I'm trying to create a service account with either no secrets or just secret I specify and the kubelet always seems to be attaching the default secret no matter what.

Service Account definition

apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  name: test
secrets:
  - name: default-token-4pbsm

Submit

$ kubectl create -f service-account.yaml
serviceaccount "test" created

Get

$ kubectl get -o=yaml serviceaccount test
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  creationTimestamp: 2017-05-30T12:25:30Z
  name: test
  namespace: default
  resourceVersion: "31414"
  selfLink: /api/v1/namespaces/default/serviceaccounts/test
  uid: 122b0643-4533-11e7-81c6-42010a8a005b
secrets:
- name: default-token-4pbsm
- name: test-token-5g3wb

As you can see above the test-token-5g3wb was automatically created & attached to the service account without me specifying it.

As far as I understand the automountServiceAccountToken only affects mounting of those secrets to a pod which was launched via that service account. (?)

Is there any way I can avoid that default secret being ever created and attached?

Versions

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"d6f433224538d4f9ca2f7ae19b252e6fcb66a3ae", GitTreeState:"clean", BuildDate:"2017-05-19T20:41:24Z", GoVersion:"go1.8.1", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"d6f433224538d4f9ca2f7ae19b252e6fcb66a3ae", GitTreeState:"clean", BuildDate:"2017-05-19T18:33:17Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}