instruction: Create a Kubernetes ServiceAccount configuration with best practices
output: ```yaml
  apiVersion: v1
  kind: ServiceAccount
  metadata:
   name: build-robot
  EOF
  The name of a ServiceAccount object must be a valid
  DNS subdomain name.If you get a complete dump of the service account object, like this:kubectl get serviceaccounts/build-robot -o yaml
  The output is similar to this:apiVersion: v1
  kind: ServiceAccount
  metadata:
   creationTimestamp: 2019-06-16T00:12:34Z
   name: build-robot
   namespace: default
   resourceVersion: "272500"
   uid: 721ab723-13bc-11e5-aec2-42010af0021e
  You can use authorization plugins to
  set permissions on service accounts.To use a non-default service account, set the spec.serviceAccountName
  field of a Pod to the name of the ServiceAccount you wish to use.You can only set the serviceAccountName field when creating a Pod, or in a
  template for a new Pod. You cannot update the .spec.serviceAccountName field
  of a Pod that already exists.Note:The .spec.serviceAccount field is a deprecated alias for .spec.serviceAccountName.
  If you want to remove the fields from a workload resource, set both fields to empty explicitly
  on the pod template.CleanupIf you tried creating build-robot ServiceAccount from the example above,
  you can clean it up by running:kubectl delete serviceaccount/build-robot
  Manually create an API token for a ServiceAccountSuppose you have an existing service account named "build-robot" as mentioned earlier.You can get a time-limited API token for that ServiceAccount using kubectl:kubectl create token build-robot
  The output from that command is a token that you can use to authenticate as that
  ServiceAccount. You can request a specific token duration using the --duration
  command line argument to kubectl create token (the actual duration of the issued
  token might be shorter, or could even be longer).FEATURE STATE:
  Kubernetes v1.33 [stable] (enabled by default: true)Using kubectl v1.31 or later, it is possible to create a service
  account token that is directly bound to a Node:kubectl create token build-robot --bound-object-kind Node --bound-object-name node-001 --bound-object-uid 123...456
  The token will be valid until it expires or either the associated Node or service account are deleted.Note:Versions of Kubernetes before v1.22 automatically created long term credentials for
  accessing the Kubernetes API. This older mechanism was based on creating token Secrets
  that could then be mounted into running Pods. In more recent versions, including
  Kubernetes v1.33, API credentials are obtained directly by using the
  TokenRequest API,
  and are mounted into Pods using a
  projected volume.
  The tokens obtained using this method have bounded lifetimes, and are automatically
  invalidated when the Pod they are mounted into is deleted.You can still manually create a service account token Secret; for example,
  if you need a token that never expires. However, using the
  TokenRequest
  subresource to obtain a token to access the API is recommended instead.Manually create a long-lived API token for a ServiceAccountIf you want to obtain an API token for a ServiceAccount, you create a new Secret
  with a special annotation, kubernetes.io/service-account.name.kubectl apply -f - <<EOF
  ```