Struct RefreshingWorkloadIdentityCredential 

struct RefreshingWorkloadIdentityCredential {
    federated_token_file: PathBuf,
    exchange: Arc<dyn Fn(String, Vec<String>) -> BoxFuture<'static, Result<AccessToken>> + Send + Sync>,
    cache: RwLock<BTreeMap<Vec<String>, (Arc<RwLock<AccessToken>>, AbortOnDropHandle<()>)>>,
    refresh_buffer: Duration,
    retry_interval: Duration,
}

A TokenCredential for AKS-style workload identity that re-reads the projected service account token file on every AAD access token refresh.

azure_identity’s WorkloadIdentityCredential reads AZURE_FEDERATED_TOKEN_FILE once at construction and holds the contents for the life of the process. Kubernetes rotates the projected token, so once the last cached AAD access token expires, every refresh presents an expired client assertion and fails, permanently locking a long-running process out of blob storage. Deferring the file read to refresh time picks up rotations.

Fields

federated_token_file: PathBuf

exchange: Arc<dyn Fn(String, Vec<String>) -> BoxFuture<'static, Result<AccessToken>> + Send + Sync>

cache: RwLock<BTreeMap<Vec<String>, (Arc<RwLock<AccessToken>>, AbortOnDropHandle<()>)>>

One token slot and refresh task per requested scope set. The task keeps the slot fresh, so TokenCredential::get_token only blocks on the first use of a scope set.

refresh_buffer: Duration

retry_interval: Duration

Implementations

impl RefreshingWorkloadIdentityCredential

fn from_env() -> Option<Result<Self>>

Returns a credential if the workload identity environment variables are present, or None to indicate that a different credential type must be used.

fn new( tenant_id: String, client_id: String, federated_token_file: PathBuf, ) -> Result<Self>

fn with_exchange( federated_token_file: PathBuf, exchange: Arc<dyn Fn(String, Vec<String>) -> BoxFuture<'static, Result<AccessToken>> + Send + Sync>, refresh_buffer: Duration, retry_interval: Duration, ) -> Self

Trait Implementations

impl Debug for RefreshingWorkloadIdentityCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TokenCredential for RefreshingWorkloadIdentityCredential

fn get_token<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, scopes: &'life1 [&'life2 str], ) -> Pin<Box<dyn Future<Output = Result<AccessToken>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Gets a AccessToken for the specified resource

fn clear_cache<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Clear the credential’s cache.