See issue hashicorp/vault#16222
We would like to replicate the change of the Secret Engine to this Auth engine, and allow specifying a label selector to define from which namespaces clients are allowed to authenticate with their ServiceAccounts.
FYI: @raffaelespazzoli