According http://static.open-scap.org/ssg-guides/ssg-ocp4-guide-cis.html#xccdf_org.ssgproject.content_rule_rbac_wildcard_use the usage of wildcard in ClusterRole and Roles should be prevented as best as possible.

Further, one should refrain from using `cluster-admin` permissions to comply with CIS security requirements.

It's therefore requested to review the below serviceAccount and their associated Roles as they were found not to be compliant with the above and restrict permissions further to the extend possible.

• system:serviceaccount:openshift-kube-apiserver-operator:kube-apiserver-operator
• system:serviceaccount:openshift-kube-apiserver:installer-sa
• system:serviceaccount:openshift-kube-apiserver:localhost-recovery-client