DefaultAzureCredentials call in golang to get creds for sending messages to azure service bus. works fine for 1-2 hours but then starts failing.

I set up a workload identity federated credential for my AKS cluster and used it for authenticating to azure service bus, I assigned the client-id of the user-assigned managed identity to the service account and added azure.workload.identity/use: “true” in my deployment spec and added serviceAccountName which had the client id. I created federated credentials using the the same MSI and gave service account name and namespace in the subject as well.

Then I used DefaultAzureCredentials call in golang to get creds for sending messages to azure service bus. On starting my deployment in AKS, the authentication works fine for 1-2 hours but then starts failing with the following error:

401 Unauthorizedn——————————————————————————–n{n “error”: “invalid_client”,n “error_description”: “AADSTS700213: No matching federated identity record found for presented assertion subject ‘system:serviceaccount::(modified for privacy)’. Please check your federated identity credential Subject, Audience and Issuer against the presented assertion.
https://docs.microsoft.com/en-us/azure/active-directory/develop/workload-identity-federation
Trace ID: 2cfbe2b0-dfc6-4ec7-8d10-d2a3ebc67c00 Correlation ID: fd714673-6298-4d66-bc69-ab49c42c6d22 Timestamp: 2024-06-28 11:36:18Z”,n “error_codes”: [n 700213n ],n “timestamp”: “2024-06-28 11:36:18Z”,n