For the 1.8.0 release, we found that kubeadm was enabling certificate
rotation, but didn't properly add the RBAC bindings to allow the new
CSRs to get auto-approved. As a stop-gap, we documented how to manually
approve these CSRs as part of the upgrade, but this change is to trade
those instructions for actually creating an RBAC binding to allow the
auto-approval to happen.
This has the added benefit that when certificates start to expire and
need to be rotated, the approval will be automatic, unlike the previous
one-off solution.
Jacob Beacham
9388b5f0b2