Restrict Auto-Mount of Service Account Tokens in Service Account

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-sa-automount-sa-token
  annotations:
    policies.kyverno.io/title: Restrict Auto-Mount of Service Account Tokens in Service Account
    policies.kyverno.io/category: Security
    kyverno.io/kyverno-version: 1.11.1
    kyverno.io/kubernetes-version: "1.27"
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Secret,ServiceAccount
    policies.kyverno.io/description: "Kubernetes automatically mounts ServiceAccount credentials in each ServiceAccount. The ServiceAccount may be assigned roles allowing Pods to access API resources. Blocking this ability is an extension of the least privilege best practice and should be followed if Pods do not need to speak to the API server to function. This policy ensures that mounting of these ServiceAccount tokens is blocked.      "
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: validate-sa-automountServiceAccountToken
      match:
        any:
          - resources:
              kinds:
                - ServiceAccount
      validate:
        message: ServiceAccounts must set automountServiceAccountToken to false.
        pattern:
          automountServiceAccountToken: false