code: func determineEffectiveSecurityContext(config *runtimeapi.ContainerConfig, container *v1.Container, pod *v1.Pod) {
  	var containerCredSpec string
  
  	containerGMSAPodAnnotation := container.Name + gMSAContainerSpecPodAnnotationKeySuffix
  	if pod.Annotations[containerGMSAPodAnnotation] != "" {
  		containerCredSpec = pod.Annotations[containerGMSAPodAnnotation]
  	} else if pod.Annotations[gMSAPodSpecPodAnnotationKey] != "" {
  		containerCredSpec = pod.Annotations[gMSAPodSpecPodAnnotationKey]
  	}
  
  	if containerCredSpec != "" {
  		if config.Annotations == nil {
  			config.Annotations = make(map[string]string)
  		}
  		config.Annotations[GMSASpecContainerAnnotationKey] = containerCredSpec
  	} else {
  		// the annotation shouldn't be present, but let's err on the side of caution:
  		// it should only be set here and nowhere else
  		delete(config.Annotations, GMSASpecContainerAnnotationKey)
  	}
  }
docs: // determineEffectiveSecurityContext determines the effective GMSA credential spec and, if any, copies it to the container's
  // GMSASpecContainerAnnotationKey annotation.