ssl.SSLError when connecting to 1.3 GKE cluster about pykube HOT 1 CLOSED

Ok, I've figured this out.

Digging into the error a bit more, the server is rejecting the TLS Client Hello, because TLS v1.0 is unsupported on GKE 1.3.

How do we select the TLS version? In general this can be easily overridden in Requests (see this guide). But Requests lets urllib3 choose the default TLS version, which is usually the best available; that in turn depends on the installed version of OpenSSL:

>>> import ssl
>>> ssl.PROTOCOL_TLSv1_2
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute 'PROTOCOL_TLSv1_2'
>>> ssl.OPENSSL_VERSION
'OpenSSL 0.9.8zh 14 Jan 2016'

Turns out on MacOS, the bundled OpenSSL version is antiquated. This also turns out to be much more of a pain to fix than expected; I'm using Python3.4, and Homebrew doesn't maintain pre-3.5 versions of Python3, so the following fix turned out to be the best for me:

http://stackoverflow.com/a/37757206/37481

For posterity, reproduced here, assuming a fully-configured pyenv install:

brew update
brew install openssl
brew link --force openssl

CFLAGS="-I$(brew --prefix openssl)/include" \
LDFLAGS="-L$(brew --prefix openssl)/lib" \
pyenv install -v 3.4.4

Sadly it doesn't appear to be sufficient to install a new openssl; a new Python must be installed and linked against the new OpenSSL.

from pykube.