# https://github.com/openshift/cluster-kube-controller-manager-operator/blob/release-4.9/bindata/assets/kube-controller-manager/csr_approver_clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: system:openshift:controller:cluster-csr-approver-controller
rules:
  - apiGroups:
    - certificates.k8s.io
    resources:
    - certificatesigningrequests
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - certificates.k8s.io
    resources:
    - certificatesigningrequests/approval
    verbs:
    - update
  - apiGroups:
    - certificates.k8s.io
    resources:
    - signers
    resourceNames:
    - kubernetes.io/kube-apiserver-client
    verbs:
    - approve
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
      - update