NewServiceAccount returns an admission.Interface implementation which limits admission of Pod CREATE requests based on the pod's ServiceAccount: 1.

DefaultAPITokenMountPath is the path that ServiceAccountToken secrets are automounted to.

DefaultServiceAccountName is the name of the default service account to set on pods which do not specify a service account.

EnforceMountableSecretsAnnotation is a default annotation that indicates that a service account should enforce mountable secrets.

PluginName is the name of this admission plugin.