assertThat(stats.loadExceptionCount()).isEqualTo(0);
    assertThat(stats.hitCount()).isEqualTo(1);

    ticker.advance(1, MILLISECONDS);
    assertThat(cache.getUnchecked(key)).isSameInstanceAs(one);
    // refreshed
    stats = cache.stats();
    assertThat(stats.missCount()).isEqualTo(1);
    assertThat(stats.loadSuccessCount()).isEqualTo(1);
    assertThat(stats.loadExceptionCount()).isEqualTo(1);

    assertThat(stats.loadExceptionCount()).isEqualTo(0);
    assertThat(stats.hitCount()).isEqualTo(1);

    ticker.advance(1, MILLISECONDS);
    assertThat(cache.getUnchecked(key)).isSameInstanceAs(one);
    // refreshed
    stats = cache.stats();
    assertThat(stats.missCount()).isEqualTo(1);
    assertThat(stats.loadSuccessCount()).isEqualTo(1);
    assertThat(stats.loadExceptionCount()).isEqualTo(1);

        }
    }

    /**
     * Attempts to refresh tokens silently using the MSAL4J silent authentication flow.
     * @param user The Entra ID user whose tokens need to be refreshed.
     * @return The new authentication result, or null if silent refresh failed.
     */
    public IAuthenticationResult refreshTokenSilently(final EntraIdCredential.EntraIdUser user) {

* With this PR, kubectl and other RestClient's using the AuthProvider framework can make OIDC authenticated requests, and, if there is a refresh token present, the tokens will be refreshed as needed. ([#25270](https://github.com/kubernetes/kubernetes/pull/25270), [@bobbyrullo](https://github.com/bobbyrullo))