Answer
Automate rotation of the service-account tokens/kubeconfigs stored in cluster Secrets, prefer short-lived credentials via cloud identity (IRSA, Workload Identity), and manage the Secrets through External Secrets so rotation happens centrally without manual edits. Monitor for expired credentials causing Unknown status.
Real-world example Cluster access uses workload identity so tokens are short-lived and rotate automatically without manual Secret edits.