C-1 from Project Glasswing security audit of hawtio-operator. The operator reads the OpenShift Service CA private signing key and mints client certificates with a Subject CN supplied by the unprivileged author of the namespaced Hawtio CR. Any principal holding the edit or admin aggregated role in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject, enabling impersonation of any in-cluster service identity. Source: hawtio-operator-security-audit.json#C-1.