WebTerminal cleanup breaks if refresh token is invalidated

[judge-red]

What happened?

I don' have much to say about this then the below:

NAMESPACE              NAME                                                         READY   STATUS             RESTARTS      AGE     IP              NODE                                       NOMINATED NODE   READINESS GATES
kube-system            cleanup-webterminal-7c27b6119f2976c19d852a723d08e4c8-72ntm   0/1     CrashLoopBackOff   5 (71s ago)   19m     172.25.1.161    pg6q7vct9t-worker-ww7wf-58d8d9bd94-8wgst   <none>           <none>

E1031 11:56:35.972860       1 memcache.go:265] couldn't get current server API group list: Get "https://86.119.81.182:32367/api?timeout=32s": failed to refresh token: oauth2: "invalid_request" "Refresh token is invalid or has already been claimed by another client."
Unable to connect to the server: failed to refresh token: oauth2: "invalid_request" "Refresh token is invalid or has already been claimed by another client."

Expected behavior

cleanup finishes successfully

How to reproduce the issue?

I haven't really tried, but I guess:

1. use OIDC for Dex logins
2. open WebTerminal and authentication against Dex
3. verify valid kubeconfig was created
4. download another kubeconfig outside of the WebTerminal, which should invalidate the refresh token in the existing one
5. wait?

How is your environment configured?

• KKP version: 2.26.0
• Shared or separate master/seed clusters?: shared

Provide your KKP manifest here (if applicable)

N/A

What cloud provider are you running on?

OpenStack

What operating system are you running in your user cluster?

Ubuntu 22.04

Additional information

[judge-red]

Wait, does that mean the end user's kubeconfig is used to delete the WebTerminal pod? Performing any operation with an end users credentials that the end user did not consent to would be very uncool.

[ahmedwaleedmalik]

/milestone KKP 2.27

[csengerszabo]

/milestone clear

[csengerszabo]

/transfer dashboard