rg --files-without-match 'ownerRefer|norman' - ignore endpoints which have the same name as a service (no matter whether service is filtered or not) - ignore stuff with ownerReference - ignore stuff with "norman" creator - ignore default serviceaccount - for every serviceaccount, check global policy..