Unable to add extra SA with NS in the bundle manifest

Bug Report

Unable to define a namespace (ns) for an extra ServiceAccount shipped on the bundle.

What did you do?

Following the steps to reproduce the issue scenario with testdata/go/v3/memcached/

1. Create the testdata/go/v3/memcached-operator/config/rbac/service_account_pod.yaml:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-pod-service-account
  # If we fixed here the ns then the following error is faced with operator-sdk bundle validate
  # operator-sdk bundle validate ./bundle
  # ERRO[0000] Error: Value my-pod-service-account: error validating object: metadata.namespace: Forbidden: not allowed on this type. &{map[apiVersion:v1 kind:ServiceAccount metadata:map[name:my-pod-service-account namespace:other-ns]]}
  namespace: other-ns 

2 - Add the extra SA to: (testdata/go/v3/memcached-operator/config/rbac/kustomization.yaml)

...
- auth_proxy_role.yaml
- auth_proxy_role_binding.yaml
- auth_proxy_client_clusterrole.yaml
- service_account_pod.yaml 

3 - Run make bundle. That will fail when we run the command operator-sdk bundle validate

What did you expect to see?

operator-sdk bundle validate does not return an error when a specific ns for the service account is informed.

What did you see instead? Under which circumstances?

ERRO[0000] Error: Value my-pod-service-account: error validating object: metadata.namespace: Forbidden: not allowed on this type. &{map[apiVersion:v1 kind:ServiceAccount metadata:map[name:my-pod-service-account namespace:other-ns]]}

Environment

$ operator-sdk version

• 1.19.0

Possible Solution

To solve this issue is required to change the spec validations in the operator-framework/api and then bump it to SDK.

Additional context

If the namespace added to the extra SA does not exist then, OLM will be unable to install the Operator.

That means that if an Operator Author tries to do that to ship the Operator in any image where its CI checks if the project is at least deployable on the cluster with OLM then, it will fail if when the ns informed, is not created by default on the k8s vendor. So, this configuration will only work when:

• The ns informed already exist on the cluster before OLM try to install it
• To publish in OCP catalog or any index catalog used by it, if the ns informed is an ns created by default on the cluster.

OLM bundles do not accept we add an ns manifest to allow the specific ns to be created when OLM applies all to install the Operator on the cluster.

Reproduce the failure from testdata/go/v3/memcached-operator by adding service_account_pod.yaml to config/rbac/kustomization.yaml and running make bundle. Then inspect the relevant validation in operator-framework/api; done means bundle validation accepts the extra ServiceAccount with metadata.namespace set to other-ns without breaking the bundle workflow.