info.Extra[NodeUIDKey] = []string{sa.NodeUID}
		}
	}

	return info
}

// CredentialIDForJTI converts a given JTI string into a credential identifier for use in a
// users 'extra' info.
func CredentialIDForJTI(jti string) string {
	if len(jti) == 0 {
		return ""
	}
	return "JTI=" + jti
}

// IsServiceAccountToken returns true if the secret is a valid api token for the service account

			staleTokensTotal.WithContext(ctx).Inc()
		} else {
			validTokensTotal.WithContext(ctx).Inc()
		}
	}

	var jti string
	if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountTokenJTI) {
		jti = public.ID
	}
	return &apiserverserviceaccount.ServiceAccountInfo{
		Namespace:    private.Kubernetes.Namespace,
		Name:         private.Kubernetes.Svcacct.Name,

		},
	)
}

func TestCreate_Token_SetsCredentialIDAuditAnnotation(t *testing.T) {
	storage, server := newStorage(t)
	defer server.Terminate(t)
	defer storage.Store.DestroyFunc()

	// Enable JTI feature
	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ServiceAccountTokenJTI, true)

	ctx := context.Background()
	// Create a test service account

| exp        | _integer_      | The token expiration time.                                                                                                                                                              |
| jti        | _string_       | Unique identifier for the JWT token.                                                                                                                                                    |

			featureNodeBinding: true,
			// really fast
			exp: 0,
			// nil audience
			aud: nil,
			err: "internal error, token can only be bound to one object type",
		},
		{
			// ensure JTI is set
			sa: sa,
			// enable setting JTI feature
			featureJTI: true,
			// really fast
			exp: 0,
			// nil audience
			aud: nil,

			sc: &jwt.Claims{
				Subject:   "system:serviceaccount:myns:mysvcacct",

- Node information is now embedded into Pod-bound service account tokens as additional metadata. The 'JTI' field is set in issued service account tokens, and this information is embedded as `authentication.kubernetes.io/credential-id` in the user's ExtraInfo. ([#123135](https://github.com/kubernetes/kubernetes/pull/123135), [@munnerz](https://github.com/munnerz))...

- `kube-apiserver` added: