GKE RBAC授权后服务账号Token过期，如何设置永不过期？

First off, the short answer is: No, you can't set a permanent, never-expiring access token for a GKE service account — and for good security reasons. Let me break down why, plus share better alternatives that let you skip manual token renewal entirely.

Why permanent tokens aren't allowed #

Google Cloud (including GKE) enforces short-lived access tokens by default (usually 1 hour for OAuth 2.0 tokens) as a core security best practice. A permanent token would create a massive risk: if it ever leaks, an attacker could gain persistent, unrestricted access to your GKE cluster and linked GCP resources. This aligns with industry standards for minimizing the impact of credential exposure.

Better alternatives to manual token renewal #

Instead of chasing a permanent token, use these supported, secure methods to automate token management:

1. Use Workload Identity (Recommended) #

This is the official GKE best practice for integrating GCP service accounts with Kubernetes workloads. It lets your pods automatically fetch short-lived, scoped tokens without any manual work:

• Enable Workload Identity on your GKE cluster (if not already enabled)
• Create a GCP service account with the exact IAM roles needed for GKE access
• Create a Kubernetes service account (KSA) in your cluster namespace
• Bind the KSA to the GCP service account using an IAM policy binding
• Configure your pods to use the KSA — they’ll automatically pull valid tokens whenever needed

2. Automate token refresh with scripts #

If Workload Identity isn’t an option for your use case, you can script automatic token generation using the gcloud CLI:

• Use this command to generate a fresh token: gcloud auth print-access-token --impersonate-service-account=your-service-account@your-project.iam.gserviceaccount.com
• Set up a cron job (or a scheduled task in your application) to run this command every 50 minutes (before the current 1-hour token expires)
• Update your tooling or app to pull the new token each time it runs

3. Service account keys (Not recommended) #

While you can create a long-lived service account key file (which acts like a permanent credential), Google strongly discourages this. Keys are static, and if compromised, can be used indefinitely until revoked. Only use this as a last resort, and ensure you:

• Restrict key permissions to the absolute minimum required
• Rotate keys on a strict schedule
• Store keys in a secure secrets manager (like GCP Secret Manager)

Final note #

Avoiding permanent tokens isn’t just a restriction — it’s a critical security measure to protect your GKE resources. Stick to Workload Identity whenever possible, as it’s the most secure and low-maintenance solution.

内容的提问来源于stack exchange，提问作者yara mohamed