fix(python): exclude Kubernetes client 36.0.0

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kubernetes: ["28.1.0", "36.0.0"]
+        kubernetes: ["28.1.0", "36.0.1", "36.0.2", "36.0.3"]
 
     steps:
       - name: Checkout code
@@ -271,28 +271,33 @@ jobs:
             exit 1
           fi
 
-      - name: Test RBAC Permissions
+      - name: Test In-Cluster Authentication
         run: |
-          echo "Test 5: Verify RBAC permissions"
+          echo "Test 5: Verify in-cluster authentication with a fixed kubernetes 36.x client"
           POD_NAME=$(kubectl get pod -n deviceshifu -l app=deviceshifu-example-device -o jsonpath='{.items[0].metadata.name}')
 
-          # Test GET permission
+          # Load the mounted service-account token and perform a real authenticated API call.
           kubectl exec -n deviceshifu $POD_NAME -- python3 -c "
+          from importlib.metadata import version
           from kubernetes import client, config
+          installed_version = version('kubernetes')
+          release = tuple(int(part) for part in installed_version.split('.')[:3])
+          if not (release >= (36, 0, 1) and release < (37, 0, 0)):
+              raise RuntimeError(f'Expected a fixed kubernetes 36.x release, got {installed_version}')
           config.load_incluster_config()
           api = client.CustomObjectsApi()
           try:
               api.get_namespaced_custom_object('shifu.edgenesis.io', 'v1alpha1', 'devices', 'edgedevices', 'example-device')
-              print('GET: OK')
+              print(f'Authenticated GET: OK (kubernetes {installed_version})')
           except Exception as e:
-              print(f'GET: FAILED - {e}')
-              exit(1)
+              print(f'Authenticated GET: FAILED - {e}')
+              raise
           " || {
-            echo "❌ GET permission check failed"
+            echo "❌ In-cluster authentication check failed"
             exit 1
           }
 
-          echo "✅ RBAC permissions verified"
+          echo "✅ In-cluster authentication verified"
 
       - name: Test Dynamic Updates
         run: |

shifu-sdk-python/README.md

@@ -15,7 +15,7 @@ Minimal, installable Python SDK that provides both **global functions** and **De
 ### Prerequisites
 - Python 3.8+
 - Kubernetes cluster access (or local kubeconfig)
-- `kubernetes>=28.1.0,<37` package
+- `kubernetes>=28.1.0,<37,!=36.0.0` package
 - **Shifu Control Plane**: Install the official [Shifu IoT Gateway](https://github.com/Edgenesis/shifu) in your cluster
   ```bash
   kubectl apply -f https://raw.githubusercontent.com/Edgenesis/shifu/main/pkg/k8s/crd/install/shifu_install.yml
@@ -143,10 +143,12 @@ Use DeviceShifu class for managing multiple devices with isolated instances.
 
 ### Kubernetes Python Client Compatibility
 
-The SDK supports Kubernetes Python client versions 28.1.0 through 36.x. It
-automatically uses `response_type` with clients before v36 and
-`response_types_map` with v36. The dependency is capped below v37 so a future
-breaking client release cannot be installed silently before it is tested.
+The SDK supports Kubernetes Python client versions 28.1.0 through 36.x, except
+for 36.0.0. That release has a broken in-cluster authentication implementation;
+use 36.0.1 or newer when installing a 36.x client. The SDK automatically uses
+`response_type` with clients before v36 and `response_types_map` with v36. The
+dependency is capped below v37 so a future breaking client release cannot be
+installed silently before it is tested.
 
 ### Environment Variables
 | Variable | Required | Default | Description |

shifu-sdk-python/pyproject.toml

@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.8"
 authors = [{name = "Your Name", email = "you@example.com"}]
 license = {text = "MIT"}
-dependencies = ["kubernetes>=28.1.0,<37"]
+dependencies = ["kubernetes>=28.1.0,<37,!=36.0.0"]
 classifiers = [
   "Programming Language :: Python :: 3",
   "License :: OSI Approved :: MIT License",

shifu-sdk-python/tests/test_kubernetes_client_compat.py

@@ -121,11 +121,11 @@ def test_put_uses_response_argument_supported_by_installed_client(self):
                 self.assertEqual(api_client.calls[0]["body"], edge_device)
                 self.assertEqual(api_client.calls[0][expected_key], expected_value)
 
-    def test_dependency_range_covers_only_tested_client_majors(self):
+    def test_dependency_range_excludes_broken_client_release(self):
         pyproject = Path(__file__).parents[1] / "pyproject.toml"
 
         self.assertIn(
-            'dependencies = ["kubernetes>=28.1.0,<37"]',
+            'dependencies = ["kubernetes>=28.1.0,<37,!=36.0.0"]',
             pyproject.read_text(encoding="utf-8"),
         )