openshift-cherrypick-robot
diff --git a/‎pkg/auth/oauth/registry/tokenauthenticator.go
+3 b/‎pkg/auth/oauth/registry/tokenauthenticator.go
+3
diff --git a/‎vendor/k8s.io/kubernetes/pkg/serviceaccount/jwt.go
+8 b/‎vendor/k8s.io/kubernetes/pkg/serviceaccount/jwt.go
+8
@@ -40,6 +40,9 @@ func (a *TokenAuthenticator) AuthenticateToken(value string) (kuser.Info, bool,
 	if token.CreationTimestamp.Time.Add(time.Duration(token.ExpiresIn) * time.Second).Before(time.Now()) {
 		return nil, false, ErrExpired
 	}
+	if token.DeletionTimestamp != nil {
+		return nil, false, ErrExpired
+	}
 
 	u, err := a.users.GetUser(ctx, token.UserName, &metav1.GetOptions{})
 	if err != nil {
Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,9 @@ func (a *TokenAuthenticator) AuthenticateToken(value string) (kuser.Info, bool,`
`40`	`40`	`if token.CreationTimestamp.Time.Add(time.Duration(token.ExpiresIn) * time.Second).Before(time.Now()) {`
`41`	`41`	`return nil, false, ErrExpired`
`42`	`42`	`}`
	`43`	`+ if token.DeletionTimestamp != nil {`
	`44`	`+ return nil, false, ErrExpired`
	`45`	`+ }`
`43`	`46`
`44`	`47`	`u, err := a.users.GetUser(ctx, token.UserName, &metav1.GetOptions{})`
`45`	`48`	`if err != nil {`