Before we used the kubecfg certificate for everything. Mint one token for each service and push it around where it belongs.