code: func (s *serviceAccount) getReferencedServiceAccountToken(serviceAccount *corev1.ServiceAccount) (string, error) {
  	if len(serviceAccount.Secrets) == 0 {
  		return "", nil
  	}
  
  	tokens, err := s.getServiceAccountTokens(serviceAccount)
  	if err != nil {
  		return "", err
  	}
  
  	accountTokens := sets.NewString()
  	for _, token := range tokens {
  		accountTokens.Insert(token.Name)
  	}
  	// Prefer secrets in the order they're referenced.
  	for _, secret := range serviceAccount.Secrets {
  		if accountTokens.Has(secret.Name) {
  			return secret.Name, nil
  		}
  	}
  
  	return "", nil
  }
docs: // getReferencedServiceAccountToken returns the name of the first referenced secret which is a ServiceAccountToken for the service account