diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index a554373..d825cd7 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -64,6 +64,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - irsa.kkb0318.github.io
   resources:
diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go
index 46c3120..71f49f0 100644
--- a/internal/controller/irsasetup_controller.go
+++ b/internal/controller/irsasetup_controller.go
@@ -51,6 +51,7 @@ type IRSASetupReconciler struct {
 //+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="apps",resources=deployments,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups="certificates.k8s.io",resources=certificatesigningrequests,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterroles,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterrolebindings,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=mutatingwebhookconfigurations,verbs=get;list;watch;create;update;patch;delete