From b1ddc17453587ec80dc7e18cb1de45b4921464b0 Mon Sep 17 00:00:00 2001
From: aditsharma55 <aditsharma@nvidia.com>
Date: Fri, 24 Jul 2026 23:22:20 +0530
Subject: [PATCH] fix(auth): remove Kubernetes service account token fallback

---
 pkg/store/authtoken.go | 34 ----------------------------------
 1 file changed, 34 deletions(-)

diff --git a/pkg/store/authtoken.go b/pkg/store/authtoken.go
index c4bc2036..3abf131f 100644
--- a/pkg/store/authtoken.go
+++ b/pkg/store/authtoken.go
@@ -2,7 +2,6 @@ package store
 
 import (
 	"fmt"
-	"io/ioutil"
 	"path"
 
 	"github.com/brevdev/brev-cli/pkg/entity"
@@ -49,13 +48,6 @@ tokens, err := authtokens.ReadAuthTokensFromDisk()
 */
 
 func (f FileStore) GetAuthTokens() (*entity.AuthTokens, error) {
-	serviceToken, err := f.GetCurrentWorkspaceServiceToken()
-	if err == nil && serviceToken != "" {
-		return &entity.AuthTokens{
-			AccessToken: serviceToken,
-		}, nil
-	}
-
 	brevCredentialsFile, err := f.getBrevCredentialsFile()
 	if err != nil {
 		return nil, breverrors.WrapAndTrace(err)
@@ -77,32 +69,6 @@ func (f FileStore) GetAuthTokens() (*entity.AuthTokens, error) {
 	return &token, nil
 }
 
-func (f FileStore) GetCurrentWorkspaceServiceToken() (string, error) {
-	saTokenFilePath := getServiceTokenFilePath()
-	// safely check if file exists
-
-	exists, err := f.FileExists(saTokenFilePath)
-
-	if !exists || err != nil {
-		return "", err
-	}
-
-	saTokenFile, err := f.fs.Open(saTokenFilePath)
-	defer saTokenFile.Close() //nolint: errcheck // defer is fine
-	if err != nil {
-		return "", breverrors.WrapAndTrace(err)
-	}
-	token, err := ioutil.ReadAll(saTokenFile)
-	if err != nil {
-		return "", breverrors.WrapAndTrace(err)
-	}
-	return string(token), nil
-}
-
-func getServiceTokenFilePath() string {
-	return "/var/run/secrets/kubernetes.io/serviceaccount/token"
-}
-
 func (f FileStore) DeleteAuthTokens() error {
 	brevCredentialsFile, err := f.getBrevCredentialsFile()
 	if err != nil {