When running container preparation, an two identities are created for the client performing the preparation
The agent's
The workload's
Those identities should be cleaned afterwards to avoid SPIRE Server overloading and because they aren't useful anymore.
We could also remove the joinToken's identities (needs more work)
(This issue is a manual import from the private original repository)