 for istiod to approve certificate signing by custom signer
          - kind: ClusterRole
            name: istiod-istio-system
            patches:
              - path: rules[-1]
                value: |
                  apiGroups:
                  - certificates.k8s.io
                  resourceNames:
                  # Name of k8s external Signer in this example
                  - example.com/foo
                  resources:
                  - signers
                  verbs:
                  - ap