# CSRApproverRoleBindingTemplate instructs the csrapprover controller to
# automatically approve CSRs made by serviceaccount node-bootstrapper in openshift-machine-config-operator
# for client credentials.
#
# This binding should be removed to disable CSR auto-approval.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system-bootstrap-approve-node-client-csr
subjects:
- kind: ServiceAccount
  name: node-bootstrapper
  namespace: openshift-machine-config-operator
roleRef:
  kind: ClusterRole
  name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
  apiGroup: rbac.authorization.k8s.io