Hi, Is it possible to apply globalRole to a limited set of downstream clusters? My use case is as follows: • We have a few downstream clusters for various services. Some host CNPG clusters only, while others host ArgoCD apps. (not exactly that but it gives the idea) • We have an IAC cluster with a few operators. One watches for a CRD called 'cnpgCluster' and deploys a real CNPG cluster on the targeted downstream cluster. The same applies to the ArgoCD operator, which watches for an "app" CRD and creates applications on the downstream clusters. • Each operator has its own roleTemplate and globalRole. It works well, but the CNPG operator has access to downstream clusters dedicated to other services. Ideally, we could bind the globalRole and the cluster using a labelSelector. Another solution would be to deploy a ClusterRole on the local cluster and a CRTB per downstream cluster, but this would require more automation when provisioning a new cluster.