Which mechanism handles token expiration for static Kubernetes service account credentials in Argo CD?

Credential Lifecycle Management

Argo CD implements least-privilege access by mapping external identity provider groups to internal roles via RBAC policies. For OIDC-based authentication, the API server validates the exp claim on every request, resulting in an HTTP 401 response once the token expires, which necessitates a client-side re-authentication flow.

Static Token Persistence

Unlike OIDC tokens, static Kubernetes service account tokens used for CI/CD integration do not possess a built-in expiration mechanism within the Argo CD authentication layer. This creates a discrepancy in how the system handles credential validity between dynamic identity providers and static secrets.

Given that the server does not natively rotate or expire these static tokens, there is uncertainty regarding the optimal way to enforce a time-bound least-privilege policy for non-human identities without external orchestration.

• Does Argo CD provide a native configuration to set a TTL for static service account tokens?
• How can an administrator ensure that static credentials are automatically invalidated without manually deleting the underlying Kubernetes secret?