Scott Andrews

Rebased on main and added tests/doc.

> confirm it's definitely not being pulled in for other subsystems I'm exactly sure what you're looking for, so here's a few examples: ### no host access ```sh wasi-virt -o...

What if we drop it from `--allow-all` so that explicit opt-in is required. More options can be introduced in the future. The interface would still show up on the exports...

> I believe we don't ever include subsystems that aren't explicitly included, are you sure this would still be the case? I followed the pattern from environment. When the subsystem...

>Should Carvel Apps set `metadata.ownerReferences` on the App to include the referenced ServiceAccount with `blockOwnerDeletion` to prevent deleting the Service Account before the Carvel App is deleted? An App with...

An admittedly broad and slightly scary solution would be to use a dedicated ServiceAccount from the kapp-controller namespace that has permission to delete any resource in the cluster. When an...

@praveenrewar please reopen as #1208 was self described as a partial fix