A Short-Lived Token for One Audience

exporter in partners runs as the ServiceAccount exporter. It never calls the Kubernetes API. It only uses a token to log in to Vault, which expects tokens issued for the audience https://vault.corp.lan.