apiVersion: v1
kind: Pod
metadata:
  name: sandbox
  labels:
    service: sandbox-service
spec:
  containers:
    - name: nginx
      image: nginx
  serviceAccountName: new-service-account
  automountServiceAccountToken: false #do not mount the default service account token