google-auth-library-java-oauth2-http: refresh() doesn't generate new token on each call in GKE about google-auth-library-java

[TimurSadykov]

Hi, thanks for the question!

The behavior of GKE is expected if you rely on a VM-provided credential. Access token is indeed cashed on environment level for approx. 55 min, just like you have discovered.

The documentation you referring to is for the very base class, not a specific credential you eventually use. Most likely the actual type of credential in your case in ComputeEngineCredentials. Although I agree, base class documentation is misleading in this case, we will update that refresh behavior depends on actual credential type.

Locally you are outside of GCE/GKE environment and you probably rely on some serviceaccount or usercredentials from gcloud. They don't cache.

If you want local and GKE behaviors to match you need to set up prod environment with a ServiceAccount. One way to do that, that does no require any code change in your case: set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the JSON file that contains your service account key.

[gaurav517]

Thanks. It makes sense.

If you want local and GKE behaviors to match you need to set up prod environment with a ServiceAccount.: In my case I was using a Service Account both in GKE (using WLI) and local environment (using json key). I am assuming caching in some layer in GKE environment when using WLI (pod/node/metadata-server etc.) Unfortunately I couldn't find a good documentation for this yet.

[TimurSadykov]

Oh actually, even separate service account could be cached in some environments. Apparently it is true for GKE. Sorry for the confusion.

BTW, do you really need the token flow? For most services token flow is not used and SelfSignedJWT flow is used instead. In this no access token and no refresh required.

This flow should be enabled by default when used with scopes. You can check having a breakpoint here, here.

[TimurSadykov]

@gaurav517 In general, there is no practical difference. Either way, library makes sure the token is fresh on each request. Let us know if there is any scenario that is affected by differences in behavior.

[TimurSadykov]

please reopen if any more questions