Does Gardener automatically revoke or rotate expired OIDC credentials in shoot kubeconfigs?

Goal

I want to operate Gardener-managed clusters with least-privilege authentication: OIDC-issued, short-lived tokens mapped to narrowly scoped Kubernetes RBAC roles, with expired or stale credentials becoming unusable without manual cleanup.

Constraints and Uncertainty

My understanding is that Gardener's OIDC integration lets token claims map to RBAC bindings, and that kubeconfigs can carry credentials with an expiration time, after which the API server rejects requests. What I cannot confirm from the documentation is whether Gardener itself plays any active role in the credential lifecycle — for example, revoking tokens early, forcing rotation, or enforcing that issued credentials stay below a maximum lifetime or privilege level — or whether all of that is delegated entirely to the external identity provider and cluster admin processes.

I am also unsure whether there is any supported way to express per-cluster or per-user privilege ceilings centrally, rather than relying on each team to craft minimal RBAC bindings on their own. Assume a current Gardener release as of late 2026; if behavior differs by version, that distinction matters.

Questions

• Does Gardener provide any built-in mechanism to revoke or rotate OIDC credentials before or at expiry, or is rejection of expired tokens by the API server the only enforcement?
• Is there a documented configuration surface for enforcing least-privilege token scopes or maximum credential lifetimes across clusters?
• If neither exists, is delegating rotation and scope enforcement to the external identity provider the intended operating model?