
2017-10-21 19:35:22,944 WARNING Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
[WARNING ] Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
2017-10-21 19:35:22,945 WARNING Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
2017-10-21 19:35:22,945 WARNING Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
[WARNING ] Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
2017-10-21 19:35:22,946 WARNING Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
2017-10-21 19:35:22,946 WARNING Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
[WARNING ] Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),)': /api/v1/nodes
[ERROR   ] Exception when calling CoreV1Api->list_node: HTTPSConnectionPool(host='192.168.99.100', port=8443): Max retries exceeded with url: /api/v1/nodes (Caused by SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),))
Traceback (most recent call last):
File "/home/jeff/git/salt/salt/modules/kubernetes.py", line 216, in nodes
api_response = api_instance.list_node()
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 13990, in list_node
(data) = self.list_node_with_http_info(**kwargs)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 14086, in list_node_with_http_info
collection_formats=collection_formats)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 335, in call_api
_preload_content, _request_timeout)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 148, in __call_api
_request_timeout=_request_timeout)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 371, in request
headers=headers)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/rest.py", line 250, in GET
query_params=query_params)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/kubernetes/client/rest.py", line 223, in request
headers=headers)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/request.py", line 66, in request
**urlopen_kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/request.py", line 87, in request_encode_url
return self.urlopen(method, url, **extra_kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/poolmanager.py", line 321, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/connectionpool.py", line 668, in urlopen
**response_kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/connectionpool.py", line 668, in urlopen
**response_kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/connectionpool.py", line 668, in urlopen
**response_kw)
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/connectionpool.py", line 639, in urlopen
_stacktrace=sys.exc_info()[2])
File "/home/jeff/git/salt/ve/lib/python2.7/site-packages/urllib3/util/retry.py", line 388, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
MaxRetryError: HTTPSConnectionPool(host='192.168.99.100', port=8443): Max retries exceeded with url: /api/v1/nodes (Caused by SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),))
Error running 'kubernetes.nodes': HTTPSConnectionPool(host='192.168.99.100', port=8443): Max retries exceeded with url: /api/v1/nodes (Caused by SSLError(SSLError(336265225, u'[SSL] PEM lib (_ssl.c:2718)'),))

# Fixed code
def _setup_conn(**kwargs):
    """
    Setup kubernetes API connection singleton
    """
    host = __salt__["config.option"]("kubernetes.api_url", "http://localhost:8080")
    username = __salt__["config.option"]("kubernetes.user")
    password = __salt__["config.option"]("kubernetes.password")
    ca_cert = __salt__["config.option"]("kubernetes.certificate-authority-data")
    client_cert = __salt__["config.option"]("kubernetes.client-certificate-data")
    client_key = __salt__["config.option"]("kubernetes.client-key-data")
    ca_cert_file = __salt__["config.option"]("kubernetes.certificate-authority-file")
    client_cert_file = __salt__["config.option"]("kubernetes.client-certificate-file")
    client_key_file = __salt__["config.option"]("kubernetes.client-key-file")

    # Override default API settings when settings are provided
    if "api_url" in kwargs:
        host = kwargs.get("api_url")

    if "api_user" in kwargs:
        username = kwargs.get("api_user")

    if "api_password" in kwargs:
        password = kwargs.get("api_password")

    if "api_certificate_authority_file" in kwargs:
        ca_cert_file = kwargs.get("api_certificate_authority_file")

    if "api_client_certificate_file" in kwargs:
        client_cert_file = kwargs.get("api_client_certificate_file")

    if "api_client_key_file" in kwargs:
        client_key_file = kwargs.get("api_client_key_file")

    if (
        kubernetes.client.configuration.host != host
        or kubernetes.client.configuration.user != username
        or kubernetes.client.configuration.password != password
    ):
        # Recreates API connection if settings are changed
        kubernetes.client.configuration.__init__()

    kubernetes.client.configuration.host = host
    kubernetes.client.configuration.user = username
    kubernetes.client.configuration.passwd = password

    if ca_cert_file:
        kubernetes.client.configuration.ssl_ca_cert = ca_cert_file
    elif ca_cert:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as ca:
            ca.write(base64.b64decode(ca_cert))
            kubernetes.client.configuration.ssl_ca_cert = ca.name
    else:
        kubernetes.client.configuration.ssl_ca_cert = None

    if client_cert_file:
        kubernetes.client.configuration.cert_file = client_cert_file
    elif client_cert:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as c:
            c.write(base64.b64decode(client_cert))
            kubernetes.client.configuration.cert_file = c.name
    else:
        kubernetes.client.configuration.cert_file = None

    if client_key_file:
        kubernetes.client.configuration.key_file = client_key_file
    elif client_key:
        with tempfile.NamedTemporaryFile(prefix="salt-kube-", delete=False) as k:
            k.write(base64.b64decode(client_key))
            kubernetes.client.configuration.key_file = k.name
    else:
        kubernetes.client.configuration.key_file = None

    # The return makes unit testing easier
    return vars(kubernetes.client.configuration)