Multi-tenancy lockdown. v0.38.2

[sst1xx]

Hi,
guys could you please elaborate on more for using default-service-account for multi-tenancy lockdown?

It seems that current settings for flux version 0.38.2 code-snippet cause an error:
$ k get kustomization test-flux-system 2m17s False CustomResourceDefinition/alerts.notification.toolkit.fluxcd.io dry-run failed, reason: Forbidden, error: customresourcedefinitions.apiextensions.k8s.io "alerts.notification.toolkit.fluxcd.io" is forbidden: User "system:serviceaccount:test-flux-system:default" cannot patch resource "customresourcedefinitions" in API group "apiextensions.k8s.io" at the cluster scope

Also during bootstrap I received an error:
✗ client rate limiter Wait returned an error: context deadline exceeded

The most strange thing that those settings have been used with 0.36 and all was OK. I tested it locally on

CRC version: 2.9.0+589ab2cd
OpenShift version: 4.11.3
Podman version: 4.2.0

Thanks