Issue Summary

In Kubernetes 1.21, the BoundServiceAccountVolume  was enabled by default. This introduced time-bound service account tokens (replacing the legacy behavior where tokens never expired).

Confluence DC nutcluster kubernetes client does not re-read tokens once they are refreshed.

Steps to Reproduce

1. Setup Confluence DC on Kubernetes 1.21 or above
2. Deploy Confluence Data Center 10.2.x on Amazon EKS using the default Helm chart configuration (which uses projected service-account tokens).
3. Wait for the service token to be expired and refreshed by the kubelet

Expected Results

Confluence nutcluster kubernetes client automatically reads this new token file.

Actual Results

Confluence nutcluster kubernetes client stops authenticating to the Kubernetes API once the token is refreshed. From then on, the oldest cluster member logs the error below until the pod is restarted:

ERROR [...] [atlassian.nutcluster.kubernetes.KubernetesClient] Kubernetes API authorization failure, please check your 'api-token' property

Workaround

a long-lived ServiceAccount token in HAZELCAST_KUBERNETES_API_TOKEN plus ATL_ALLOWLIST_SENSITIVE_ENV_VARS=HAZELCAST_KUBERNETES_API_TOKEN, on every clustered container. Without the allowlist, the image removes the variable at startup.