Is this not possible to do? According to the docs:
System administrators, use care when granting access to pod creation. A user granted permission to create pods (or controllers that create pods) in the namespace can: read all secrets in the namespace; read all config maps in the namespace; and impersonate any service account in the namespace and take any action the account could take. This applies regardless of authorization mode.
I would like for a user to be able to create a pod, but if they specify a ServiceAccount in the pod spec that has more permissions than they do, forbid the action. Even better, they shouldn't be allowed to specify a ServiceAccount, even if they have pod creation permissions, without an extra special permission.
Is there any way to achieve what I am looking for?