KUBERNETES V1.35: A BETTER WAY TO PASS SERVICE ACCOUNT TOKENS TO CSI DRIVERS

Summary from the TLDR InfoSec newsletter

Kubernetes v1.35 added the ability for CSI drivers to opt-in to receiving service account tokens via the `secret` field in `NodePublishVolumeRequest`. Prior to this update, service account tokens were received via the `volume_context` field, which could lead to secrets being included in gRPC request logs if drivers did not implement custom sanitizer logic. To opt in to this feature, CSI drivers should implement the `serviceAccountTokenInSecrets' field as well as implement logic for backwards compatibility.