From b027171d3a2cc8d6f372f11de45578a9c3ee4607 Mon Sep 17 00:00:00 2001 From: ealeonraz Date: Sun, 19 Jul 2026 22:57:00 -0700 Subject: [PATCH] Fix PermissionError in OIDC token refresh on Windows _refresh_oidc wrote the IdP CA certificate by reopening a NamedTemporaryFile by name, which raises PermissionError on Windows while the original handle is still open. Reuse the module's existing _create_temp_file_with_content helper, which is mkstemp-based (Windows-safe) and cleans up via atexit instead of relying on GC timing. --- kubernetes/base/config/kube_config.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/kubernetes/base/config/kube_config.py b/kubernetes/base/config/kube_config.py index 13f4ba226c..c436e8d264 100644 --- a/kubernetes/base/config/kube_config.py +++ b/kubernetes/base/config/kube_config.py @@ -383,16 +383,14 @@ def _refresh_oidc(self, provider): config = Configuration() if 'idp-certificate-authority-data' in provider['config']: - ca_cert = tempfile.NamedTemporaryFile(delete=True) - cert = base64.b64decode( provider['config']['idp-certificate-authority-data'] ).decode('utf-8') - with open(ca_cert.name, 'w') as fh: - fh.write(cert) - - config.ssl_ca_cert = ca_cert.name + # Use the shared temp-file helper instead of reopening a + # NamedTemporaryFile by name, which fails with PermissionError + # on Windows while the original handle is still open. + config.ssl_ca_cert = _create_temp_file_with_content(cert) elif 'idp-certificate-authority' in provider['config']: config.ssl_ca_cert = provider['config']['idp-certificate-authority']