code: func applyGMSAConfig(config *runtimeapi.ContainerConfig, createConfig *dockertypes.ContainerCreateConfig, cleanupInfo *containerCleanupInfo) error {
  	credSpec := config.Annotations[kuberuntime.GMSASpecContainerAnnotationKey]
  	if credSpec == "" {
  		return nil
  	}
  
  	valueName, err := copyGMSACredSpecToRegistryValue(credSpec)
  	if err != nil {
  		return err
  	}
  
  	if createConfig.HostConfig == nil {
  		createConfig.HostConfig = &dockercontainer.HostConfig{}
  	}
  
  	createConfig.HostConfig.SecurityOpt = append(createConfig.HostConfig.SecurityOpt, "credentialspec=registry://"+valueName)
  	cleanupInfo.gMSARegistryValueName = valueName
  
  	return nil
  }
docs: // applyGMSAConfig looks at the kuberuntime.GMSASpecContainerAnnotationKey container annotation; if present,
  // it copies its contents to a unique registry value, and sets a SecurityOpt on the config pointing to that registry value.
  // We use registry values instead of files since their location cannot change - as opposed to credential spec files,
  // whose location could potentially change down the line, or even be unknown (eg if docker is not installed on the
  // C: drive)
  // When docker supports passing a credential spec's contents directly, we should switch to using that
  // as it will avoid cluttering the registry - there is a moby PR out for this:
  // https://github.com/moby/moby/pull/38777