metadata:
  name: gce:beta:kubelet-certificate-rotation
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups:
  - "certificates.k8s.io"
  resources:
  - certificatesigningrequests/selfnodeclient
  - certificatesigningrequests/selfnodeserver
  verbs:

	recognizers := []csrRecognizer{
		{
			recognize:      isSelfNodeClientCert,
			permission:     authorization.ResourceAttributes{Group: "certificates.k8s.io", Resource: "certificatesigningrequests", Verb: "create", Subresource: "selfnodeclient", Version: "*"},
			successMessage: "Auto approving self kubelet client certificate after SubjectAccessReview.",
		},
		{
			recognize:      isNodeClientCert,