Value Statement

In ACM-12548, the ability to access content outside of the root policy namespace in a hub template will be allowed by specifying a service account. We need to account for this feature in the template-resolver CLI.

The output of this story is noticing when `spec.hubTemplateOptions.serviceAccountName` is set and not set the root policy namespace restrictions. This assumes the user's hub kubeconfig passed to the template-resolver CLI is of the service account.

Definition of Done for Engineering Story Owner (Checklist)

• The user is able to use the template-resolver CLI tool to test hub templates that access content outside of the namespace

Development Complete

• The code is complete.
• Functionality is working.
• Any required downstream Docker file changes are made.

Tests Automated

• [ ] Unit/function tests have been automated and incorporated into the
  build.
• [ ] 100% automated unit/function test coverage for new or changed APIs.

Secure Design

• [ ] Security has been assessed and incorporated into your threat model.

Multidisciplinary Teams Readiness

• [ ] Create an informative documentation issue using the Customer

Portal Doc template that you can access from [The Playbook](

https://docs.google.com/document/d/1YTqpZRH54Bnn4WJ2nZmjaCoiRtqmrc2w6DdQxe_yLZ8/edit#heading=h.9fvyr2rdriby),

and ensure doc acceptance criteria is met.

• Call out this sentence as it's own action:

• [ ] Link the development issue to the doc issue.

Support Readiness

• [ ] The must-gather script has been updated.