Get ocelot to work with workload identity and reload bearer after specific time

[muhmuhhum]

We have following Problem:
We are using Ocelot with Workload identity and it works perfectly fine for exactly 1 hour cause then the token will not be valid anymore and no reload is happening. Is there a way to reload the token after 1 hour or reload ocelot to recreate the KubeClient after 1 hour or something like that ?

[raman-m]

What token are you talking about? Authentication token or Kubernetes service discovery token?

[muhmuhhum]

should be kubernetes service discovery its the token file under /var/run/secrets/kubernetes.io/serviceaccount

[raman-m]

We are using Ocelot with Workload identity and it works perfectly fine for exactly 1 hour cause then the token will not be valid anymore and no reload is happening.

It appears you need to upload a new configuration file, namely ocelot.json, to the Ocelot instance.

Is there a way to reload the token after 1 hour or reload ocelot to recreate the KubeClient after 1 hour or something like that ?

Since the token is part of the ServiceDiscoveryProvider global settings, you need a new token with a ocelot.json file inside the created Ocelot instance. To reuse the new service discovery token:

1. Create a new Docker image with a preinstalled ocelot.json containing the updated config. Then deploy instance/pod from this image.
2. Upload the new config JSON using the Administration feature for long-living Ocelot instances. However, the Admin feature requires using IdentityServer setup, which is a bottleneck of the feature.
3. If there is open access to the file system of the Ocelot instance, manually copy ocelot.json and start the Ocelot app with Reload JSON Config On Change mode. After starting copy new file with the new token. Seems DevOps development is required.
4. Develop auto-restart Ocelot logic with reading configuration from anywhere using the AddOcelot methods, which have the FileConfiguration parameter.

Hope this helps!