← Permission Reference
T2
update certificatesigningrequests/status
Writes certificate bytes into a CertificateSigningRequest's status.
Rejected without the sign verb on signers for the request's exact signerName, and even then the bytes only authenticate if a CA the API server already trusts actually signed them.
Requires these verbs, still T2:
Certificate bytes published into a CSR, conferring no authentication
Permits the write only.
Authentication depends on possessing a trusted CA key, which this pair does not grant, so this is data manipulation rather than issuance.
An attacker who already holds such a key does not need these permissions.
- API Group
- certificates.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse