// Only our plugin consumes this kubeconfig, and it resides in our owned rundir on the host node,
	// so we are good to simply write it out if our watched svcacct token changes.
	if err := writeKubeConfigFile(in.cfg); err != nil {
		cniInstalls.With(resultLabel.Value(resultCreateKubeConfigFailure)).Increment()
		return copiedFiles, fmt.Errorf("write kubeconfig: %v", err)
	}