According to https://docs.google.com/document/d/1D6Asw-dg1d6oii_ofThZiROnmvOl2XH8b559NnszCtk/edit# :

Q: Is there a way we could restrict it? On resourceName? If that makes any sense?

[David]If the SA that needs to be created, and eventually destroyed, is always created and destroyed in a known Namespace, this could work in a Role RBAC definition, instead of a ClusterRole RBAC one.

In this subtask, we want to investigate if it is possible to restrict the permissions to create/update/delete serviceaccounts to the namespace, instead oc giving this permission for the whole cluster