client should periodically reload InClusterConfig token

[mikedanese]

See kubernetes/kubernetes#70679

[yue9944882]

what's the recommended period of reloading for client? or, is there any way to know the expiration time of the current token? considering leader-election client tolerates at most second-ish period of failure, a longer period like minute-ish won't be fine i suppose..

[mikedanese]

client-go re-reads the token every 1 minute:

https://github.com/kubernetes/kubernetes/blob/663796e62441d4f1f871838d567ccee847555cff/staging/src/k8s.io/client-go/transport/token_source.go#L53-L57

considering leader-election client tolerates at most second-ish period of failure, a longer period like minute-ish won't be fine i suppose..

Kubelet will refresh the token proactively before it expires. The minimum TTL for tokens is 10 minutes, and kubelet starts refreshing at 80% so you have about 2 minutes to reload with the lowest configurable token TTL.

[adohe-zz]

/cc @adohe

[yue9944882]

/assign

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[cizezsy]

Any progress in this? If no one is working on this issue, I think I can provide some help to implement it.

[yue9944882]

sure, let me know if you need any help

[cizezsy]

Hi, I am working on this and plan to add a new Authentication to ApiClient to support periodically token refreshing.

I have a question about this class. The comment in here says this file should not be modified, but I have seen many manually changes in the commit history. Can this class be changed manually? Thanks!

[yue9944882]

it was manually edited in the past, but by picking all the manual changes to the upstream generator, this ApiClient class honors the original code template now.. what's the point of modifying this?

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten