From a1b85375a2b8aa05a0b69ae6c42e5f9e42672d06 Mon Sep 17 00:00:00 2001 From: Gianluca Mardente Date: Tue, 18 Aug 2026 14:08:06 +0200 Subject: [PATCH] fix: detect an expired kubeconfig and discard it from cache --- controllers/classifier_report_collection.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/controllers/classifier_report_collection.go b/controllers/classifier_report_collection.go index 097e809..c3b3ade 100644 --- a/controllers/classifier_report_collection.go +++ b/controllers/classifier_report_collection.go @@ -442,6 +442,13 @@ func collectClassifierReportsFromCluster(ctx context.Context, c client.Client, classifierReportList := libsveltosv1beta1.ClassifierReportList{} err = clusterClient.List(ctx, &classifierReportList, listOptions...) if err != nil { + // getClassifierClient succeeding only means the cached rest.Config was non-nil - it + // does not verify the credentials still work, since client.New performs no network + // call. A token that expired since the config was cached surfaces here, on first + // actual use, not there. Evict so the next collection cycle rebuilds the client from a + // freshly-read kubeconfig Secret instead of retrying the same stale credentials forever. + clustercache.GetManager().InvalidateOnAuthError(cluster.Namespace, cluster.Name, + clusterproxy.GetClusterType(cluster), err) return err }