Issue Summary

In Kubernetes 1.21, the BoundServiceAccountVolume  was enabled by default. This introduced time-bound service account tokens (replacing the legacy behavior where tokens never expired).

Bitbucket DC nutcluster kubernetes client does not re-read tokens once they are refreshed.

Steps to Reproduce

1. Setup Bitbucket DC on Kubernetes 1.21 or above
2. Wait for the service token to be expired and refreshed by the kubelet

Expected Results

• Bitbucket nutcluster kubernetes client automatically reads this new token file.

Actual Results

• Bitbucket nutcluster kubernetes client stops authenticating to the Kubernetes API once the token is refreshed. From then on, the oldest cluster member logs the error below until the pod is restarted:

  ERROR [...] [atlassian.nutcluster.kubernetes.KubernetesClient] Kubernetes API authorization failure, please check your 'api-token' property
  

Workaround

A long-lived ServiceAccount token in HAZELCAST_KUBERNETES_API_TOKEN plus ATL_ALLOWLIST_SENSITIVE_ENV_VARS=HAZELCAST_KUBERNETES_API_TOKEN, on every clustered container. Without the allowlist, the image removes the variable at startup.