The service account token one must have `serviceAccountName` specified in order to be successfully validated. The PV duplicate example can only refer to an existing volume.