Use monotonic time for in-cluster token refresh

kubernetes/aio/config/incluster_config.py

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import datetime
 import os
+from time import monotonic
 
 from kubernetes.aio.client import Configuration
 
@@ -44,7 +44,7 @@ def __init__(self,
         self._cert_filename = cert_filename
         self._environ = environ
         self._try_refresh_token = try_refresh_token
-        self._token_refresh_period = datetime.timedelta(minutes=1)
+        self._token_refresh_period = 60
 
     def load_and_set(self, client_configuration=None):
         try_set_default = False
@@ -93,7 +93,7 @@ def _set_config(self, client_configuration):
             return
 
         def _refresh_api_key(client_configuration):
-            if self.token_expires_at <= datetime.datetime.now():
+            if self.token_expires_at <= monotonic():
                 self._read_token_file()
             self._set_config(client_configuration)
 
@@ -105,8 +105,7 @@ def _read_token_file(self):
             if not content:
                 raise ConfigException("Token file exists but empty.")
             self.token = "bearer " + content
-            self.token_expires_at = datetime.datetime.now(
-            ) + self._token_refresh_period
+            self.token_expires_at = monotonic() + self._token_refresh_period
 
 
 def load_incluster_config(client_configuration=None, try_refresh_token=True):

kubernetes/aio/config/incluster_config_test.py

@@ -12,11 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import datetime
 import os
 import tempfile
 import time
 import unittest
+from unittest.mock import patch
 from unittest import IsolatedAsyncioTestCase
 
 from kubernetes.aio.client import Configuration
@@ -86,7 +86,8 @@ def test_load_config(self):
         self.assertEqual(cert_filename, loader.ssl_ca_cert)
         self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
 
-    async def test_refresh_token(self):
+    @patch(__package__ + ".incluster_config.monotonic", return_value=100.0)
+    async def test_refresh_token(self, monotonic):
         loader = self.get_test_loader()
         config = Configuration()
         loader.load_and_set(config)
@@ -96,14 +97,13 @@ async def test_refresh_token(self):
         self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
         self.assertIsNotNone(loader.token_expires_at)
 
-        old_token = loader.token
         old_token_expires_at = loader.token_expires_at
         loader._token_filename = self._create_file_with_temp_content(
             _TEST_NEW_TOKEN)
         self.assertEqual('bearer ' + _TEST_TOKEN,
                          await config.get_api_key_with_prefix('BearerToken'))
 
-        loader.token_expires_at = datetime.datetime.now()
+        monotonic.return_value = 160.0
         self.assertEqual('bearer ' + _TEST_NEW_TOKEN,
                          await config.get_api_key_with_prefix('BearerToken'))
         self.assertEqual('bearer ' + _TEST_NEW_TOKEN, loader.token)

kubernetes/config/incluster_config.py

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import datetime
 import os
+from time import monotonic
 
 from kubernetes.client import Configuration
 
@@ -44,7 +44,7 @@ def __init__(self,
         self._cert_filename = cert_filename
         self._environ = environ
         self._try_refresh_token = try_refresh_token
-        self._token_refresh_period = datetime.timedelta(minutes=1)
+        self._token_refresh_period = 60
 
     def load_and_set(self, client_configuration=None):
         try_set_default = False
@@ -93,7 +93,7 @@ def _set_config(self, client_configuration):
             return
 
         def _refresh_api_key(client_configuration):
-            if self.token_expires_at <= datetime.datetime.now():
+            if self.token_expires_at <= monotonic():
                 self._read_token_file()
             self._set_config(client_configuration)
 
@@ -105,8 +105,7 @@ def _read_token_file(self):
             if not content:
                 raise ConfigException("Token file exists but empty.")
             self.token = "bearer " + content
-            self.token_expires_at = datetime.datetime.now(
-            ) + self._token_refresh_period
+            self.token_expires_at = monotonic() + self._token_refresh_period
 
 
 def load_incluster_config(client_configuration=None, try_refresh_token=True):

kubernetes/config/incluster_config_test.py

@@ -12,11 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import datetime
 import os
 import tempfile
 import time
 import unittest
+from unittest.mock import patch
 
 from kubernetes.client import Configuration
 
@@ -85,7 +85,8 @@ def test_load_config(self):
         self.assertEqual(cert_filename, loader.ssl_ca_cert)
         self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
 
-    def test_refresh_token(self):
+    @patch(__package__ + ".incluster_config.monotonic", return_value=100.0)
+    def test_refresh_token(self, monotonic):
         loader = self.get_test_loader()
         config = Configuration()
         loader.load_and_set(config)
@@ -95,14 +96,13 @@ def test_refresh_token(self):
         self.assertEqual('bearer ' + _TEST_TOKEN, loader.token)
         self.assertIsNotNone(loader.token_expires_at)
 
-        old_token = loader.token
         old_token_expires_at = loader.token_expires_at
         loader._token_filename = self._create_file_with_temp_content(
             _TEST_NEW_TOKEN)
         self.assertEqual('bearer ' + _TEST_TOKEN,
                          config.get_api_key_with_prefix('BearerToken'))
 
-        loader.token_expires_at = datetime.datetime.now()
+        monotonic.return_value = 160.0
         self.assertEqual('bearer ' + _TEST_NEW_TOKEN,
                          config.get_api_key_with_prefix('BearerToken'))
         self.assertEqual('bearer ' + _TEST_NEW_TOKEN, loader.token)