apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    labels:
        app: cert-manager
        app.kubernetes.io/component: cert-manager
        app.kubernetes.io/instance: cert-manager
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: cert-manager
        helm.sh/chart: cert-manager-v1.4.0
    name: cert-manager-controller-certificatesigningrequests
rules:
    - apiGroups:
        - certificates.k8s.io
      resources:
        - certificatesigningrequests
      verbs:
        - get
        - list
        - watch
        - update
    - apiGroups:
        - certificates.k8s.io
      resources:
        - certificatesigningrequests/status
      verbs:
        - update
    - apiGroups:
        - certificates.k8s.io
      resourceNames:
        - issuers.cert-manager.io/*
        - clusterissuers.cert-manager.io/*
      resources:
        - signers
      verbs:
        - sign
    - apiGroups:
        - authorization.k8s.io
      resources:
        - subjectaccessreviews
      verbs:
        - create