search

kubernetes / client-go

Go client for Kubernetes.
Apache License 2.0
9.13k stars 2.95k forks source link

token expire work with watch client? #1381

Closed FANHIDE closed 1 month ago

FANHIDE commented 1 month ago

We are using Go Kubernetes client . Recently we have some token expiration issue for some deployment running for more than 1 years.

Calico issue: https://github.com/projectcalico/calico/pull/5910 Java-client issue: https://github.com/fabric8io/kubernetes-client/pull/4264

This is because K8s had some change for service account token renew Since k8s 1.21, service account tokens have an lifespan of one hour (short-lived & rotation). The token expiration is 365 days actually.

I am wondering for GO client code with watch client? watch client will renew the token? or get 401 to renew the token?

liggitt commented 1 month ago

When a client-go client is constructed pointing at a token file (as the default in-cluster config does), it re-reads that token once a minute:

https://github.com/kubernetes/client-go/blob/23900f492969db045e8a36396852381fd189569b/transport/token_source.go#L67-L69

As long as the token on disk is refreshed at least a minute prior to expiration (which the kubelet automatically handles for tokens injected into pods), the client re-reads a refreshed token and starts using it for requests without being interrupted.

Requests are only authenticated when they are initialized, so if a single request lives longer than the token lifetime (like a watch request), the token expiration does not cause any issues.