How to categorize this issue?

/area security disaster-recovery robustness
/kind enhancement

What would you like to be added:
As of now users cannot configure the expiration of workload identity which is set to 6 hours.

Tokens are renewed when the token reaches ~80% of its lifespan.

It can be beneficial if operators of a Gardener system can configure the expiration for such tokens in order to mitigate the risk mentioned below.

Why is this needed:
In case the Garden cluster is not reachable for a longer period of time because of a datacenter failure or other force majeure reason the gardenlets would not be able to request workload identity tokens. This will lead to eventually blocking cloud operations such as provisioning of hardware, reconciliation of existing cloud infrastructure. That can be especially bad for example, for clusters that rely on scale up behaviour (provisioning of new nodes).

This risk is not present if users configure static credentials for Gardener to cloud infrastructure provider communication as the credentials never expire.