code: func NewServiceAccount() *serviceAccount {
  	return &serviceAccount{
  		Handler: admission.NewHandler(admission.Create),
  		// TODO: enable this once we've swept secret usage to account for adding secret references to service accounts
  		LimitSecretReferences: false,
  		// Auto mount service account API token secrets
  		MountServiceAccountToken: true,
  		// Reject pod creation until a service account token is available
  		RequireAPIToken: true,
  
  		generateName: names.SimpleNameGenerator.GenerateName,
  
  		featureGate: utilfeature.DefaultFeatureGate,
  	}
  }
docs: // NewServiceAccount returns an admission.Interface implementation which limits admission of Pod CREATE requests based on the pod's ServiceAccount:
  // 1. If the pod does not specify a ServiceAccount, it sets the pod's ServiceAccount to "default"
  // 2. It ensures the ServiceAccount referenced by the pod exists
  // 3. If LimitSecretReferences is true, it rejects the pod if the pod references Secret objects which the pod's ServiceAccount does not reference
  // 4. If the pod does not contain any ImagePullSecrets, the ImagePullSecrets of the service account are added.
  // 5. If MountServiceAccountToken is true, it adds a VolumeMount with the pod's ServiceAccount's api token secret to containers