Fix python kubernetes login for >= v36.0.1

[markafarrell]

closes #1307

[markafarrell]

@nolar I'm not sure if this is required anymore post kubernetes-client/python#2604

I'm happy to close if you are happy with only supporting <=36.0.0 >=36.0.2

[markafarrell]

@nolar I'm not sure if this is required anymore post kubernetes-client/python#2604

I'm happy to close if you are happy with only supporting <=36.0.0 >=36.0.2

This is incorrect. 36.0.2 does not fix the issue

[faust64]

Indeed, 36.0.2 fixes kubernetes-client/python#2595
Still the switch to BearerToken remains necessary

Trying out 36.0.2 with some kopf based operator today, doesn't pick up on authentication:

[2026-06-02 17:35:14,357] kopf._core.reactor.o [ERROR   ] Request attempt #7/9 failed; will retry: GET https://10.96.0.1:443/api -> APIForbiddenError('forbidden: User "system:anonymous" cannot get path "/api"', {'kind': 'Status', 'apiVersion': 'v1', 'metadata': {}, 'status': 'Failure', 'message': 'forbidden: User "system:anonymous" cannot get path "/api"', 'reason': 'Forbidden', 'details': {}, 'code': 403}, status=403)
[2026-06-02 17:35:14,357] kopf._core.reactor.o [ERROR   ] Request attempt #7/9 failed; will retry: GET https://10.96.0.1:443/apis -> APIForbiddenError('forbidden: User "system:anonymous" cannot get path "/apis"', {'kind': 'Status', 'apiVersion': 'v1', 'metadata': {}, 'status': 'Failure', 'message': 'forbidden: User "system:anonymous" cannot get path "/apis"', 'reason': 'Forbidden', 'details': {}, 'code': 403}, status=403)

[nolar]

Looks good to me, thanks for fixing it fast. I have also removed an unused import line left from the initial commit.

Please sign-off your existing commits as documented in https://docs.kopf.dev/en/stable/contributing/#dco-sign-off — if appropriate, squash them (it is for you to decide). I am going to tighten the rules on external contributions soon in order to avoid all the legal mess that AI contributions create — until resolved somehow some day (now researching). But DCO was in place since a long time ago anyway — a weaker and easier equivalent of CLAs.

I will take a look on the mypy & pytest failures with kubernetes_asyncio tomorrow (I have some time tomorrow). I thought I have fixed that issue some time ago, not sure what has broken again.

[markafarrell]

Looks good to me, thanks for fixing it fast. I have also removed an unused import line left from the initial commit.

Please sign-off your existing commits as documented in https://docs.kopf.dev/en/stable/contributing/#dco-sign-off — if appropriate, squash them (it is for you to decide). I am going to tighten the rules on external contributions soon in order to avoid all the legal mess that AI contributions create — until resolved somehow some day (now researching). But DCO was in place since a long time ago anyway — a weaker and easier equivalent of CLAs.

I will take a look on the mypy & pytest failures with kubernetes_asyncio tomorrow (I have some time tomorrow). I thought I have fixed that issue some time ago, not sure what has broken again.

@nolar Squashed to a single commit and signed off

[nolar]

1. The mypy + pytest failure on kubernetes_asyncio is fixed by re-running it today. I do not know what was that, but previous re-runs did not help. The errors suggest weird things as if kubernetes_asyncio was corrupted or empty. But it is no more corrupt or broken, everything works. This is only relevant for tests with kubernetes_asyncio installed — it is NOT a runtime dependency normally.

2. Another test failure with fresh PyPy 3.11.15 fixed in Fix a test failure specifically in PyPy 3.11.15+ #1310 and merged back into this PR/branch.

[nolar]

Released as 1.44.6

Thanks again for the contribution.