# Short-lived Kubernetes Service Account Tokens vs Tokenreview

**URL:** <https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975>\
**Category:** Vault\
**Created:** [July 29, 2025, 9:03am UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975 "2025-07-29T09:03:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![msonnleitner](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/msonnleitner/32/44399_2.png) [@msonnleitner](https://discuss.hashicorp.com/u/msonnleitner)\
**Post date:** [July 29, 2025, 9:03am UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975/1 "2025-07-29T09:03:06Z")

</div>

If I use a projected service account token like

```
  projected:
    sources:
    - serviceAccountToken:
        path: vault-token
        expirationSeconds: 7200
        audience: vault  

```

und try using [Use local service account token as the reviewer JWT](https://developer.hashicorp.com/vault/docs/auth/kubernetes#use-local-service-account-token-as-the-reviewer-jwt), then this will probably not work, since the audience “vault” cannot be used to query the TokenReview API.

So if I want

- projected tokens
- don’t want to use long-lived Kubernetes tokens
- use a custom audience like “vault”.

I guess this cannot be done with Kubernetes auth method?

So do I have to switch to JWT?

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [July 29, 2025, 2:50pm UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975/2 "2025-07-29T14:50:08Z")

</div>

Can you share a bit more about your setup? For example, where does Vault run in relation to your Kubernetes cluster(s)? Do you run multiple clusters? Multiple instances of Vault?

---

<div class="post-metadata">

**Author:** ![msonnleitner](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/msonnleitner/32/44399_2.png) [@msonnleitner](https://discuss.hashicorp.com/u/msonnleitner)\
**Post date:** [July 29, 2025, 3:02pm UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975/3 "2025-07-29T15:02:33Z")

</div>

Using HCP Vault, therefore Vault is not running in that Kubernetes cluster. Currently there is only one cluster.  
So “Use local token as reviewer JWT” is not an option ( terminology from [Kubernetes - Auth Methods | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/auth/kubernetes#how-to-work-with-short-lived-kubernetes-tokens) )  
Would also like to avoid “Use long-lived token as reviewer JWT”

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [July 29, 2025, 5:33pm UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975/4 "2025-07-29T17:33:58Z")

</div>

I think in that scenario, unless we have something coming I am not aware of, it looks like the recommendation for short lived tokens is JWT:

> **[Kubernetes - Auth Methods | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/auth/kubernetes#how-to-work-with-short-lived-kubernetes-tokens)**
>
> The Kubernetes auth method allows automated authentication of Kubernetes
> Service Accounts.

---

<div class="post-metadata">

**Author:** ![michaelkosir](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/michaelkosir/32/44585_2.png) [@michaelkosir](https://discuss.hashicorp.com/u/michaelkosir)\
**Post date:** [July 29, 2025, 6:15pm UTC](https://discuss.hashicorp.com/t/short-lived-kubernetes-service-account-tokens-vs-tokenreview/75975/5 "2025-07-29T18:15:44Z")

</div>

**Update:** As you are using HCP Vault, you are correct in that you cannot use the “local service account token” as it requires Vault to be deployed on the Kubernetes cluster.

You should be able to use a custom audience when configuring the Kubernetes auth method for: “_Use local service account token as the reviewer JWT_”.

I recently built a GitHub repo with various Kubernetes Auth method examples (in Terraform). In my [example](https://github.com/michaelkosir/vault-kubernetes-auth/blob/0dacf272daa56e9727ca7272c937a179359f4db2/local-token/vault-config.tf#L17) I was able to set `audience: vault`.

> **[GitHub - michaelkosir/vault-kubernetes-auth: This repository provides a demo of the various...](https://github.com/michaelkosir/vault-kubernetes-auth)**
>
> This repository provides a demo of the various authentication strategies when integrating Vault and Kubernetes.

However, I did have trouble setting a custom audience with: _“Use the Vault client’s JWT as the reviewer JWT”_. When configuring this option, the audience must be equal/contain the Kubernetes issuer URL.

As @jonathanfrappier mentioned, JWT is always another option!