we need this on secret rotation here:

https://github.com/kubernetes/kubernetes/blob/2c1c0f3f7295e0d00651d6e30cfcda56239275e4/pkg/controller/serviceaccount/tokens_controller.go#L478-L481