On the negative hand, they are still bearer tokens. On the positive hand, they're valid in exactly one place and valid for 10 minutes and you can actively check their validity with the Kubernetes API Server
Tag: oauth2
Slowly patching all of the OAuth2/OpenID Connect clients in my k8s cluster to use RFC7523 JWT Bearer client auth with a projected service account token for auth as part of my mission to eliminate all long lived bearer secrets ( ˘ω˘ )