Rancher kubeconfig token expiry and authentication session mismatch

Credential Lifecycle Management

In Rancher environments utilizing external identity providers (OIDC, SAML, or AD), there is a functional distinction between the identity provider session lifetime and the TTL of the token embedded in the generated kubeconfig file. While the session governs access to the Rancher UI, the kubeconfig token governs kubectl operations via the Rancher proxy or authorized cluster endpoints.

Least-Privilege Enforcement

Implementing a strict least-privilege model often requires shortening token TTLs to minimize the window of opportunity for leaked credentials. However, the behavior of the Rancher proxy when a token expires while the underlying identity session remains active is not uniformly documented across all versions.

Specifically, it is unclear if the Rancher proxy can transparently re-mint a short-lived token based on a valid session, or if the expiration of the kubeconfig token necessitates a full manual re-authentication flow regardless of the session state.

• Does the Rancher proxy automatically refresh an expired kubeconfig token if a valid identity provider session exists?
• How does the expiration behavior differ when requests are routed through the Rancher proxy versus directly through an authorized cluster endpoint?