ALLOW_ANY_SERVICE_ACCOUNT_ENV

Constant ALLOW_ANY_SERVICE_ACCOUNT_ENV 

Source
pub const ALLOW_ANY_SERVICE_ACCOUNT_ENV: &str = "BIND_ALLOW_ANY_SERVICEACCOUNT";
Expand description

Environment variable that explicitly opts into allow-all authorization when the Kubernetes TokenReview feature is active but no namespace / service-account allowlist is configured.

See check_authorization_posture (A2): without an allowlist, every authenticated ServiceAccount in the cluster is authorized for full DNS control, so bindcar refuses to start in that posture unless this is set.