Ansible Kubernetes模块找不到kube config但kubectl可用的原因与解决方法

问题描述 #

我有一台运行k3s的服务器，尝试用Ansible部署组件，编写了以下任务：

- name: Create lb
  kubernetes.core.k8s:
    state: present
    src: /opt/metallb/metallb-native.yaml

但任务执行失败，报错：

Could not create API client: Invalid kube-config file. No configuration found.

已确认~/.kube/config存在配置文件，且执行以下Ansible shell任务能正常运行：

- name: test kubectl 
  ansible.builtin.shell:
    cmd: kubectl get nodes 

添加-vvv参数后的错误日志如下：

The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_kubernetes.core.k8s_payload_tu6hy1j6/ansible_kubernetes.core.k8s_payload.zip/ansible_collections/kubernetes/core/plugins/module_utils/k8s/client.py", line 153, in _create_configuration
    kubernetes.config.load_incluster_config()
  File "/usr/local/lib/python3.10/dist-packages/kubernetes/config/incluster_config.py", line 121, in load_incluster_config
    try_refresh_token=try_refresh_token).load_and_set(client_configuration)
  File "/usr/local/lib/python3.10/dist-packages/kubernetes/config/incluster_config.py", line 54, in load_and_set
    self._load_config()
  File "/usr/local/lib/python3.10/dist-packages/kubernetes/config/incluster_config.py", line 62, in _load_config
    raise ConfigException("Service host/port is not set.")
kubernetes.config.config_exception.ConfigException: Service host/port is not set.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/ansible_kubernetes.core.k8s_payload_tu6hy1j6/ansible_kubernetes.core.k8s_payload.zip/ansible_collections/kubernetes/core/plugins/module_utils/k8s/client.py", line 351, in get_api_client
    configuration = _create_configuration(auth_spec)
  File "/tmp/ansible_kubernetes.core.k8s_payload_tu6hy1j6/ansible_kubernetes.core.k8s_payload.zip/ansible_collections/kubernetes/core/plugins/module_utils/k8s/client.py", line 158, in _create_configuration
    raise err
  File "/tmp/ansible_kubernetes.core.k8s_payload_tu6hy1j6/ansible_kubernetes.core.k8s_payload.zip/ansible_collections/kubernetes/core/plugins/module_utils/k8s/client.py", line 156, in _create_configuration
    _load_config(auth)
  File "/tmp/ansible_kubernetes.core.k8s_payload_tu6hy1j6/ansible_kubernetes.core.k8s_payload.zip/ansible_collections/kubernetes/core/plugins/module_utils/k8s/client.py", line 126, in _load_config
    kubernetes.config.load_kube_config(config_file=None, **optional_arg)
  File "/usr/local/lib/python3.10/dist-packages/kubernetes/config/kube_config.py", line 815, in load_kube_config
    loader = _get_kube_config_loader(
  File "/usr/local/lib/python3.10/dist-packages/kubernetes/config/kube_config.py", line 772, in _get_kube_config_loader
    raise ConfigException(
kubernetes.config.config_exception.ConfigException: Invalid kube-config file. No configuration found.

原因分析 #

kubectl命令行工具会自动读取当前执行用户的~/.kube/config配置文件，但Ansible的kubernetes.core.k8s模块基于Python的kubernetes客户端库，其配置加载逻辑存在差异：

• 模块会优先尝试加载集群内配置（incluster config），适配Pod内运行Ansible的场景，失败后才会尝试读取kubeconfig文件
• 读取kubeconfig时，Python库可能因执行用户上下文不同（比如Ansible用root执行，测试kubectl用普通用户）、环境变量未传递（比如KUBECONFIG变量未给到模块），导致找不到正确的配置文件路径

解决方法 #

方法1：显式指定kubeconfig路径 #

在k8s模块中通过kubeconfig参数直接指定配置文件的绝对路径，确保模块准确定位：

- name: Create lb
  kubernetes.core.k8s:
    state: present
    src: /opt/metallb/metallb-native.yaml
    kubeconfig: "/root/.kube/config"  # 根据实际执行用户调整，比如普通用户用/home/user/.kube/config

方法2：传递KUBECONFIG环境变量 #

通过Ansible的environment参数设置KUBECONFIG环境变量，让Python客户端库识别配置位置：

- name: Create lb
  kubernetes.core.k8s:
    state: present
    src: /opt/metallb/metallb-native.yaml
  environment:
    KUBECONFIG: "{{ ansible_env.HOME }}/.kube/config"

方法3：确保执行用户一致 #

检查Ansible执行任务的用户（比如通过remote_user指定）和测试kubectl的用户是否相同，若不同，将~/.kube/config复制到Ansible执行用户的~/.kube/目录，并设置正确权限：

- name: Copy kubeconfig to ansible user home
  ansible.builtin.copy:
    src: "/home/testuser/.kube/config"  # 测试kubectl的用户路径
    dest: "/root/.kube/config"  # Ansible执行用户的路径
    remote_src: yes
    mode: '0600'

方法4：修复配置文件权限 #

确保kubeconfig文件权限为0600（仅所有者可读可写），避免因权限过宽被Python客户端库拒绝加载：

- name: Fix kubeconfig permissions
  ansible.builtin.file:
    path: "~/.kube/config"
    mode: '0600'

内容的提问来源于stack exchange，提问作者iaquobe