Can't have both global and non-global service account rules

[Hamish]

In the k8s spec, service accounts are defined like:

kubernetesResources:
  serviceAccounts:
    - name: nginx-ingress
      automountServiceAccountToken: true
      global: true
      rules: []

There are cases where you need the equivalent of a Role and a ClusterRole attached to a single ServiceAccount (my use case here is porting the nginx-ingress helm chart).

To illustrate the issue, here is a potential fix to the spec:

kubernetesResources:
  serviceAccountRules:
    - name: nginx-ingress-cluster-rules
      global: true
      rules: []
    - name: nginx-ingress-rules
      global: false
      rules: []
  serviceAccounts:
    - name: nginx-ingress
      automountServiceAccountToken: true
      rules:
        - nginx-ingress-cluster-rules
        - nginx-ingress-rules

Which would create a ClusterRole, ClusterRoleBinding, Role, RoleBinding, and the ServiceAccount.
A variation on this would be to have something like kubernetesResources.serviceAccounts.rules AND kubernetesResources.serviceAccounts.globalRules

[Yang Kelvin Liu (kelvin.liu)]

https://github.com/juju/juju/pull/11293 will land to 2.8 to add this feature for k8s spec v3.