Constant SERVICE_ACCOUNT_TOKEN_PATH 

pub const SERVICE_ACCOUNT_TOKEN_PATH: &str = "/var/run/secrets/kubernetes.io/serviceaccount/token";

Path to the default ServiceAccount token file in Kubernetes pods.

This token carries the API server’s default audience. bindcar 0.7.0 enforces status.audiences on the TokenReview response, so this default token is rejected by bindcar unless it also carries the bindcar audience. Prefer BINDCAR_TOKEN_PATH (an explicitly-projected token with audience: bindcar); this path is kept only as a backward-compatible fallback for clusters that have not yet projected the audience-scoped token.