Impersonate system:serviceaccount:kube-system:clusterrole-aggregation-controller

That SA has escalate on all ClusterRoles by default

Patch own bound ClusterRole to inject */* rules via impersonation