The API docs for status.audiences mention

a TokenReview returns an empty status.audience field where status.authenticated is "true", the token is valid against the audience of the Kubernetes API server.

Can we be reasonably sure that all supported kube api servers will actually populate the field?

If Kubernetes doesn't guarantee that the audiences field is always defined, we should prioritize parsing the JWT token directly, as this ensures we know the field is set. My concern is that, since the documentation doesn't mandate it, there might have been a version in the past that didn't include the audiences field, or a future version might omit it. To safeguard against this, we should handle the token by unmarshaling it ourselves.

You can use jwt/v4 package for that

import "github.com/golang-jwt/jwt/v4"
...
p := jwt.NewParser()
	claims := &jwt.RegisteredClaims{}
	_, _, err := p.ParseUnverified(token, claims)
	if err != nil {
		panic(err.Error())
	}

	fmt.Println(claims.Audiences)
}

(there is a (go-jose/v3/*jwt.JSONWebToken).UnsafeClaimsWithoutVerification method fyi)

I changed to parsing our own token without validating. The missing audience thing is for legacy Kubernetes tokens (which are in theory still supported, but we do reject them for kube >= 1.21).

So basically:

• if there's an audience on our token we know this is a modern kube and can set the audience
• if there are no audience on our token, this is an old kube and we do the review without specifying audience, as we were doing before