Thanks for the heads up @williamdclt - aware of token rotation in general but I forgot that kuberesolver implements its own client. We can issue a patch upstream (or fork if it comes to it)