Identify a high-privilege ServiceAccount in scope.
The clusterrole-aggregation-controller SA in kube-system has effective cluster-admin rights and is a prime target.
Mint a bound token through the TokenRequest API with an extended lifetime, for example --duration=87600h for ten years.
The API server honors the request unless --service-account-max-token-expiration is set.
kubeadm does not set it, so the full 87600h is issued.
Managed providers commonly do set it.
Authenticate as the ServiceAccount with the minted token.
T0 when targeting kube-system controller service accounts such as clusterrole-aggregation-controller or kube-controller-manager.
Note:
The serviceaccounts/token subresource (TokenRequest API) was promoted to stable in 1.22, making this path available without alpha flags.
No patch exists.
Keep token TTLs short and audit all uses of this verb.