Change:
says about : Since 1.22 is released, the text shall not say what is planned to happen in the 1.22 versions, as if those were in the future.
/triage accepted /kind bug /assign
/language en

Discussion:
1. If the pod does not have a `ServiceAccount` set, it sets the `ServiceAccount` to `default`. 1. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it. <del> 1. It adds a `volume` to the pod which contains a token for API access if neither the ServiceAccount `automountServiceAccountToken` nor the Pod's `automountServiceAccountToken` is set to `false`. 1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`, if the previous step has created a volume for ServiceAccount token. 1. If the pod does not contain any `imagePullSecrets`, then `imagePullSecrets` of the `ServiceAccount` are added to the pod. </del> <ins> 1. It adds a `volume` to the pod which contains a token for API access if neither the ServiceAccount `automountServiceAccountToken` nor the Pod's `automountServiceAccountToken` is set to `false`. 1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`, if the previous step has created a volume for the ServiceAccount token. 1. If the pod does not contain any `imagePullSecrets`, then `imagePullSecrets` of the `ServiceAccount` are added to the pod. </ins> #### Bound Service Account Token Volume {{< feature-state for_k8s_version="v1.22" state="stable" >}} <del> The ServiceAccount admission controller will add the following projected volume instead of a Secret-based volume for the non-expiring service account token created by Token Controller. </del> <ins> The ServiceAccount admission controller will add the following projected volume instead of a Secret-based volume for the non-expiring service account token created by the Token controller. </ins> ```yaml - name: kube-api-access-<random-suffix>

This projected volume consists of three sources: <del> 1. A ServiceAccountToken acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and has kube-apiserver as the audience. 1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true. (This flag will be removed from --feature-gate arg in 1.22) 1. A DownwardAPI that references the namespace of the pod. </del> <ins> 1. A `serviceAccountToken` acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and it has its audience set to match the audience of the `kube-apiserver`. 1. A `configMap` containing a CA bundle used for verifying connections to the kube-apiserver. 1. A `downwardAPI` that references the namespace of the pod. </ins> See more details about [projected volumes](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).

A ServiceAccount controller manages the ServiceAccounts inside namespaces, and ensures a ServiceAccount named "default" exists in every active namespace.