An application needs a time-bound, audience-scoped ServiceAccount token rather than the legacy long-lived secret-based token. Which pattern should the developer use?
Select an answer to reveal the explanation.
Short Explanation
Projected SA tokens are temporary guest passes with an expiration time and audience. Mount a projected volume that asks for that token shape instead of clinging to old everlasting secrets. ca.crt alone is not your bearer credential.
Full Explanation
Projected volumes can request ServiceAccount tokens with expiration and audience binding for modern workload identity to the API. That pattern supersedes reliance on legacy long-lived SA secret tokens for many app use cases. ConfigMaps holding ca.crt, fictional ClusterRoles, or baking kubeconfigs into images are not the correct projected-token approach.