instruction: Create a Kubernetes ServiceAccount configuration with best practices
output: ```dockerfile
  from automatically creating these tokens for
  ServiceAccounts. LegacyServiceAccountTokenNoAutoGeneration is enabled
  by default; in other words, Kubernetes does not create these tokens.
  
  Note: For applications running outside your Kubernetes cluster, you might be considering
  creating a long-lived ServiceAccount token that is stored in a Secret. This allows authentication, but the Kubernetes project recommends you avoid this approach.
  Long-lived bearer tokens represent a security risk as, once disclosed, the token
  can be misused. Instead, consider using an alternative. For example, your external
  application can authenticate using a well-protected private key and a certificate,
  or using a custom mechanism such as an authentication webhook that you implement yourself.
  You can also use TokenRequest to obtain short-lived tokens for your external application.
  
  Restricting access to Secrets
  Kubernetes provides an annotation called kubernetes.io/enforce-mountable-secrets
  that you can add to your ServiceAccounts. When this annotation is applied,
  the ServiceAccount's secrets can only be mounted on specified types of resources,
  enhancing the security posture of your cluster.
  You can add the annotation to a ServiceAccount using a manifest:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
   annotations:
   kubernetes.io/enforce-mountable-secrets: "true"
   name: my-serviceaccount
   namespace: my-namespace
  When this annotation is set to "true", the Kubernetes control plane ensures that
  the Secrets
  ```