Merge pull request #40760 from mikedanese/gce

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

enable kubelet csr bootstrap in GCE/GKE

@jcbsmpsn @pipejakob 

Fixes https://github.com/kubernetes/kubernetes/issues/31168

```release-note
Enable kubelet csr bootstrap in GCE/GKE
```

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -278,6 +278,7 @@ func init() {
 		Rules: []rbac.PolicyRule{
 			rbac.NewRule("get", "list", "watch").Groups(certificatesGroup).Resources("certificatesigningrequests").RuleOrDie(),
 			rbac.NewRule("update").Groups(certificatesGroup).Resources("certificatesigningrequests/status", "certificatesigningrequests/approval").RuleOrDie(),
+			rbac.NewRule("create").Groups(authorizationGroup).Resources("subjectaccessreviews").RuleOrDie(),
 			eventsRule(),
 		},
 	})

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml

@@ -73,6 +73,12 @@ items:
     - certificatesigningrequests/status
     verbs:
     - update
+  - apiGroups:
+    - authorization.k8s.io
+    resources:
+    - subjectaccessreviews
+    verbs:
+    - create
   - apiGroups:
     - ""
     resources: