Support a custom SSL CA bundle for KubernetesHook connections - #71831
Open
dheerenmohta wants to merge 1 commit into
Open
Support a custom SSL CA bundle for KubernetesHook connections#71831dheerenmohta wants to merge 1 commit into
dheerenmohta wants to merge 1 commit into
Conversation
KubernetesHook (which backs KubernetesPodOperator) could only fully disable TLS verification via the "Disable verify SSL" connection extra; there was no way to trust a cluster whose API server certificate is signed by a custom or intermediate CA. Users hitting this had to disable verification entirely just to let the operator list/create/watch its spawned pods, weakening security for something that only needed a CA bundle. KubernetesExecutor's own client already supports this via the kubernetes_executor.ssl_ca_cert config. Mirror the same capability into KubernetesHook as a new ssl_ca_cert connection extra / hook param, applied in _TimeoutK8sApiClient after config loading so it can't be silently overwritten, consistent with how disable_verify_ssl is already handled there. closes: apache#53192
dheerenmohta
requested review from
hussein-awala,
jedcunningham and
jscheffl
as code owners
August 19, 2026 10:15
boring-cyborg
Bot
added
area:providers
kind:documentation
provider:cncf-kubernetes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KubernetesHook only offered a binary disable_verify_ssl switch, with no way to trust a custom or intermediate CA without disabling verification entirely. KubernetesExecutor's kube_client.py already solves this via a kubernetes_executor.ssl_ca_cert config key, so this mirrors that same capability into KubernetesHook (used by KubernetesPodOperator via its hook property), rather than inventing a new mechanism.
Adds ssl_ca_cert as a KubernetesHook constructor param and matching Connection-extra field, threaded through every get_conn() branch into the existing _TimeoutK8sApiClient choke point. Also documents the new field in the connections docs.
Known gap: AsyncKubernetesHook (deferrable/trigger path) doesn't apply disable_verify_ssl either today, so it isn't covered here — a pre-existing asymmetry, left as follow-up scope rather than guessed at.
closes: #53192
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Sonnet 5) following the guidelines