k8s 证书认证问题

如下节点的证书请求被我 deny 后,然后再 approve，为什么还是 deny 的状态？

[root@k8s01 ~]# kubectl get csr NAME AGE REQUESTOR CONDITION node-csr-g0V5uKekQ2OuHzUkK9EIXphayh1_2M7EGmyz38k_I4U 57m kubelet-bootstrap Denied

[root@k8s01 ~]# kubectl certificate approve --recursive=true node-csr-g0V5uKekQ2OuHzUkK9EIXphayh1_2M7EGmyz38k_I4U certificatesigningrequest.certificates.k8s.io/node-csr-g0V5uKekQ2OuHzUkK9EIXphayh1_2M7EGmyz38k_I4U approved

[root@k8s01 ~]# kubectl get csr NAME AGE REQUESTOR CONDITION node-csr-g0V5uKekQ2OuHzUkK9EIXphayh1_2M7EGmyz38k_I4U 57m kubelet-bootstrap Denied