/ 
Kubernetes-REST-1.107
⭐ Starred 2 / Kubernetes::REST::AuthTokenFile

NAME

Kubernetes::REST::AuthTokenFile - Bearer token read from a file, re-read when the file changes

VERSION

version 1.107

SYNOPSIS

use Kubernetes::REST::AuthTokenFile;

my $auth = Kubernetes::REST::AuthTokenFile->new(
    file => '/var/run/secrets/kubernetes.io/serviceaccount/token',
);

my $api = Kubernetes::REST->new(
    server => $server,
    credentials => $auth,
);

# Read once, and again whenever the file has changed since
my $token = $auth->token;

# Read once and never again
my $fixed = Kubernetes::REST::AuthTokenFile->new(
    file => $path,
    refresh => 0,
);

DESCRIPTION

Authentication credentials whose bearer token lives in a file: a kubeconfig user's tokenFile, or the service account token mounted into a pod at /var/run/secrets/kubernetes.io/serviceaccount/token.

Kubernetes rotates those files. The kubelet replaces a projected service account token well before it expires, and a client that read the file once at startup keeps sending a token that stops being valid while a good one sits in the file next to it. This class re-reads instead: every call to "token" checks whether the file has changed, and reads it again when it has.

Kubernetes::REST asks its credentials for a token() on every request, so passing one of these is all a long-running process needs.

file

Required. Path to the file holding the token. Used as given on every read, so an absolute path is the safe choice for a process that may chdir - that is what Kubernetes::REST::Kubeconfig passes.

description

How this file is named in error messages, e.g. tokenFile of user 'prod' or service account token. Defaults to token file.

refresh

Whether "token" looks at the file again after the first read. True by default. With refresh => 0 the file is read exactly once, when the object is built, and the token stays what it was then - the behaviour of a plain Kubernetes::REST::AuthToken, for a caller who wants no per-call stat or knows the file never changes.

token

my $token = $auth->token;

The bearer token. Reads the file again if it has changed since the last read, otherwise hands back what was read then.

Cost: one stat per call, so one extra syscall per request. That is the price of noticing a rotation without a timer, and it is deliberate.

If the file cannot be read any more, or holds no token, the last good token is returned instead of dying: a rotation can take the file away for a moment, and an error there would break a client that is one stat away from recovering on its own. Only the very first read, in the constructor, is fatal.

SEE ALSO

SUPPORT

Issues

Please report bugs and feature requests on GitHub at https://github.com/pplu/kubernetes-rest/issues.

IRC

Join #kubernetes on irc.perl.org or message Getty directly.

CONTRIBUTING

Contributions are welcome! Please fork the repository and submit a pull request.

AUTHORS

  • Torsten Raudssus <getty@cpan.org>

  • Jose Luis Martinez Torres <jlmartin@cpan.org>

COPYRIGHT AND LICENSE

This software is Copyright (c) 2019-2026 by Jose Luis Martinez Torres <jlmartin@cpan.org>.

This is free software, licensed under:

The Apache License, Version 2.0, January 2004