<p><code>kubectl explain serviceaccount.secrets</code> describes ServiceAccount Secrets as the secrets allowed to be used by Pods running using this ServiceAccount, but what effect does adding a Secret name to this list have?</p>
<p>The ServiceAccount token Secret (which is automatically added to this list) gets automatically mounted as a volume into all containers in a Pod running using this ServiceAccount (as long as the ServiceAccount admission controller is enabled), but what happens for other secrets?</p>

dippynark
<p>It holds the name of all secrets containing tokens for that SA so when the controller goes to rotate things, it knows where to find them.</p>
