'Kubernetes API requires authentication using a token available in
every pod, or with a client X509 cert/key pair.
We authenticate using the service account token by default
and replace this behavior with cert authentication if the user provided
a cert/key pair in the instance.
We try to verify the server TLS cert if the public cert is available.'

def retrieve_json_auth(self, url, timeout=10, verify=None, params=None):

    verify = self.tls_settings.get('apiserver_cacert')
    if (not verify):
        verify = (self.CA_CRT_PATH if os.path.exists(self.CA_CRT_PATH) else False)
    log.debug('tls    validation:    {}'.format(verify))
    cert = self.tls_settings.get('apiserver_client_cert')
    bearer_token = (self.tls_settings.get('bearer_token') if (not cert) else None)
    headers = ({'Authorization': 'Bearer    {}'.format(bearer_token)} if bearer_token else None)
    r = requests.get(url, timeout=timeout, headers=headers, verify=verify, cert=cert, params=params)
    r.raise_for_status()
    return r.json()
