Starting in 4.16 creating ServiceAccounts no longer associates a token, doc examples show a token associated to the SA and that should be updated to <none>
    

4.16
    

Always
    

    1. Install OCP 4.16
    2. create a namespace: "oc new-project <my-project>"
    3. create a service account : "oc create sa <my-sa>"
    

The current doc shows that when describing a SA it shows a token:
    

Name:                robot
Namespace:           project1
Labels:	             <none>
Annotations:	     <none>
Image pull secrets:  robot-dockercfg-qzbhb
Mountable secrets:   robot-dockercfg-qzbhb
Tokens:              robot-token-f4khf
Events:              <none>

No tokens should be associated by default after creating a SA
    

Name:                robot
Namespace:           project1
Labels:	             <none>
Annotations:	     <none>
Image pull secrets:  robot-dockercfg-qzbhb
Mountable secrets:   robot-dockercfg-qzbhb
Tokens:              <none>
Events:              <none>

Multiple pages show the same:
- https://docs.openshift.com/container-platform/4.16/authentication/using-service-accounts-in-applications.html#service-accounts-managing_using-service-accounts - Procedure Step 3
- https://docs.openshift.com/container-platform/4.16/authentication/understanding-and-creating-service-accounts.html#service-accounts-managing_understanding-service-accounts - Procedure Step 3
- https://docs.openshift.com/container-platform/4.16/networking/ingress-operator.html#nw-autoscaling-ingress-controller_configuring-ingress - Procedure Step 1