feat: add MachineAccount support to PolicyBinding subjects with mandatory namespace validation

[JoseSzycho]

Related to:

• Machine Account and Key Management enhancements#129

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: f858aed | Powered by Joggr

[scotwells]

Aren't machine keys cluster-scoped resources?

[JoseSzycho]

@scotwells MachineAccounts are namespaced resources https://github.com/datum-cloud/milo/blob/main/pkg/apis/iam/v1alpha1/machineaccount_types.go

[scotwells]

Is that by design? Their access is granted across the entire project so it's odd they would be namespaced.

[JoseSzycho]

@scotwells Is this way by design. That type was introduced 10 months ago.
#177

Do you want the MachineAccount type to be updated to be cluster scoped?

[scotwells]

I think cluster-scoped would make more sense right now given their access is granted across the entire project. We can introduce a namespaced equivalent if the use-case comes up.

[JoseSzycho]

@scotwells I'm doing the changes now. Do you think that I would face issues with the already created MachineAccounts in staging?

[scotwells]

@JoseSzycho they may disappear, unsure how the storage layer would like that.