staleTokensTotal.WithContext(ctx).Inc()
		} else {
			validTokensTotal.WithContext(ctx).Inc()
		}
	}

	var jti string
	if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountTokenJTI) {
		jti = public.ID
	}
	return &apiserverserviceaccount.ServiceAccountInfo{
		Namespace:    private.Kubernetes.Namespace,
		Name:         private.Kubernetes.Svcacct.Name,

			featureNodeBinding: true,
			// really fast
			exp: 0,
			// nil audience
			aud: nil,
			err: "internal error, token can only be bound to one object type",
		},
		{
			// ensure JTI is set
			sa: sa,
			// enable setting JTI feature
			featureJTI: true,
			// really fast
			exp: 0,
			// nil audience
			aud: nil,

			sc: &jwt.Claims{
				Subject:   "system:serviceaccount:myns:mysvcacct",