Per-controller service accounts #208
Description
For the security-conscious, supporting per-controller service accounts is a nice way to ensure that individual controllers only are allowed to do what they need to do. Ideally, such controllers would each have their own manager and be run in separate pods, but practically, the performance benefits from shared caches, plus the desired to gradually refactor existing multi-controller managers makes the immediate jump to controller-per-pod infeasible.
We'd need to research what would be required to actually make this occur -- IIRC, it's not as "easy" to inject multiple SA tokens into a single pod, but should still be doable.
cc @cheftako