K8s 1.24中ServiceAccount无法列出leases资源问题求助

配置了对应Role和RoleBinding的ServiceAccount（system:serviceaccount:karpenter:karpenter）仍无法列出kube-node-lease命名空间下的Lease资源，报错如下：

2023-09-08T15:30:21.875Z    INFO    controller  k8s.io/client-go@v0.26.6/tools/cache/reflector.go:169: 
failed to list *v1.Lease: leases.coordination.k8s.io is forbidden: User "system:serviceaccount:karpenter:karpenter" 
cannot list resource "leases" in API group "coordination.k8s.io" 
in the namespace "kube-node-lease"

执行权限校验命令时返回认证错误：

➜  ~ kubectl auth can-i get leases --as system:serviceaccount:karpenter:karpenter
error: You must be logged in to the server (the server has asked for the client to provide credentials (post selfsubjectaccessreviews.authorization.k8s.io))

当前已配置的Role和RoleBinding如下：

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: karpenter-lease
  namespace: kube-node-lease
  labels:
    helm.sh/chart: karpenter-v0.30.0
    app.kubernetes.io/name: karpenter
    app.kubernetes.io/instance: karpenter
    app.kubernetes.io/version: "0.30.0"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: karpenter-lease
subjects:
  - kind: ServiceAccount
    name: karpenter
    namespace: karpenter
---
# Source: karpenter/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: karpenter-lease
  namespace: kube-node-lease
  labels:
    helm.sh/chart: karpenter-v0.30.0
    app.kubernetes.io/name: karpenter
    app.kubernetes.io/instance: karpenter
    app.kubernetes.io/version: "0.30.0"
    app.kubernetes.io/managed-by: Helm
rules:
  # Read
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch"]
  # Write
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["delete"]

已知K8s 1.24对ServiceAccount Token有重大变更，已手动创建Token但问题未解决：

kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: karpenter
  annotations:
    kubernetes.io/service-account.name: karpenter
type: kubernetes.io/service-account-token
EOF

请问是否有人遇到过此类问题，希望得到帮助。

内容的提问来源于stack exchange，提问作者titanium1905