Ripta Pasay

@Miouge1 - What happens when you don't mount in a service account by modifying kuberos's pod spec to have `automountServiceAccountToken: false` ([doc](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/))? Doing so removes the default service account from...

@kleimkuhler — Thanks for responding and for the clarification about the ServerAuthorizations not currently being deprecated. I've heard of Gateway API, but hadn't read it fully, so thanks for the...

> There is the Token Exchange feature that can be used to exchange one JWT token for another. It only requires the OIDC discovery endpoint (with the valid JWKS uri)....

@sudarshan-reddy — Because I don't want anything to be unprotected by default. If it's part of a design to not support a global originRequest.access, that's fine, but this behavior should...