#6255 Move external command execution from token source provider to token source Pull request opened by andrei-trandafir Tracking issue #6254 Why are the changes needed? External command doesn't get called again if authentication starts failing due to the returned token. What changes were proposed in this pull request? Create a new externalCommandTokenSource that runs the external command instead of the token source provider. This results in: • The external command is called as part of the

MaterialiseCredentials

function instead of the

getTokenSourceAndMetadata

function that is synchronized (in the

flyteidl/go/client/admin/auth_interceptor.go

). • If the token in the token cache results in an

Unauthenticated

response from the flyte admin, the external command is called again. How was this patch tested? • Deployed the change to a flytepropeller instance using

ExternalCommand

auth that returns an expiring token • Waited for the expiry of the token and checked whether authentication still works Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. Related PRs The issue resulted from the following PR: #5686 Summary by Bito This pull request introduces the ExternalCommandTokenSource feature, enhancing token handling by re-executing external commands upon authentication failures. It aims to improve the authentication process in the Flyte system, with relevant unit tests added to ensure functionality. Unit tests added: True Estimated effort to review (1-5, lower is better): 2 flyteorg/flyte