xvega commented on PR #71349: URL: https://github.com/apache/airflow/pull/71349#issuecomment-5598381922
> Since the ApiClient is now reused for the lifetime of the trigger, can we explicitly document how credential refresh is handled independently of the client lifecycle? In particular, I'm wondering about long-running triggers where credentials may expire while the client is still alive. Credential refresh is handled separately from the cached client: - In-cluster service-account tokens refresh through the Kubernetes configuration’s token-refresh callback. - When exec auth is detected, the hook still reloads the config and creates a client on each call. - For GKE, each get_conn() checks the cached token and updates the Authorization header when it refreshes. The caveat is static mTLS certificates: those are now loaded once per client, so certificate rotation during a running trigger won’t be picked up automatically. That tradeoff is noted in the PR description. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
