Tokens generated via token.kubevirt.io have no mechanism for revocation. 
For now, If we generate a one-time token using curl and no longer need it, we simply discard it or let it expire but if they are still valid and get leaked, that brings risk. There is no direct way for now to manage/revoke/delete such token. Removing sa every time could not be a feasible solution.

4.15

always

1.
2.
3.