Currently the lagoon-logging serviceaccount uses the overly broad view default clusterrole.
This should be reduced to only provide permissions on namespaces and pods similar to this example
Once we figure out which permissions are required, we should also probably send a PR upstream to document this.