A service account has automount disabled, and the init job that fetches configuration from the cluster API never receives credentials

Main workload logic is fine, but the initialization phase assumes access to a token that policy has intentionally removed.