In a time leap scenario, it may render the service account token unavailable. about kubernetes HOT 7 CLOSED

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

from kubernetes.

/sig auth

from kubernetes.

In a time leap scenario, if the system time is adjusted to a time beyond the token's expiration, kubelet will refresh the token automatically, ensuring no issues arise. However, if the system time is set to a time before the token's validity period, kubelet will not automatically update the token, leading to a 401 error when containers attempt to access the API server.

this seems like something that can be improved.
SIG auth can provide feedback.

but FWIW, time leap can break a lot of things and is generally not advisable.
the kubelet automatic client cert rotation comes to mind. we (at kubeadm) continue to occasionally get reports where the kubelet client cert did not renew "on time".

from kubernetes.

I submitted a PR.
When the kubelet determines that the token is later than the system time, it will be refreshed, as if the token is about to expire.

from kubernetes.

/area kubelet

from kubernetes.

/close

Per #123432 (comment)

from kubernetes.

@enj: Closing this issue.

from kubernetes.