<p>With Kubernetes configured to point to an external OpendID provider, it seems through browsing through the code that Kubernetes makes a call to the OpendID provider to get a refresh token.  It expects an <code>id_token</code> to come back.  It seems that Kubernetes respects the expire time for the bearer token and not make a call to the OpendID provider until the bearer token expires.</p>
<p>Is that the correct description of how the refresh tokens work in Kubernetes?</p>

Jeff Sloyer
<p>Kubernetes doesn't have any concept of refresh tokens because the Kubernetes API server isn't a client of the OpenID provider, it simply validates <code>id_token</code>s issues for a specific client.</p>

<p>Clients of the OpenID provider which wish to talk to the API server on the end user's behalf must manage the refresh tokens to issue more <code>id_token</code>s as the current one expires. The API server wont do it for you. </p>
