code: func (e *TokensController) removeSecretReference(saNamespace string, saName string, saUID types.UID, secretName string) error {
  	// We don't want to update the cache's copy of the service account
  	// so remove the secret from a freshly retrieved copy of the service account
  	serviceAccounts := e.client.CoreV1().ServiceAccounts(saNamespace)
  	serviceAccount, err := serviceAccounts.Get(saName, metav1.GetOptions{})
  	// Ignore NotFound errors when attempting to remove a reference
  	if apierrors.IsNotFound(err) {
  		return nil
  	}
  	if err != nil {
  		return err
  	}
  
  	// Short-circuit if the UID doesn't match
  	if len(saUID) > 0 && saUID != serviceAccount.UID {
  		return nil
  	}
  
  	// Short-circuit if the secret is no longer referenced
  	if !getSecretReferences(serviceAccount).Has(secretName) {
  		return nil
  	}
  
  	// Remove the secret
  	secrets := []v1.ObjectReference{}
  	for _, s := range serviceAccount.Secrets {
  		if s.Name != secretName {
  			secrets = append(secrets, s)
  		}
  	}
  	serviceAccount.Secrets = secrets
  	_, err = serviceAccounts.Update(serviceAccount)
  	// Ignore NotFound errors when attempting to remove a reference
  	if apierrors.IsNotFound(err) {
  		return nil
  	}
  	return err
  }
docs: // removeSecretReference updates the given ServiceAccount to remove a reference to the given secretName if needed.