auto renewal of refresh token, update cfclient

.vscode/launch.json

@@ -15,7 +15,7 @@
                 "--webhook-bind-address=:2443",
                 "--webhook-tls-directory=${workspaceFolder}/.local/ssl",
                 "--enableWebhooks=false",
-                "--cluster-resource-namespace=default",
+                "--refresh-token-auto-renewal-interval=1h",
                 "--sap-binding-metadata"
             ]
         },

Dockerfile

@@ -1,5 +1,6 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.23.0 as builder
+FROM --platform=$BUILDPLATFORM golang:1.22.5 AS builder
+
 ARG TARGETOS
 ARG TARGETARCH
 

go.mod

@@ -3,7 +3,7 @@ module github.com/sap/cf-service-operator
 go 1.22.5
 
 require (
-	github.com/cloudfoundry-community/go-cfclient/v3 v3.0.0-alpha.5
+	github.com/cloudfoundry/go-cfclient/v3 v3.0.0-alpha.9
 	github.com/go-logr/logr v1.4.1
 	github.com/maxbrunsfeld/counterfeiter/v6 v6.8.1
 	github.com/onsi/ginkgo/v2 v2.15.0
@@ -49,26 +49,25 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2 // indirect
+	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
 	github.com/prometheus/common v0.45.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/testify v1.8.4 // indirect
+	github.com/stretchr/testify v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
 	golang.org/x/mod v0.14.0 // indirect
 	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/oauth2 v0.12.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
 	golang.org/x/sys v0.16.0 // indirect
 	golang.org/x/term v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.17.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect

go.sum

@@ -5,8 +5,8 @@ github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cloudfoundry-community/go-cfclient/v3 v3.0.0-alpha.5 h1:D6Kc4/ockmFHKNKUSeMNt3G82rddwZV6xWbjIXv8oaE=
-github.com/cloudfoundry-community/go-cfclient/v3 v3.0.0-alpha.5/go.mod h1:hFja9UPzLkfNxTF8EM0sqs7K+J2BCoLcjNmrMbP24xY=
+github.com/cloudfoundry/go-cfclient/v3 v3.0.0-alpha.9 h1:HK3+nJEPgwlhc5H74aw/V4mVowqWaTKGjHONdVQQ2Vw=
+github.com/cloudfoundry/go-cfclient/v3 v3.0.0-alpha.9/go.mod h1:eUjFfpsU3lRv388wKlXMmkQfsJ9pveUHZEia7AoBCPY=
 github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0 h1:sDMmm+q/3+BukdIpxwO365v/Rbspp2Nt5XntgQRXq8Q=
 github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0/go.mod h1:4Zcjuz89kmFXt9morQgcfYZAYZ5n8WHjt81YYWIwtTM=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -40,7 +40,6 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
@@ -92,8 +91,8 @@ github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY
 github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
 github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
 github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
-github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2 h1:CXwSGu/LYmbjEab5aMCs5usQRVBGThelUKBNnoSOuso=
-github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2/go.mod h1:L3UMQOThbttwfYRNFOWLLVXMhk5Lkio4GGOtw5UrxS0=
+github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c h1:rp5dCmg/yLR3mgFuSOe4oEnDDmGLROTvMragMUXpTQw=
+github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c/go.mod h1:X07ZCGwUbLaax7L0S3Tw4hpejzu63ZrrQiUe6W0hcy0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -115,13 +114,15 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -140,14 +141,13 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
-golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
+golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
+golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -162,7 +162,6 @@ golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
@@ -180,8 +179,6 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=

internal/cf/binding.go

@@ -11,8 +11,8 @@ import (
 	"fmt"
 	"strconv"
 
-	cfclient "github.com/cloudfoundry-community/go-cfclient/v3/client"
-	cfresource "github.com/cloudfoundry-community/go-cfclient/v3/resource"
+	cfclient "github.com/cloudfoundry/go-cfclient/v3/client"
+	cfresource "github.com/cloudfoundry/go-cfclient/v3/resource"
 	"github.com/pkg/errors"
 
 	"github.com/sap/cf-service-operator/internal/facade"
@@ -37,7 +37,8 @@ func (bn *bindingFilterName) getListOptions() *cfclient.ServiceCredentialBinding
 
 func (bo *bindingFilterOwner) getListOptions() *cfclient.ServiceCredentialBindingListOptions {
 	listOpts := cfclient.NewServiceCredentialBindingListOptions()
-	listOpts.LabelSelector.EqualTo(fmt.Sprintf("%s/%s=%s", labelPrefix, labelKeyOwner, bo.owner))
+	listOpts.LabelSel = make(map[string]cfclient.ExclusionFilter)
+	listOpts.LabelSel.EqualTo(fmt.Sprintf("%s/%s=%s", labelPrefix, labelKeyOwner, bo.owner))
 	return listOpts
 }
 
@@ -113,7 +114,7 @@ func (c *spaceClient) GetBinding(ctx context.Context, bindingOpts map[string]str
 
 	return &facade.Binding{
 		Guid:             guid,
-		Name:             name,
+		Name:             *name,
 		Owner:            bindingOpts["owner"],
 		Generation:       generation,
 		ParameterHash:    parameterHash,
@@ -161,5 +162,6 @@ func (c *spaceClient) UpdateBinding(ctx context.Context, guid string, generation
 }
 
 func (c *spaceClient) DeleteBinding(ctx context.Context, guid string) error {
-	return c.client.ServiceCredentialBindings.Delete(ctx, guid)
+	_ /*jobId*/, err := c.client.ServiceCredentialBindings.Delete(ctx, guid)
+	return err
 }

internal/cf/client.go

@@ -7,12 +7,15 @@ package cf
 
 import (
 	"fmt"
+	"net/http"
 	"sync"
+	"time"
 
-	cfclient "github.com/cloudfoundry-community/go-cfclient/v3/client"
-	cfconfig "github.com/cloudfoundry-community/go-cfclient/v3/config"
+	cfclient "github.com/cloudfoundry/go-cfclient/v3/client"
+	cfconfig "github.com/cloudfoundry/go-cfclient/v3/config"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 
+	"github.com/sap/cf-service-operator/internal/config"
 	"github.com/sap/cf-service-operator/internal/facade"
 	cfmetrics "github.com/sap/cf-service-operator/pkg/metrics"
 )
@@ -44,10 +47,11 @@ type clientIdentifier struct {
 }
 
 type clientCacheEntry struct {
-	url      string
-	username string
-	password string
-	client   cfclient.Client
+	url       string
+	username  string
+	password  string
+	client    cfclient.Client
+	expiresAt time.Time
 }
 
 var (
@@ -68,17 +72,22 @@ func newOrganizationClient(organizationName string, url string, username string,
 	if password == "" {
 		return nil, fmt.Errorf("missing or empty password")
 	}
-	config, err := cfconfig.NewUserPassword(url, username, password)
+
+	// prepare HTTP client with metrics
+	httpClient := &http.Client{}
+	transport, err := cfmetrics.AddMetricsToTransport(httpClient.Transport, metrics.Registry, "cf-api", url)
 	if err != nil {
 		return nil, err
 	}
-	httpClient := config.HTTPClient()
-	transport, err := cfmetrics.AddMetricsToTransport(httpClient.Transport, metrics.Registry, "cf-api", url)
+	httpClient.Transport = transport
+
+	// create CF client
+	config, err := cfconfig.New(url,
+		cfconfig.UserPassword(username, password),
+		cfconfig.HttpClient(httpClient))
 	if err != nil {
 		return nil, err
 	}
-	httpClient.Transport = transport
-	config.WithHTTPClient(httpClient)
 	c, err := cfclient.New(config)
 	if err != nil {
 		return nil, err
@@ -99,25 +108,30 @@ func newSpaceClient(spaceGuid string, url string, username string, password stri
 	if password == "" {
 		return nil, fmt.Errorf("missing or empty password")
 	}
-	config, err := cfconfig.NewUserPassword(url, username, password)
+
+	// add metrics to HTTP client
+	httpClient := &http.Client{}
+	transport, err := cfmetrics.AddMetricsToTransport(httpClient.Transport, metrics.Registry, "cf-api", url)
 	if err != nil {
 		return nil, err
 	}
-	httpClient := config.HTTPClient()
-	transport, err := cfmetrics.AddMetricsToTransport(httpClient.Transport, metrics.Registry, "cf-api", url)
+	httpClient.Transport = transport
+
+	// create CF client
+	config, err := cfconfig.New(url,
+		cfconfig.UserPassword(username, password),
+		cfconfig.HttpClient(httpClient))
 	if err != nil {
 		return nil, err
 	}
-	httpClient.Transport = transport
-	config.WithHTTPClient(httpClient)
 	c, err := cfclient.New(config)
 	if err != nil {
 		return nil, err
 	}
 	return &spaceClient{spaceGuid: spaceGuid, client: *c}, nil
 }
 
-func NewOrganizationClient(organizationName string, url string, username string, password string) (facade.OrganizationClient, error) {
+func NewOrganizationClient(organizationName string, url string, username string, password string, config *config.Config) (facade.OrganizationClient, error) {
 	cacheMutex.Lock()
 	defer cacheMutex.Unlock()
 
@@ -135,21 +149,32 @@ func NewOrganizationClient(organizationName string, url string, username string,
 			delete(clientCache, identifier)
 			isInCache = false
 		}
+		if cacheEntry.expiresAt.Before(time.Now()) {
+			delete(clientCache, identifier)
+			isInCache = false
+		}
 	}
 
 	if !isInCache {
 		// create new CF client and wrap it as organizationClient
 		client, err = newOrganizationClient(organizationName, url, username, password)
 		if err == nil {
 			// add CF client to cache
-			clientCache[identifier] = &clientCacheEntry{url: url, username: username, password: password, client: client.client}
+			clientCache[identifier] = &clientCacheEntry{
+				url:       url,
+				username:  username,
+				password:  password,
+				client:    client.client,
+				expiresAt: time.Now().Add(config.RefreshTokenAutoRenewalInterval),
+			}
+
 		}
 	}
 
 	return client, err
 }
 
-func NewSpaceClient(spaceGuid string, url string, username string, password string) (facade.SpaceClient, error) {
+func NewSpaceClient(spaceGuid string, url string, username string, password string, config *config.Config) (facade.SpaceClient, error) {
 	cacheMutex.Lock()
 	defer cacheMutex.Unlock()
 
@@ -167,21 +192,31 @@ func NewSpaceClient(spaceGuid string, url string, username string, password stri
 			delete(clientCache, identifier)
 			isInCache = false
 		}
+		if cacheEntry.expiresAt.Before(time.Now()) {
+			delete(clientCache, identifier)
+			isInCache = false
+		}
 	}
 
 	if !isInCache {
 		// create new CF client and wrap it as spaceClient
 		client, err = newSpaceClient(spaceGuid, url, username, password)
 		if err == nil {
 			// add CF client to cache
-			clientCache[identifier] = &clientCacheEntry{url: url, username: username, password: password, client: client.client}
+			clientCache[identifier] = &clientCacheEntry{
+				url:       url,
+				username:  username,
+				password:  password,
+				client:    client.client,
+				expiresAt: time.Now().Add(config.RefreshTokenAutoRenewalInterval),
+			}
 		}
 	}
 
 	return client, err
 }
 
-func NewSpaceHealthChecker(spaceGuid string, url string, username string, password string) (facade.SpaceHealthChecker, error) {
+func NewSpaceHealthChecker(spaceGuid string, url string, username string, password string, config *config.Config) (facade.SpaceHealthChecker, error) {
 	cacheMutex.Lock()
 	defer cacheMutex.Unlock()
 
@@ -199,14 +234,24 @@ func NewSpaceHealthChecker(spaceGuid string, url string, username string, passwo
 			delete(clientCache, identifier)
 			isInCache = false
 		}
+		if cacheEntry.expiresAt.Before(time.Now()) {
+			delete(clientCache, identifier)
+			isInCache = false
+		}
 	}
 
 	if !isInCache {
 		// create new CF client and wrap it as spaceClient
 		client, err = newSpaceClient(spaceGuid, url, username, password)
 		if err == nil {
 			// add CF client to cache
-			clientCache[identifier] = &clientCacheEntry{url: url, username: username, password: password, client: client.client}
+			clientCache[identifier] = &clientCacheEntry{
+				url:       url,
+				username:  username,
+				password:  password,
+				client:    client.client,
+				expiresAt: time.Now().Add(config.RefreshTokenAutoRenewalInterval),
+			}
 		}
 	}