@@ -154,6 +154,11 @@ type clusterAccessorHealthProbeConfig struct {
154
154
// and health checking information (e.g. lastProbeSuccessTimestamp, consecutiveFailures).
155
155
// lockedStateLock must be *always* held (via lock or rLock) before accessing this field.
156
156
type clusterAccessorLockedState struct {
157
+ // kubeconfigResourceVersion is the resource version of the kubeconfig secret.
158
+ // This is used to detect if the kubeconfig secret has changed and we need to re-create the connection.
159
+ // It is set when the connection is created.
160
+ kubeconfigResourceVersion string
161
+
157
162
// lastConnectionCreationErrorTimestamp is the timestamp when connection creation failed the last time.
158
163
lastConnectionCreationErrorTimestamp time.Time
159
164
@@ -273,6 +278,12 @@ func (ca *clusterAccessor) Connect(ctx context.Context) (retErr error) {
273
278
274
279
log .Info ("Connected" )
275
280
281
+ kubeconfigSecret , err := ca .getKubeConfigSecret (ctx )
282
+ if err != nil {
283
+ return err
284
+ }
285
+ ca .lockedState .kubeconfigResourceVersion = kubeconfigSecret .ResourceVersion
286
+
276
287
// Only generate the clientCertificatePrivateKey once as there is no need to regenerate it after disconnect/connect.
277
288
// Note: This has to be done before setting connection, because otherwise this code wouldn't be re-entrant if the
278
289
// private key generation fails because we check Connected above.
@@ -414,6 +425,18 @@ func (ca *clusterAccessor) GetRESTConfig(ctx context.Context) (*rest.Config, err
414
425
return ca .lockedState .connection .restConfig , nil
415
426
}
416
427
428
+ func (ca * clusterAccessor ) KubeConfigUpdated (ctx context.Context ) (bool , error ) {
429
+ ca .rLock (ctx )
430
+ defer ca .rUnlock (ctx )
431
+
432
+ kubeconfigSecret , err := ca .getKubeConfigSecret (ctx )
433
+ if err != nil {
434
+ return false , err
435
+ }
436
+
437
+ return kubeconfigSecret .ResourceVersion != ca .lockedState .kubeconfigResourceVersion , nil
438
+ }
439
+
417
440
func (ca * clusterAccessor ) GetClientCertificatePrivateKey (ctx context.Context ) * rsa.PrivateKey {
418
441
ca .rLock (ctx )
419
442
defer ca .rUnlock (ctx )
0 commit comments