Prefer higher-priority bearer tokens over kubeconfig basic auth - #8002
Open
HarshDevelops wants to merge 1 commit into
Open
Prefer higher-priority bearer tokens over kubeconfig basic auth#8002HarshDevelops wants to merge 1 commit into
HarshDevelops wants to merge 1 commit into
Conversation
When a higher-priority bearer token (system property/env) competes with lower-priority kubeconfig basic credentials, clear the losing form so TokenRefreshInterceptor does not send Basic auth over the token. Prefer higher-priority basic credentials over a lower-ranked token the same way. Same-rank values keep previous combined behaviour. Fixes fabric8io#7960
HarshDevelops
requested review from
ash-thakur-rh,
manusa and
shawkins
as code owners
July 19, 2026 13:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7960
What was wrong
Auto-configuration keeps both a higher-priority bearer token (system property or environment) and lower-priority kubeconfig basic credentials. TokenRefreshInterceptor checks basic auth first, so the client can send Basic credentials even when a higher-priority token was supplied.
What changed
Config now ranks auth sources (system property > environment > kubeconfig) and clears the losing form when token and basic credentials compete. Same-rank values still keep both, matching previous same-source behaviour.
Testing