<p>Is there a way to configure Kubernetes SetviceAccount tokens to expire? Following the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens" rel="nofollow noreferrer">documentation these tokens are JWT</a> (as I was able to also check it using a <a href="https://jwt.io/#debugger-io" rel="nofollow noreferrer">JWT debugger</a>). <a href="https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4" rel="nofollow noreferrer">Following the specification JWT specifies expiration</a> but so far I was not able to find out how I can convince Kubernetes create tokens with this header.</p>
<p>Any thoughts?</p>

<p>Currently the default service account JWT tokens in Kubernetes are considered as “forever” tokens. They don’t expire and are valid for as long as the service account exists. I fear that your goal might nor be possible to achieve from the Kubernetes side.</p>
<p>I am posting this answer as a community wiki. Feel free to expand it if you know how to approach it from another side.</p>
<p>I hope this helps.</p>
