StabilityLevel: metrics.ALPHA,
		},
	)

	// StaleTokensTotal is the number of stale projected tokens not refreshed on
	// client side.
	staleTokensTotal = metrics.NewCounter(
		&metrics.CounterOpts{
			Subsystem:      kubeServiceAccountSubsystem,
			Name:           "stale_tokens_total",
			Help:           "Cumulative stale projected service account tokens used",

			auditInfo := fmt.Sprintf("subject: %s, seconds after warning threshold: %d", public.Subject, secondsAfterWarn)
			audit.AddAuditAnnotation(ctx, "authentication.k8s.io/stale-token", auditInfo)
			staleTokensTotal.WithContext(ctx).Inc()
		} else {
			validTokensTotal.WithContext(ctx).Inc()
		}
	}

	var jti string
	if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountTokenJTI) {
		jti = public.ID