Long-lived broker SA bearer token may be placed directly in the Submariner CR .spec field. Per the broker shared-trust findings, possession of any broker token grants full mesh control (CRUD on all endpoints, secrets, and endpointslices in the broker namespace). Same etcd-cleartext / kubectl get / must-gather exposure as the PSK cleartext finding.

Source: Project Glasswing AI-SAST audit of submariner-io/submariner-operator.
Finding ID: FIND-004
Assurance: execution_proven