A web frontend never calls the Kubernetes API. How can its Pod avoid receiving an automatically mounted service account token?

1. Rename the default service account
2. Set automountServiceAccountToken: false on the Pod or its service account
3. Put the token in an environment variable instead
4. Set imagePullPolicy: Never