Some API calls are not working when keycloak-owned openshift token expires.

Have CRW installed with OAuth enabled Interact with CRW with some user. Don't use CRW with that user for more than a day (default openshift token expiration time) After that day, obtain keycloak token for that user: $ ACCESS_TOKEN=$(curl -k --location --request POST 'https://<KEYCLOAK_ENDPOINT>/auth/realms/codeready/protocol/openid-connect/token' \ --data-urlencode 'client_id=codeready-public' \ --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \ --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:access_token' \ --data-urlencode 'subject_issuer=openshift-v4' \ --data-urlencode 'subject_token=<User's openshift token>' |jq -r .access_token) And using that token try to for example start workspace from devfile: $ curl -k -X POST -H "Content-type: application/json" -H "Authorization: Bearer $ACCESS_TOKEN" -d '{"apiVersion":"1.0.0","metadata":{"name":"wksp-test-ZPgDE"}}' -H "Accept: application/json, */*" https://codeready-openshift-workspaces.apps.ocp47-load.crw-qe.com/api/workspace/devfile Expected: Workspace is created Actual: {"message":"Error occurred when tried to list all available projects. Cause: Failure executing: GET at: https://172.30.0.1/apis/project.openshift.io/v1/projects?labelSelector\u003dapp.kubernetes.io%2Fpart-of%3Dche.eclipse.org%2Capp.kubernetes.io%2Fcomponent%3Dworkspaces-namespace. Message: Unauthorized! Configured service account doesn\u0027t have access. Service account may have been revoked. Unauthorized."}