Include serviceaccount namespace

[bergerx]

TL;DR: Service accounts are namespaced, they are not like users and groups which are not namespaced. Currently the SUBJECT field in output works fine for users and groups but not for service accounts. For service accounts it only has "ServiceAccount/" which should be something like "ServiceAccount//".

As an example, in our clusters we have a per-namespace "tiller" serviceaccount and each with different set of bindings. They also have rolebindings in other namespaces.

Here is an example case:
We have a tiller service account in dev, qa and demo namespaces. Qa and demo also has explicit access in a monitoring namespace.

Currently when we run rbac-lookup tiller -o wide it prints out RoleBindings for tiller serviceaccounts in any namespace, and its not possible to distinguish which service account has which role.

Example output (mind duplicate line at the beginning, thats not a copy paste mistake):

$ rbac-lookup tiller -o wide
SUBJECT                  SCOPE                    ROLE                              SOURCE
ServiceAccount/tiller    application-monitoring   Role/application-monitoring       RoleBinding/tiller-can-application-monitoring
ServiceAccount/tiller    application-monitoring   Role/application-monitoring       RoleBinding/tiller-can-application-monitoring
ServiceAccount/tiller    dev                      ClusterRole/admin                 RoleBinding/tiller-can-admin
ServiceAccount/tiller    dev                      ClusterRole/prometheus-operator   RoleBinding/tiller-can-prometheus-operator
ServiceAccount/tiller    qa                       ClusterRole/admin                 RoleBinding/tiller-can-admin
ServiceAccount/tiller    qa                       ClusterRole/prometheus-operator   RoleBinding/tiller-can-prometheus-operator

Here is what i'd expect to see:

$ rbac-lookup tiller -o wide
SUBJECT                       SCOPE                    ROLE                              SOURCE
ServiceAccount/qa:tiller      application-monitoring   Role/application-monitoring       RoleBinding/tiller-can-application-monitoring
ServiceAccount/demo:tiller    application-monitoring   Role/application-monitoring       RoleBinding/tiller-can-application-monitoring
ServiceAccount/dev:tiller     dev                      ClusterRole/admin                 RoleBinding/tiller-can-admin
ServiceAccount/dev:tiller     dev                      ClusterRole/prometheus-operator   RoleBinding/tiller-can-prometheus-operator
ServiceAccount/qa:tiller      qa                       ClusterRole/admin                 RoleBinding/tiller-can-admin
ServiceAccount/qa:tiller      qa                       ClusterRole/prometheus-operator   RoleBinding/tiller-can-prometheus-operator
ServiceAccount/demo:tiller    demo                     ClusterRole/admin                 RoleBinding/tiller-can-admin
ServiceAccount/demo:tiller    demo                     ClusterRole/prometheus-operator   RoleBinding/tiller-can-prometheus-operator

[sudermanjr]

@bergerx I think this is a great idea. We will definitely put this on our list of TODO. Thanks!