// still used by pods
			continue
		}

		invalidSince := secret.Labels[serviceaccount.InvalidSinceLabelKey]
		// If the secret has not been labeled with invalid since date or the label value has invalid format, update the invalidSince label with the current date value.
		_, err = time.Parse(dateFormat, invalidSince)
		if err != nil {
			invalidSince = now.Format(dateFormat)

		}

		// Track secret-based long-lived service account tokens and add audit annotations and metrics.
		autoGenerated := false

		// Check if the secret has been marked as invalid
		if invalidSince := secret.Labels[InvalidSinceLabelKey]; invalidSince != "" {
			audit.AddAuditAnnotation(ctx, "authentication.k8s.io/legacy-token-invalidated", secret.Name+"/"+secret.Namespace)
			invalidatedAutoTokensTotal.WithContext(ctx).Inc()

		},
	}
}

func patchContent(namespace, name, invalidSince string, uID types.UID) []byte {
	patch, _ := json.Marshal(applyv1.Secret(name, namespace).WithUID(uID).WithLabels(map[string]string{serviceaccount.InvalidSinceLabelKey: invalidSince}))
	return patch
}

func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
	testcases := map[string]struct {