pub const ALLOW_ANY_SERVICE_ACCOUNT_ENV: &str = "BIND_ALLOW_ANY_SERVICEACCOUNT";Expand description
Environment variable that explicitly opts into allow-all authorization when the Kubernetes TokenReview feature is active but no namespace / service-account allowlist is configured.
See check_authorization_posture (A2): without an allowlist, every
authenticated ServiceAccount in the cluster is authorized for full DNS
control, so bindcar refuses to start in that posture unless this is set.