GKE sometimes gives short-lived tokens when your refresh time is too close to expiry.

**My scheduled monitor triggers the token refresh (4 minutes before the old token expires).
**
I think you should make it to 10 mins.