title: Unexpected token showing up for custom ServiceAccount
body: <p>I have set up a custom ServiceAccount with a ClisterRole binding. I can see the account and it's ca.crt, namespace and token.</p>
  <p>Definition:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    labels:
      app: my-app
    name: my-app-svcaccount
    namespace: my-app-ns
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: my-app-svcaccount
    namespace: my-app-ns
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin
  subjects:
  - kind: ServiceAccount
    name: my-app-svcaccount
    namespace: my-app-ns
  </code></pre>
  <p>In my pod spec I have specified the serviceAccountName and expect it to be mounted into the pod. When I go into the pod, I see the /run/secrets/kubernetes.io/serviceaccount/ folder as expected.</p>
  <p>Definition within deployment pod spec:</p>
  <pre><code>  serviceAccountName: my-app-svcaccount
  </code></pre>
  <p>However, the token in that folder is not the one from my serviceAccountName, nor of any other secret in my namespace. I'm pulling my hair as to what could be the reason for this. Where can this token be coming from and how can I find out where the incorrect token is coming from?</p>
  <p>What I can see is that the mounted volume name does not refer to the ServiceAccount name, but rather to kube-api-access-... which is unknown to me where it's coming from.</p>
  <p>Thanks in advance.</p>