When I do kubectl get secret my-sa-token-lr928 -o yaml, there is a base64 string(JWT A) value for data.token. There are other fields too, like data.ca.crt in this returned secret.

When I use projected volume with source serviceAccountToken and read the file, there is another not-base64 string(JWT B).

cat /var/run/secrets/some.directory/serviceaccount/token

Why JWT A and JWT B strings are different? The most notable difference is in JWT B iss i.e my issuer url (--service-account-issuer) and in JWT A iss i.e my issuer url iskubernetes/serviceaccount`. Aren't they both JWT service account tokens? If not then what Kubernetes API object they actually represent?

Following is my Kubernetes Pod spec (edited for brevity)

apiVersion: v1
kind: Pod
metadata:
  annotations:
  labels:
    app: sample-app
  name: sample-pod-gwrcf
spec:
  containers:
    image: someImage
    name: sample-app-container
    resources: {}
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: my-sa-token-lr928
      readOnly: true
    - mountPath: /var/run/secrets/some.directory/serviceaccount
      name: good-token
      readOnly: true
  serviceAccount: my-sa
  serviceAccountName: my-sa
  terminationGracePeriodSeconds: 30
  volumes:
  - name: good-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: my.audience.com
          expirationSeconds: 86400
          path: token
  - name: my-sa-token-lr928
    secret:
      defaultMode: 420
      secretName: my-sa-token-lr928