$ cat /tmp/setup.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: uber-csr-approver
rules:
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  verbs:
  - create
- apiGroups:
  - certificates.k8s.io
  resourceNames:
  - example.com/*
  resources:
  - signers
  verbs:
  - approve
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: delegator-uber-csr-approver
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: uber-csr-approver
subjects:
- kind: ServiceAccount
  name: delegator
  namespace: csr-test
---
apiVersion: v1
kind: Namespace
metadata:
  name: csr-test
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: delegator
  namespace: csr-test

$ kubectl apply -f /tmp/setup.yaml
clusterrole.rbac.authorization.k8s.io/uber-csr-approver created
clusterrolebinding.rbac.authorization.k8s.io/delegator-uber-csr-approver created
namespace/csr-test created
serviceaccount/delegator created

$ cat /tmp/delegate.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: specific-csr-approver
rules:
- apiGroups:
  - certificates.k8s.io
  resourceNames:
  - example.com/specific
  resources:
  - signers
  verbs:
  - approve

$ kubectl --as system:serviceaccount:csr-test:delegator apply -f /tmp/delegate.yaml
Error from server (Forbidden): error when creating "/tmp/csr.yaml": clusterroles.rbac.authorization.k8s.io "specific-csr-approver" is forbidden: user "system:serviceaccount:csr-test:delegator" (groups=["system:serviceaccounts" "system:serviceaccounts:csr-test" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:["certificates.k8s.io"], Resources:["signers"], ResourceNames:["example.com/specific"], Verbs:["approve"]}