Why is `/var/run/secrets/kubernetes.io/serviceaccount/token` automatically generated?

General Discussions
1

This token is automatically generated when automountServiceAccountToken is enabled.
But I can’t understand why it is.

  1. This token has no role. So Developer should bind a proper role of the service account which is the owner of token, although it is generated automatically.

  2. It is confusing because since kubernetes 1.24, ServiceAccount cannot have its secret (token) automatically. We need to manually create the secret. But it has /var/run/secrets/kubernetes.io/serviceaccount/token automatically. It looks confusing.

Would anyone explain why it is designed like this?