When trying to migrate the existing Clients/Exporters from the community server to a new cluster, we found the issue that our internal authenticator uses the format:
"client:{namespace}:{name}:{uid}"
this is not portable, because the object uid cannot be assigned on creation, and it's something internally generated by k8s/etcd.