tokenData := secret.Data[v1.ServiceAccountTokenKey]
	needsToken := len(tokenData) == 0

	return needsCA, needsNamespace, needsToken
}

// generateTokenIfNeeded populates the token data for the given Secret if not already set
func (e *TokensController) generateTokenIfNeeded(logger klog.Logger, serviceAccount *v1.ServiceAccount, cachedSecret *v1.Secret) ( /* retry */ bool, error) {

# Monitor

This package provides the ability to populate a `crd.Controller` dynamically via a function that provides
additional config. The monitor will acquire snapshots of additional changes and populate the `crd.Controller`
as needed.

## Creating a Monitor

To create a monitor, you should provide the `crd.Controller`, a polling interval, and
a function that returns `[]*model.Config`.

```golang
monitor := file.NewMonitor(

Go 1.23 changed the behavior of [X509KeyPair] and [LoadX509KeyPair]
to populate the [Certificate.Leaf] field of the returned [Certificate].

This defeats <<incremental_build.adoc#incremental_build,incremental build>> (i.e., `UP-TO-DATE` checks), but this issue is mitigated via use of the local build cache.
You might run a build on Branch A, which will populate the local cache.
You then switch to Branch B to conduct a code review, help a colleague, or address feedback on an open PR.
You then switch back to Branch A to continue your original work.

# The Module field should be populated even if there is an error loading the package.

env GO111MODULE=on

go list -e -f {{.Module}}
stdout '^mod.com$'

-- go.mod --
module mod.com

go 1.16

-- blah.go --
package blah

import _ "embed"

//go:embed README.md

<!--
### Example promoted
-->

## Fixed issues

<!--
This section will be populated automatically
-->

## Known issues

Known issues are problems that were discovered post-release that are directly related to changes made in this release.

<!--
This section will be populated automatically
-->

## External contributions

// the secret/configmap/pvc/node references in the pod and pv objects are named to indicate the connections between the objects.
// for example, secret0-pod0-node0 is a secret referenced by pod0 which is bound to node0.
// when populated into the graph, the node authorizer should allow node0 to access that secret, but not node1.

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: installation

releaseNotes:
- |

  // username contains the name of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string username = 2;

  // uid contains the uid of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;