Running 'az acs kubernetes install-cli' from env giving error

saurabsa commented 7 years ago

When running from the developer environment, its throwing error: Connection error while attempting to download client (<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)>)

The same command works fine when executed outside of the dev env.

saurabsa commented 7 years ago

@brendandburns @colemickens Any updates? Something which can unblock me.

saurabsa commented 7 years ago

Here is the debug log:

(env) mbp$ az acs kubernetes install-cli --debug Command arguments ['acs', 'kubernetes', 'install-cli'] Registered application event handler 'CommandParser.Parsed' at <function _handle_container_ssh_file at 0x104440e18> Current active cloud 'AzureCloud' {'active_directory': 'https://login.microsoftonline.com', 'active_directory_graph_resource_id': 'https://graph.windows.net/', 'active_directory_resource_id': 'https://management.core.windows.net/', 'batch_resource_id': 'https://batch.core.windows.net/', 'gallery': 'https://gallery.azure.com/', 'management': 'https://management.core.windows.net/', 'resource_manager': 'https://management.azure.com/', 'sql_management': 'https://management.core.windows.net:8443/'} {'azure_datalake_analytics_catalog_and_job_endpoint': 'azuredatalakeanalytics.net', 'azure_datalake_store_file_system_endpoint': 'azuredatalakestore.net', 'keyvault_dns': '.vault.azure.net', 'sql_server_hostname': '.database.windows.net', 'storage_endpoint': 'core.windows.net'} Successfully loaded command table from module 'acs'. Application event 'CommandTable.Loaded' with event data {'command_table': OrderedDict([('acs show', <azure.cli.core.commands.CliCommand object at 0x1035c8080>), ('acs delete', <azure.cli.core.commands.CliCommand object at 0x103665710>), ('acs scale', <azure.cli.core.commands.CliCommand object at 0x103665668>), ('acs list', <azure.cli.core.commands.CliCommand object at 0x103665748>), ('acs browse', <azure.cli.core.commands.CliCommand object at 0x103665828>), ('acs install-cli', <azure.cli.core.commands.CliCommand object at 0x1036658d0>), ('acs d [...] Application event 'CommandParser.Loaded' with event data {'parser': AzCliCommandParser(prog='az', usage=None, description=None, formatter_class=<class 'argparse.HelpFormatter'>, conflict_handler='error', add_help=True)} Registered application event handler 'CommandTableParams.Loaded' at <function add_id_parameters at 0x104874c80> Registered application event handler 'CommandTable.Loaded' at <function add_id_parameters at 0x104874c80> Application event 'CommandTableParams.Loaded' with event data {'command_table': OrderedDict([('acs show', <azure.cli.core.commands.CliCommand object at 0x1035c8080>), ('acs delete', <azure.cli.core.commands.CliCommand object at 0x103665710>), ('acs scale', <azure.cli.core.commands.CliCommand object at 0x103665668>), ('acs list', <azure.cli.core.commands.CliCommand object at 0x103665748>), ('acs browse', <azure.cli.core.commands.CliCommand object at 0x103665828>), ('acs install-cli', <azure.cli.core.commands.CliCommand object at 0x1036658d0>), ('acs d [...] Application event 'CommandParser.Parsed' with event data {'command': 'acs kubernetes install-cli', 'args': Namespace(_command_package='acs', _jmespath_query=None, _log_verbosity_debug=False, _log_verbosity_verbose=False, _output_format='json', _parser=AzCliCommandParser(prog='az acs kubernetes install-cli', usage=None, description='Downloads the kubectl command line from Kubernetes', formatter_class=<class 'argparse.HelpFormatter'>, conflict_handler='error', add_help=True), _validators=[], client_version='1.4.5', command='acs kubernetes install- [...] Downloading client to /usr/local/bin/kubectl Connection error while attempting to download client (<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)>)

colemickens commented 7 years ago

The same command works fine when executed outside of the dev env.

What does this mean? Do you mean the acs-engine devenv? It already has kubectl available.

Otherwise, I've not seen this before. Are you running this from a container or on a normal Linux distro or something else? Does SSL work normally elsewhere? Are you running mitmproxy/fiddler etc?

saurabsa commented 7 years ago

I am running this command on my normal OSX machine. The same command works fine when I run it from outside the az cli devenv but throws me the above error when run from inside the devenv. devenv is the one which we get from . /env/bin/activate

SSL works fine as the command works fine normally. Something is different in the devenv. Might I be missing something?

colemickens commented 7 years ago

I assume ./env/bin/activate is just virtualenv. Not really sure I understand why that would affect SSL validation. All we do is make an HTTP request with urlretrieve from urllib/urllib.request.

@derekbekoe do you know why being in the dev virtualenv would affect SSL validation?

saurabsa commented 7 years ago

Yes I agree. That's what the confusion is. Infact, this can be repro'd on another machine.

derekbekoe commented 7 years ago

@saurabsa What are the repro steps? I can create a VM and test.

saurabsa commented 7 years ago

@derekbekoe Just get in the devenv using . /env/bin/activate and run the command: az acs kubernetes install-cli

derekbekoe commented 7 years ago

What OS, Python version? Also, what's the output of pip freeze?

derekbekoe commented 7 years ago

I tried and couldn't reproduce.

saurabsa commented 7 years ago

osX = macOS Sierra version 10.12.3

python = Python 3.6.0

saurabsa commented 7 years ago

I and @derekbekoe investigated the issue. The issue seems to be because of Python3.6. It can be repro'd if we set the devenv using Python3.6. Python3.5 seems to work fine. Repro steps:

_git clone https://github.com/Azure/azure-cli cd azure-cli python3.6 -m venv env . env/bin/activate python scripts/devsetup.py . az.completion.sh

Run command: az acs kubernetes install-cli Connection error while attempting to download client (<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)>)

This could be repro'd by @derekbekoe as well.

For now, we can switch to 3.5 and it would unblock us. But 3.6 should also be supported I guess. Thanks @derekbekoe for the help.

djarvis commented 7 years ago

I am getting this error with python 3.5.1 on my Windows 10 machine.

brendandburns commented 7 years ago

@saurabsa

I believe this is the explanation: http://stackoverflow.com/a/42334357/4364364

Basically Python 3.6 on OS X doesn't install any certs by default.

brendandburns commented 7 years ago

@djarvis pip install certifi

may help with this as well, see:

https://bugs.python.org/issue28150

brendandburns commented 7 years ago

I'm going to close this, since it is not a cli issue, afaik.

marcelloromani commented 6 years ago

For future reference, the linked python bug contains a command which fixed the issue for me (on Mac OS X 10.12.6): /Applications/Python\ 3.6/Install\ Certificates.command

anujb commented 6 years ago

TLDR; Quick fix:

Execute the following command to resolve the issue:

/Applications/Python\ 3.6/Install\ Certificates.command

Background:

Python 3.6 has an explicit post-installation step to install certificates since they are not installed at the point of installation. The command above will install the certifi package and resolve any CERTIFICATE_VERIFY_FAILED issue.

Currently on macOS 10.12.16 + Python 3.6.

-Anuj

Sudharma commented 5 years ago

If I Install certificates as mentined

TLDR; Quick fix:

Execute the following command to resolve the issue:

/Applications/Python\ 3.6/Install\ Certificates.command

Background:

Python 3.6 has an explicit post-installation step to install certificates since they are not installed at the point of installation. The command above will install the certifi package and resolve any CERTIFICATE_VERIFY_FAILED issue.

Currently on macOS 10.12.16 + Python 3.6.

-Anuj

If I install certificates like above. I get an error like this. This is with Python 3.7.1

azure-mgmt-recoveryservicesbackup 0.1.1 has requirement msrestazure~=0.4.11, but you'll have msrestazure 0.5.0 which is incompatible. azure-mgmt-recoveryservices 0.1.0 has requirement msrestazure~=0.4.11, but you'll have msrestazure 0.5.0 which is incompatible. azure-mgmt-datalake-analytics 0.2.0 has requirement msrestazure~=0.4.7, but you'll have msrestazure 0.5.0 which is incompatible.

Azure / azure-cli

Running 'az acs kubernetes install-cli' from env giving error #2581