Kubernetes time-bound service account tokens not handled by Bitbucket DC

XMLWordPrintable

    • 2
    • Severity 3 - Minor
    • 1

      Issue Summary

      In Kubernetes 1.21, the BoundServiceAccountVolume  was enabled by default. This introduced time-bound service account tokens (replacing the legacy behavior where tokens never expired).

      Bitbucket DC nutcluster kubernetes client does not re-read tokens once they are refreshed.

      Steps to Reproduce

      1. Setup Bitbucket DC on Kubernetes 1.21 or above
      2. Wait for the service token to be expired and refreshed by the kubelet

      Expected Results

      • Bitbucket nutcluster kubernetes client automatically reads this new token file.

      Actual Results

      • Bitbucket nutcluster kubernetes client stops authenticating to the Kubernetes API once the token is refreshed. From then on, the oldest cluster member logs the error below until the pod is restarted: 
        ERROR [...] [atlassian.nutcluster.kubernetes.KubernetesClient] Kubernetes API authorization failure, please check your 'api-token' property

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

              Assignee:
              Dyon Georgopoulos
              Reporter:
              Karthik Mahesh
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: